小众快餐释放的木马程序 [MD5: C9F8B]

aoyang

http://bbs.kafan.cn/viewthread.php?tid=94345&pid=1162331&page=1&extra=page%3D1
这个帖子的样本释放的一个木马
具体地址在C:\Program Files\Outlook Express\mqq.dll

tracydk

小邪邪

咖啡杀：PWS-QQPass.dll (特洛伊)  

wangjay1980

detected: Trojan program Trojan-PSW.Win32.QQPass.hn        URL: http://bbs.kafan.cn/attachment.php?aid=83618//mqq.dll

The EQs

Scan performed at: 2007-6-7 21:38:55
Scanning Log
NOD32 version 2315 (20070607) NT
Command line: C:\Documents and Settings\EQ2\桌面\mqq.rar
Operating memory - is OK

Date: 7.6.2007  Time: 21:39:00
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\mqq.rar
C:\Documents and Settings\EQ2\桌面\mqq.rar ?RAR ?mqq.dll - probably a variant of Win32/PSW.QQShou.EH trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 21:39:00 Total scanning time: 0 sec (00:00:00)

taihuxian

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.

lioney

The requested URL http://bbs.kafan.cn/attachment.php?aid=83618 is infected with Trojan-PSW.Win32.QQPass.hn virus

蓝色牛仔裤

[Scan path] C:\Documents and Settings\Administrator\桌面\mqq.rar
>C:\Documents and Settings\Administrator\桌面\mqq.rar\mqq.dll infected with Trojan.PWS.Qqpass.488
C:\Documents and Settings\Administrator\桌面\mqq.rar - archive contains infected objects

fireworld

金山可以查杀

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\mqq.rar'
C:\Documents and Settings\Administrator\My Documents\
  mqq.rar
    [0] Archive type: RAR
    --> mqq.dll
        [DETECTION] Is the Trojan horse TR/PSW.QQPass.HN.29
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!