终于遭遇毒网

显示全部楼层 · 发表于 2007-5-16 08:49:05

我进去了MCAFEE也是没报

那个报的是5楼的样本

显示全部楼层 · 发表于 2007-5-16 08:56:00

detected: virus Downloader (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\bind_50080.rar/bind_50080.exe//data.rar/bind_50080.exe

显示全部楼层 · 发表于 2007-5-16 10:40:28

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Zelda\桌面\bind_50080.exe'
C:\Documents and Settings\Zelda\桌面\bind_50080.exe
  [0] Archive type: RAR SFX (self extracting)
  --> dodolook144.exe
   [DETECTION] Is the Trojan horse TR/Drop.RKit.Cinm.M
  --> bind_50080.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    A backup was created as '46b86f53.qua'  ( QUARANTINE )
   [INFO]    The file was successfully wiped!
   [INFO]    The file was deleted!

End of the scan: 2007年5月16日  10:39
Used time: 00:06 min

The scan has been done completely.

   0 Scanning directories
   3 Files were scanned
   2 viruses and/or unwanted programs were found
   1 classified as suspicious:
   1 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   0 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes
   0 Hidden objects were found

红伞报了一个RootKit??

显示全部楼层 · 发表于 2007-5-16 10:42:01

Scan performed at: 2007-5-16 10:42:07
Scanning Log
NOD32 version 2269 (20070516) NT
Command line: C:\Documents and Settings\EQ2\桌面\bind_50080.rar
Operating memory - is OK

Date: 16.5.2007 Time: 10:42:12
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\bind_50080.rar
C:\Documents and Settings\EQ2\桌面\bind_50080.rar ?RAR ?bind_50080.exe ?RAR ?dodolook144.exe ?NSIS ?268.exe ?NSIS ?acpidisk.sys - a variant of Win32/Adware.Cinmus application - was a part of the deleted object
Number of scanned files: 6
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 10:42:12 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-5-16 10:43:50

是不是已经被站长清理了，那个网页现在不报

显示全部楼层 · 发表于 2007-5-16 12:06:00

卡巴报了

显示全部楼层 · 发表于 2007-5-16 12:19:45

Hello,

bind_50080.exe_ - not-a-virus:AdWare.Win32.Cinmus.u

This file is an Advertizing Tool, It's detection will be included in
the next
update of extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

Please quote all when answering.

--
Best regards, Boris Yampolsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

显示全部楼层 · 发表于 2007-5-16 16:32:26

那个样本中好多东西！一运行，微点的黑框就弹个不停。

显示全部楼层 · 发表于 2007-5-16 19:50:44

PCC MISS

显示全部楼层 · 发表于 2007-5-19 14:19:37

网页无毒样本 RootKit.Agent.wq 瑞星报

[病毒样本] 终于遭遇毒网

回复 #10 tracydk 的帖子