adware

显示全部楼层 · 发表于 2007-4-1 11:34:24

Scan performed at: 2007-4-1 11:33:54
Scanning Log
NOD32 version 2160 (20070331) NT
Command line: C:\Documents and Settings\EQ2\桌面\复件 3_1175114219.rar C:\Documents and Settings\EQ2\桌面\复件 2_1175114199.rar C:\Documents and Settings\EQ2\桌面\复件 1_1175114187.rar
Operating memory - is OK
Date: 1.4.2007 Time: 11:33:58
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\复件 3_1175114219.rar; C:\Documents and Settings\EQ2\桌面\复件 2_1175114199.rar; C:\Documents and Settings\EQ2\桌面\复件 1_1175114187.rar
C:\Documents and Settings\EQ2\桌面\复件 3_1175114219.rar ?RAR ?d.dll - Win32/Adware.DM application - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\复件 2_1175114199.rar ?RAR ?WNSO.exe - Win32/Adware.DM application - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\复件 2_1175114199.rar ?RAR ?a.dll - Win32/Adware.DM application - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\复件 2_1175114199.rar ?RAR ?b.exe - Win32/Adware.DM application - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\复件 1_1175114187.rar ?RAR ?c.dll - Win32/Adware.DM application - was a part of the deleted object
Number of scanned files: 10
Number of threats found: 5
Number of files cleaned: 3
Time of completion: 11:33:59 Total scanning time: 1 sec (00:00:01)

显示全部楼层 · 发表于 2007-4-1 11:39:47

驱逐舰报五个

显示全部楼层 · 发表于 2007-4-1 11:39:49

扫描报告
2007年4月1日 11:39:30 - 11:39:35
计算机名称: 0553A719C5644CE
扫描类型: 扫描目标
目标: C:\Documents and Settings\Administrator\桌面\3_1175114219.rar C:\Documents and Settings\Administrator\桌面\2_1175114199.rar C:\Documents and Settings\Administrator\桌面\1_1175114187.rar

--------------------------------------------------------------------------------

结果: 发现 5 恶意软件
AdWare.Win32.Dm.y (adware)
C:\Documents and Settings\Administrator\桌面\3_1175114219.rar\d.dll
C:\Documents and Settings\Administrator\桌面\2_1175114199.rar\WNSO.exe
C:\Documents and Settings\Administrator\桌面\2_1175114199.rar\a.dll
C:\Documents and Settings\Administrator\桌面\2_1175114199.rar\b.exe
C:\Documents and Settings\Administrator\桌面\1_1175114187.rar\c.dll

--------------------------------------------------------------------------------

统计信息
已扫描:
文件: 10
尚未扫描: 0
结果:
病毒: 0
间谍软件: 5
可疑项目: 0
危险软件: 0
操作:
已杀毒: 0
已重命名: 0
已删除邮件: 0
已隔离: 0
失败: 0
启动扇区:
已扫描: 0
已感染: 0
可疑项目: 0
已杀毒: 0

--------------------------------------------------------------------------------

选项
定义版本:
病毒: 2007-03-31_02
间谍软件: 2007-03-31_02
扫描引擎:
F-Secure AVP: 7.00.171, 2007-03-31
F-Secure Libra: 2.04.01, 2007-03-30
F-Secure Orion: 1.02.37, 2007-03-30
F-Secure Draco: 1.00.35, 2007-03-26
扫描选项:
扫描定义的文件: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ANI AVB BAT CEO CMD LSP MAP MHT MIF PHP POT WMF NWS TAR TGZ ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQX
扫描内部存档
操作:
病毒: 扫描后询问
间谍软件: 扫描后询问

--------------------------------------------------------------------------------

版权 © 1998-2007 产品支持 | 发送病毒样本到 F-Secure

显示全部楼层 · 发表于 2007-4-1 11:40:31

费尔的特征库全搞定了

显示全部楼层 · 发表于 2007-4-1 11:46:53

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用

===============================================
___________病毒查杀结果__________________

===============================================

2007年4月1日11时46分46秒开始查杀C:\Documents and Settings\Administrator\桌面\新建文件夹\新建文件夹 (8)\3_1175114219
C:\Documents and Settings\Administrator\桌面\新建文件夹\新建文件夹 (8)\3_1175114219\WNSO.exe 发现未知可疑文件:Win32.NkHack.PEC.A 操作:阻止运行
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\新建文件夹 (8)\3_1175114219\b.exe
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。

-----------------------------------------

2007年4月1日11时46分46秒收起线程…100% 查杀完毕！
扫描文件：5查杀病毒：2

显示全部楼层 · 发表于 2007-4-1 11:50:14

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-3-25
Start time: 2007-4-1 11:49
Engine(s): KAV engine (AVK 17.3527), BD-Engine (BD 17.2421)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: c.dll
In archive: C:\Documents and Settings\Administrator\桌面\1_1175114187.rar
Status: Virus detected
Virus: not-a-virus:AdWare.Win32.Dm.y (KAV engine), Adware.DM (BD-Engine)
Object: 1_1175114187.rar
Path: C:\Documents and Settings\Administrator\桌面
Status: Move file into quarantine
Virus: not-a-virus:AdWare.Win32.Dm.y (KAV engine), Adware.DM (BD-Engine)
Object: WNSO.exe
In archive: C:\Documents and Settings\Administrator\桌面\2_1175114199.rar
Status: Virus detected
Virus: not-a-virus:AdWare.Win32.Dm.y (KAV engine), Adware.DM (BD-Engine)
Object: a.dll
In archive: C:\Documents and Settings\Administrator\桌面\2_1175114199.rar
Status: Virus detected
Virus: not-a-virus:AdWare.Win32.Dm.y (KAV engine), Adware.DM (BD-Engine)
Object: b.exe
In archive: C:\Documents and Settings\Administrator\桌面\2_1175114199.rar
Status: Virus detected
Virus: not-a-virus:AdWare.Win32.Dm.y (KAV engine), Adware.DM (BD-Engine)
Object: front.sys
In archive: C:\Documents and Settings\Administrator\桌面\2_1175114199.rar
Status: Virus detected
Virus: Trojan.Agent.XC (BD-Engine)
Object: 2_1175114199.rar
Path: C:\Documents and Settings\Administrator\桌面
Status: Move file into quarantine
Virus: not-a-virus:AdWare.Win32.Dm.y (3x) (KAV engine), Adware.DM (3x), Trojan.Agent.XC (BD-Engine)
Object: d.dll
In archive: C:\Documents and Settings\Administrator\桌面\3_1175114219.rar
Status: Virus detected
Virus: not-a-virus:AdWare.Win32.Dm.y (KAV engine), Adware.DM (BD-Engine)
Object: 3_1175114219.rar
Path: C:\Documents and Settings\Administrator\桌面
Status: Move file into quarantine
Virus: not-a-virus:AdWare.Win32.Dm.y (KAV engine), Adware.DM (BD-Engine)
Analysis complete: 2007-4-1 11:49
3 files checked
3 infected files detected
0 suspected files detected

显示全部楼层 · 发表于 2007-4-1 12:44:56

显示全部楼层 · 发表于 2007-4-1 12:55:43

Starting the file scan:

Begin scan in 'D:\2_1175114199.rar'
D:\
  2_1175114199.rar
  2_1175114199.rar:Zone.Identifier
[0] Archive type: RAR
--> WNSO.exe
      [DETECTION] Is the Trojan horse TR/Agent.39936
      [WARNING] Infected files in archives cannot be repaired!
--> roreg.sys
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/DesktopMedia.V
      [WARNING] Infected files in archives cannot be repaired!
--> front.sys
      [DETECTION] Is the Trojan horse TR/Agent.XC.2
      [WARNING] Infected files in archives cannot be repaired!
--> a.dll
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Drop.WSea.L.1
      [WARNING] Infected files in archives cannot be repaired!
--> b.exe
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Dm.BA.2
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!
Begin scan in 'D:\3_1175114219.rar'
D:\
  3_1175114219.rar
  3_1175114219.rar:Zone.Identifier
[0] Archive type: RAR
--> d.dll
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Dm.Y.3
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!
Begin scan in 'D:\1_1175114187.rar'
D:\
  1_1175114187.rar
  1_1175114187.rar:Zone.Identifier
[0] Archive type: RAR
--> c.dll
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/Dm.Y.2
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-4-1 14:15:40

卡巴报警

显示全部楼层 · 发表于 2007-4-1 17:28:39

KIS报5个
已删除: 广告程序 not-a-virus:AdWare.Win32.Dm.y 文件: D:\Downloads\1_1175114187.rar\c.dll
已删除: 广告程序 not-a-virus:AdWare.Win32.Dm.y 文件: D:\Downloads\2_1175114199.rar\WNSO.exe/PE_Patch.PECompact/PecBundle/PECompact
已删除: 广告程序 not-a-virus:AdWare.Win32.Dm.y 文件: D:\Downloads\2_1175114199.rar\a.dll
已删除: 广告程序 not-a-virus:AdWare.Win32.Dm.y 文件: D:\Downloads\2_1175114199.rar\b.exe
已删除: 广告程序 not-a-virus:AdWare.Win32.Dm.y 文件: D:\Downloads\3_1175114219.rar\d.dll

[病毒样本] adware

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源