挂很多c3b97b

promised

a-squared	3.0.0.123	2007.09.08	2007-09-08	-	3.959
Arcavir	1.0.4	200709081003	2007-09-08	-	1.244
AVAST	1.0.8	000773-3	2007-09-08	-	3.038
AVG	7.5.48.442	269.13.7/992	2007-09-06	-	1.492
BitDefender	7.60825.871834	7.14688	2007-09-09	-	3.137
CA (VET)	8.4.0.24	31.1.5119	2007-09-08	-	0.845
ClamAV	0.91.1	4205	2007-09-09	-	0.297
Comodo	2.11	2.0.0.279	2007-09-09	-	0.997
ewido	4.0.0.2	2007.09.09	2007-09-09	-	2.144
F-SECURE	5.51.6100	2007.09.09.01	2007-09-09	-	2.745
Hauri	20070907	2007.09.07	2007-09-07	-	0.454
IKARUS	T3.1.1.12	2007.09.09.69475	2007-09-09	suspicious(level 140)	2.839
MKS_VIR	2.01	2007.09.09	2007-09-09	-	2.010
NOD32	2.70.8	2515	2007-09-09	-	0.273
nProtect	2007-09-07.00	909334	2007-09-07	-	10.640
QuickHeal	9.00	2007.09.08	2007-09-08	W32.Bobic.L	2.133
SOPHOS	2.49.1	4.21	2007-09-09	Mal/Packer	2.539
The Hacker	6.1.10	v00182	2007-09-08	W32/Behav-Heuristic-066	0.681
VBA32	3.12.2.4	20070908.0321	2007-09-08	-	0.944
VirusBuster	4.3.19:9	9.103.2/11.0	2007-09-08	Packed/MEW	0.962
冰岛杀毒	3.16.16	2007.09.07	2007-09-07	-	1.395
卡巴斯基	5.5.10	2007.09.09	2007-09-09	-	0.219
大蜘蛛	4.33	2007.09.08	2007-09-08	-	4.925
小红伞	7.6.0.5	6.39.1.106	2007-09-08	HEUR/Malware	2.292
江民杀毒	10.00.650	2007.09.08	2007-09-08	-	0.789
熊猫卫士	9.04.03.0001	2007.09.09	2007-09-09	-	3.296
瑞星	19.0	19.39.62.00	2007-09-09	-	1.617
诺曼	5.91.07	5.90	2007-09-07	W32/Suspicious_M.gen	2.838
赛门铁克	1.3.0.24	20070908.008	2007-09-08	-	0.277
趋势	8.500-1001	4.705.00	2007-09-07	-	0.393
迈克菲	5.2.00	5115	2007-09-07	-	1.151
金山毒霸	2007.6.20.249	2007.9.8	2007-09-08	-	0.870

风野胤

MEW？
什么壳？

小邪邪

2007-9-9        21:45:06       
已由访问保护规则禁止 E:\Downloads\test\623\623.exe       
D:\Temp\delself0.bat       
防病毒爆发控制:将所有共享项设为只读       
已阻止的操作: 创建

wangjay1980

detected: virus Heur.Invader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\623.rar/623.exe//PE_Patch//MewBundle//MEW

promised

壳又不是我加的，下载者下的
貌似是个压缩壳

小邪邪

2007-9-9 21:46:22
已由访问保护规则禁止E:\Downloads\test\623\623.exe
D:\Temp\delself0.bat
通用标准保护:禁止公用程序从 Temp 文件夹运行文件
已阻止的操作: 执行

小邪邪

@echo off

:loop

del "E:\Downloads\test\623\623.exe"

if exist "E:\Downloads\test\623\623.exe" goto loop

del

nosferatu

扫描 : 已完成
-------------
已扫描：        8
检测到：        1
未处理：        0
开始时间：        2007-9-9 21:59:32
运行时间：        00:00:06
完成时间：        2007-9-9 21:59:38


检测到
------
状态        对象
----        ----
已删除：病毒 Heur.Invader (修改)        文件　: C:\Documents and Settings\Administrator\桌面\623.rar/623.exe//PE_Patch//MewBundle//MEW

ssy275

Starting the file scan:

Begin scan in 'C:\Documents and Settings\ssy\桌面\623.rar'
C:\Documents and Settings\ssy\桌面\623.rar
  [0] Archive type: RAR
  --> 623.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!

1688388728

卡巴斯基互联网安全套装 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=125809 is infected with Backdoor.Win32.Small.tf virus