MD5 F4F50B 6080158.exe

allenhippo

promised

?           Copyright (c) 1993-2007 by VBA Ltd.            ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯?
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /af+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Ctrl-C will terminate program execution

*:
C:\
C:\ABC\6080158.zip:<ZIP>\6080158.exe : infected BackDoor.Huai
Program execution terminated by user


Directories       : 3       Files in archives:      Files on disks:
Archives:                   - total       : 3       - total       : 23
- scanned         : 2       -  scanned    : 3       - scanned     : 23
- contain viruses : 1       -  infected   : 1       - infected    : 1
- deleted         : 0       -  suspicious : 0       - suspicious  : 0

Startup    : 17:39:50 04-06-2007
End        : 17:39:54 04-06-2007
Total time : 00:00:04
终止批处理操作吗(Y/N)?

电影结束了

Scan performed at: 2007-6-4 17:40:29
Scanning Log
NOD32 version 2305 (20070601) NT
Command line: C:\Documents and Settings\wangcheng\桌面\6080158.zip
C:\Program Files\Eset\nod32.exe - is OK
Operating memory - is OK
MBR sector of the 1. physical disk - is OK
Active boot sector of the 1. physical disk - is OK - Error reading disk sectorError reading disk sectorError reading disk sector

Date: 4.6.2007  Time: 17:40:36
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\wangcheng\桌面\6080158.zip
C:\Documents and Settings\wangcheng\桌面\6080158.zip ?ZIP ?6080158.exe ?RAR ?dodolook246.exe ?NSIS ?System.dll - is OK
C:\Documents and Settings\wangcheng\桌面\6080158.zip ?ZIP ?6080158.exe ?RAR ?dodolook246.exe ?NSIS ?1145.exe ?NSIS ?System.dll - is OK
C:\Documents and Settings\wangcheng\桌面\6080158.zip ?ZIP ?6080158.exe ?RAR ?dodolook246.exe ?NSIS ?1145.exe ?NSIS ?DoSSSetup.dll - is OK
C:\Documents and Settings\wangcheng\桌面\6080158.zip ?ZIP ?6080158.exe ?RAR ?dodolook246.exe ?NSIS ?1145.exe ?NSIS ?acpidisk.sys - a variant of Win32/Adware.Cinmus application
C:\Documents and Settings\wangcheng\桌面\6080158.zip ?ZIP ?6080158.exe ?RAR ?bind_50454.exe - is OK
Number of scanned files: 6
Number of threats found: 1
Number of active threats: 1
Time of completion: 17:40:39 Total scanning time: 3 sec (00:00:03)

红心王子

费尔，卡巴7不报
上报。。。。。。。。

qwerasdf123

微点报联网
卡巴报增加driver

没有确定为木马或病毒
不过看那个连接的ip 应该是魔兽某个盗号木马的变种

allenhippo

主要是里面那个bind_50454.exe有问题，dodolook么小流氓一个。

tracydk

广告而已

伯夷叔齐

D:\病毒木马样本\6080158.zip
  [0] Archive type: ZIP
    --> 6080158.exe
      [1] Archive type: RAR SFX (self extracting)
      --> bind_50454.exe
          [DETECTION] Contains suspicious code HEUR/Malware

wangjay1980

好规范啊

蓝色牛仔裤

蜘蛛挂了。。。上报。。。