测测

pc9x

updaterun.exe
注册表
rundll2kxp.exe
ocmor.dll
rfpcp.dll
写进export
还继续调用rundll32.dll   还有svchost.exe  带  net 参数
运行bar.exe

[ 本帖最后由 pc9x 于 2007-4-26 13:38 编辑 ]

mofunzone

自己手动脱，终于给他扒光了，我喜欢看病毒在裸替的状态。。
barsetup[1]依然会说nsis错误，但是东西已经进去了
bar是主程序，剩下的就是一些什么乱七八糟的dll了，9个antivir杀了7个，剩下上报了

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\ocmor.dll'
C:\Documents and Settings\morgan\My Documents\
  ocmor.dll
      [DETECTION] Is the Trojan horse TR/Dldr.QQHe.FT.5.D
      [WARNING]   The file was ignored!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\bar.exe'
C:\Documents and Settings\morgan\My Documents\
  bar.exe
      [DETECTION] Contains signature of the dropper DR/Click.Agent.IO.2
      [WARNING]   The file was ignored!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\barsetup[1].exe'
C:\Documents and Settings\morgan\My Documents\
  barsetup[1].exe
      [DETECTION] Is the Trojan horse TR/Dldr.QQhelper.DB
      [WARNING]   The file was ignored!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\Updaterun.exe'
C:\Documents and Settings\morgan\My Documents\
  Updaterun.exe
Begin scan in 'C:\Documents and Settings\morgan\My Documents\superutilbar.dll'
C:\Documents and Settings\morgan\My Documents\
  superutilbar.dll
      [DETECTION] Is the Trojan horse TR/Click.Agent.IO.7
      [WARNING]   The file was ignored!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\uninst.exe'
C:\Documents and Settings\morgan\My Documents\
  uninst.exe
      [DETECTION] Contains signature of the Ad- or Spyware ADSPY/BaiduBar.BR
      [WARNING]   The file was ignored!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\advport.dll'
C:\Documents and Settings\morgan\My Documents\
  advport.dll
Begin scan in 'C:\Documents and Settings\morgan\My Documents\pvpep.dll'
C:\Documents and Settings\morgan\My Documents\
  pvpep.dll
      [DETECTION] Is the Trojan horse TR/Drop.QQHelpe.q.3
      [WARNING]   The file was ignored!
Begin scan in 'C:\Documents and Settings\morgan\My Documents\mjjqs.dll'
C:\Documents and Settings\morgan\My Documents\
  mjjqs.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!


End of the scan: 2007年4月25日  22:41
Used time: 00:09 min

The scan has been done completely.

      0 Scanning directories
      9 Files were scanned
      7 viruses and/or unwanted programs were found
      1 classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      0 Archives were scanned
      7 Warnings
      0 Notes
      0 Hidden objects were found

alexliu

绅博周幸

看来世界最强启发还有待提高啊[:26:] [:26:] [:27:]

bluenice

卡巴7.0启发报了一个。

红心王子

KIS621飘过

曲中求

NOD 32：

Scan performed at: 2007-4-26 15:18:05
Scanning Log
NOD32 version 2219 (20070425) NT
Command line: E:\病毒\My Documents[1].part1

Date: 26.4.2007  Time: 15:18:07
Anti-Stealth technology is enabled.
Scanned disks, folders and files: E:\病毒\My Documents[1].part1\
E:\病毒\My Documents[1].part1\bar.exe - Win32/Adware.Toolbar.Baidu application
E:\病毒\My Documents[1].part1\barsetup[1].exe - a variant of Win32/TrojanDownloader.QQHelper trojan
E:\病毒\My Documents[1].part1\mjjqs.dll - a variant of Win32/TrojanDownloader.QQHelper.AJ trojan
E:\病毒\My Documents[1].part1\pvpep.dll - a variant of Win32/TrojanDownloader.QQHelper trojan
E:\病毒\My Documents[1].part1\superutilbar.dll - Win32/Adware.Toolbar.Baidu application
E:\病毒\My Documents[1].part1\Updaterun.exe - a variant of Win32/Adware.Toolbar.Baidu application
Number of scanned files: 8
Number of threats found: 6
Time of completion: 15:18:14 Total scanning time: 7 sec (00:00:07)

7sumetai

卡巴的速度…… 现在已经会报了……
已检测到: 木马程序 Trojan-Downloader.Win32.QQHelper.wd        URL: http://bbs.kafan.cn/attachment.php?aid=60051//bind_50287.exe

蓝色牛仔裤

这个是不是攻击肉鸡用的??

chow2006

过了费尔