system32\setup\avchost[MD5: AB45C7]

fanuq

一个隐蔽的文件名！
我的卡巴一直开着，还是让人家给启动了！
大家的system32文件夹下面有setup文件夹吗？

[ 本帖最后由 fanuq 于 2007-7-22 16:28 编辑 ]

snakebone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\svchost.rar'
C:\Documents and Settings\Administrator\桌面\
  svchost.rar
    [0] Archive type: RAR
    --> svchost.exe
        [DETECTION] Is the Trojan horse TR/Dldr.Agent.24576.7
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      A backup was created as '470611eb.qua'  ( QUARANTINE )
        [INFO]      The file was deleted!

scottxzt

svchost.rar\svchost.exe;D:\Documents and Settings\dell\桌面\svchost.rar;Trojan.DownLoader.28172;;

solcroft

yurius

Sign of "Win32:Qqhelper-DL [Trj]" has been found in "http://bbs.kafan.cn/attachment.php?aid=103821\svchost.exe" file.

微点卫士

金山报！

微点：
木马名称:Trojan-Downloader.Win32.QQHelper.eze

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.547\SVCHOST.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

woai_jolin

2007/7/22 16:26:03        Scanning Log
2007/7/22 16:26:03        Version of virus signature database: 2411 (20070721)
2007/7/22 16:26:03        Date: 22.7.2007  Time: 16:26:03
2007/7/22 16:26:03        Scanned disks, folders and files: F:\v\
2007/7/22 16:26:03        F:\v\svchost.rar - probably a variant of Win32/TrojanDownloader.QQHelper.NDD trojan - deleted - quarantined
2007/7/22 16:26:03        F:\v\svchost.rar » RAR » svchost.exe - probably a variant of Win32/TrojanDownloader.QQHelper.NDD trojan
2007/7/22 16:26:03        Number of scanned files: 2
2007/7/22 16:26:03        Number of threats found: 1
2007/7/22 16:26:03        Time of completion: 16:26:03  Total scanning time: 0 sec (00:00:00)

woai_jolin

卡巴PASS

红心王子

C:\Documents and Settings\Administrator\桌面\svch
ost.rar>>svchost.exe       Trojan.DL.Win32.Agent.wyk

l784588

avast灭之,报Win32:Qqhelper-DL [Trj]