这个算不算毒呢?[MD5: 513B8A]

Anycall-D908

微点报未知木马,NOD32也报.但是我个人则怀疑....究竟算不算毒啊

标题后半部分：
[MD5: 513B8A]

论坛搜索字符串：
513B8A

计算简便工具在置顶帖子里，谢谢合作

navigateqd

[ 本帖最后由 navigateqd 于 2007-6-12 21:58 编辑 ]

solcroft

要看你对“毒”怎么下定义了
瑞星报广告软件

ALEXBLAIR

detected: adware not-a-virus:AdWare.Win32.BHO.av        URL: http://bbs.kafan.cn/attachment.p ... e//stream//data0001

foxhound

A-Squared	Found nothing
AntiVir	Found nothing
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found Trojan.BHO.BI
ClamAV	Found nothing
Dr.Web	Found Adware.Sogou
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found not-a-virus:AdWare.Win32.BHO.av (4, 1, 400)
Fortinet	Found nothing
Kaspersky Anti-Virus	Found not-a-virus:AdWare.Win32.BHO.av
NOD32	Found Win32/Adware.BHO.AV application
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

1688388728

回复

taihuxian

Virus: not-a-virus:AdWare.Win32.BHO.av

Virus found while downloading Web content.

Address: bbs.kafan.cn

taihuxian

[ 本帖最后由 taihuxian 于 2007-6-12 07:34 编辑 ]

a256886572008

運行ad5247.exe，發現下列行為，被EQ-Secure RC2攔截！
----------------------
2007-06-12 07:04:47    运行应用程序      操作:允许
进程路径:C:\WINDOWS\Explorer.EXE
文件路径:D:\桌面\virus\ad5247\ad5247.exe
规则:所有程序规则->ALL->*.*


2007-06-12 07:04:48    创建文件      操作:阻止
进程路径:D:\桌面\virus\ad5247\ad5247.exe
文件路径:C:\Program Files\Common Files\CPUSH
规则:所有程序规则->全局設置_普通模式->%SystemDrive%\*


2007-06-12 07:04:49    创建文件      操作:阻止
进程路径:D:\桌面\virus\ad5247\ad5247.exe
文件路径:C:\Program Files\Common Files\CPUSH\Uninst.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-12 07:04:49    创建文件      操作:阻止
进程路径:D:\桌面\virus\ad5247\ad5247.exe
文件路径:C:\Program Files\Common Files\CPUSH\cpush.dll
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.dll


2007-06-12 07:04:57    运行应用程序      操作:允许(自动创建规则)
进程路径:D:\桌面\virus\ad5247\ad5247.exe
文件路径:C:\WINDOWS\system32\regsvr32.exe
命令行:/s "C:\Program Files\Common Files\CPUSH\cpush.dll"


2007-06-12 07:04:57    创建文件      操作:阻止
进程路径:D:\桌面\virus\ad5247\ad5247.exe
文件路径:C:\Program Files\Common Files\CPUSH\cpush.tmp
规则:所有程序规则->全局設置_普通模式->%SystemDrive%\*


2007-06-12 07:04:57    创建注册表值      操作:阻止
进程路径:D:\桌面\virus\ad5247\ad5247.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
注册表名称:CPushSetup
注册表数据:"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files\Common Files\CPUSH\cpush.dll"
规则:所有程序规则->係統自動運行_普通模式->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*

-------------------------------------------------------------------
1.他會在C:\Program Files\Common Files\依序產生
   CPUSH
   CPUSH\Uninst.exe
   CPUSH\cpush.dll
2.他會利用regsvr32.exe
   /s "C:\Program Files\Common Files\CPUSH\cpush.dll"
3.他會在下列路徑產生cpush.tmp
   C:\Program Files\Common Files\CPUSH\
4.他會创建注册表值
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
   CPushSetup
   "C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files\Common Files\CPUSH\cpush.dll"

jlennon

rasis

cpush.tmp
      [DETECTION] Is the Trojan horse TR/Adware.BHO.AV