讨厌的广告[MD5: 31B71A 00C26A BDADCC]

allenhippo

一个skype安装包，夹杂了7，8个广告，下载者等等

运行了就下载cnnic啊，51地图这几个垃圾，沙盘里运行都不安全

[ 本帖最后由 allenhippo 于 2007-6-23 11:33 编辑 ]

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\virus.rar'
C:\Documents and Settings\Administrator\My Documents\
  virus.rar
    [0] Archive type: RAR
    --> 1160.exe
    --> dodolook006.exe
    --> my_70017.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

mofunzone

蜘蛛一个没有？？

[Scan path] C:\Documents and Settings\Administrator\My Documents\virus.rar
>>>C:\Documents and Settings\Administrator\My Documents\virus.rar\1160.exe\data001 - Ok
>>C:\Documents and Settings\Administrator\My Documents\virus.rar\1160.exe\data002 - Ok
>>C:\Documents and Settings\Administrator\My Documents\virus.rar\1160.exe\data003 - Ok
>>C:\Documents and Settings\Administrator\My Documents\virus.rar\1160.exe\data004 - Ok
>C:\Documents and Settings\Administrator\My Documents\virus.rar\1160.exe - Ok
>>>C:\Documents and Settings\Administrator\My Documents\virus.rar\dodolook006.exe\data001 - Ok
>>C:\Documents and Settings\Administrator\My Documents\virus.rar\dodolook006.exe\data002 - Ok
>>>>C:\Documents and Settings\Administrator\My Documents\virus.rar\dodolook006.exe\data003\data001 - Ok
>>>C:\Documents and Settings\Administrator\My Documents\virus.rar\dodolook006.exe\data003\data002 - Ok
>>>C:\Documents and Settings\Administrator\My Documents\virus.rar\dodolook006.exe\data003\data003 - Ok
>>>C:\Documents and Settings\Administrator\My Documents\virus.rar\dodolook006.exe\data003\data004 - Ok
>>C:\Documents and Settings\Administrator\My Documents\virus.rar\dodolook006.exe\data003 - Ok
>C:\Documents and Settings\Administrator\My Documents\virus.rar\dodolook006.exe - Ok
>C:\Documents and Settings\Administrator\My Documents\virus.rar\my_70017.exe - Ok
C:\Documents and Settings\Administrator\My Documents\virus.rar - Ok

tonger2003

卡巴飘了

电影结束了

扫描系统区域...
扫描所选择的目录和文件...
对象: 1160.exe=>(NSIS o) lzma_nsis0000
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\virus.rar
        Status: 已发现病毒
        病毒: Trojan.Cinmeng.A (BD 引擎)
对象: dodolook006.exe=>(NSIS o) lzma_nsis0000
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\virus.rar
        Status: 已发现病毒
        病毒: Trojan.Cinmus.P (BD 引擎)
对象: dodolook006.exe=>(NSIS o)=>lzma_nsis0002=>(NSIS o) lzma_nsis0000
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\virus.rar
        Status: 已发现病毒
        病毒: Trojan.Cinmeng.A (BD 引擎)
对象: virus.rar
        路径: C:\Documents and Settings\wangcheng\桌面
        Status: 已发现病毒
        病毒: Trojan.Cinmeng.A (2x), Trojan.Cinmus.P (BD 引擎)
扫描完成: 2007-6-23 11:39
    已检查 1 个文件
    已发现 1 个染毒文件
    发现 0 个可疑文件
bd杀广告还真不错
NOD32杀广告要加油Ｏ
C:\Documents and Settings\wangcheng\桌面\样本.rar »RAR »a.exe - a variant of Win32/PSW.Agent.NEW trojan

[ 本帖最后由 电影结束了 于 2007-6-23 11:39 编辑 ]

mofunzone

antivir不支持nsis是硬伤呀。。
直接报壳好了。。

allenhippo

那死定了，用nsis做的软件安装包全世界不知道有多少

aerbeisi

前两个在安装sys,卡巴主防suspicious driver install，最后一个下载者，可以拦截下载的东西，结束进程就可以了。
detected: Trojan program Trojan-Downloader.Win32.Agent.bbb        URL: http://install1.ring520.org/kkkk/mminstall.exe?queryid=70017

woai_jolin

ess pass

红心王子

费尔不报
AD就先不上报了