F61A1B

promised

1

残缺的唯美

Scan performed at: 2007-9-15 12:18:39
Scanning Log
NOD32 version 2531 (20070915) NT
Command line: D:\Documents and Settings\EKINCHENG\桌面\minstall.zip

Date: 15.9.2007  Time: 12:18:41
Anti-Stealth technology is enabled.
Scanned disks, folders and files: D:\Documents and Settings\EKINCHENG\桌面\minstall.zip
D:\Documents and Settings\EKINCHENG\桌面\minstall.zip ?ZIP ?minstall.exe - probably a variant of Win32/Genetik trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 12:18:41 Total scanning time: 0 sec (00:00:00)

红心王子

反病毒引擎	版本	最后更新	扫描结果
AhnLab-V3	2007.9.14.0	2007.09.14	-
AntiVir	7.6.0.10	2007.09.14	-
Authentium	4.93.8	2007.09.15	-
Avast	4.7.1043.0	2007.09.14	-
AVG	7.5.0.485	2007.09.14	-
BitDefender	7.2	2007.09.15	-
CAT-QuickHeal	9.00	2007.09.14	-
ClamAV	0.91.2	2007.09.15	-
DrWeb	4.33	2007.09.14	-
eSafe	7.0.15.0	2007.09.13	-
eTrust-Vet	31.1.5136	2007.09.14	-
Ewido	4.0	2007.09.14	-
FileAdvisor	1	2007.09.15	-
Fortinet	3.11.0.0	2007.09.15	-
F-Prot	4.3.2.48	2007.09.15	-
F-Secure	6.70.13030.0	2007.09.15	-
Ikarus	T3.1.1.12	2007.09.15	-
Kaspersky	4.0.2.24	2007.09.15	-
McAfee	5120	2007.09.14	-
Microsoft	1.2803	2007.09.15	-
NOD32v2	2531	2007.09.15	probably a variant of Win32/Genetik
Norman	5.80.02	2007.09.14	-
Panda	9.0.0.4	2007.09.14	-
Prevx1	V2	2007.09.15	Heuristic: Suspicious Self Modifying File
Rising	19.40.50.00	2007.09.15	-
Sophos	4.21.0	2007.09.15	-
Sunbelt	2.2.907.0	2007.09.15	-
Symantec	10	2007.09.15	Trojan.Farfli
TheHacker	6.2.5.060	2007.09.14	-
VBA32	3.12.2.4	2007.09.14	-
VirusBuster	4.3.26:9	2007.09.14	-
Webwasher-Gateway	6.0.1	2007.09.14	-

欠妳緈諨

这个Win32/Genetik trojan已经是NOD32的撒手锏，无敌了

微点卫士

微点：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MINSTALL.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:1557
远端地址:58.211.7.35(江苏·苏州)
远端端口:80

生成了3个东西，微点居然挂了。

1688388728

2007-09-15 14:26:34    修改文件      操作:允许
进程路径:D:\病毒库\minstall\minstall.exe
文件路径:D:\我的文档\Favorites\收藏.url
触发规则:黑名单->文件保护->D:\我的文档\*


2007-09-15 14:26:34    创建文件      操作:阻止
进程路径:D:\病毒库\minstall\minstall.exe
文件路径:C:\WINDOWS\system32\drivers\dbjp4rzv80.sys
触发规则:所有程序规则->文件规则->%systemdrive%\*.sys


2007-09-15 14:26:37    创建文件      操作:阻止
进程路径:D:\病毒库\minstall\minstall.exe
文件路径:C:\WINDOWS\system32\drivers\c6a3pi.sys
触发规则:所有程序规则->文件规则->%systemdrive%\*.sys


2007-09-15 14:26:37    创建文件      操作:阻止
进程路径:D:\病毒库\minstall\minstall.exe
文件路径:C:\WINDOWS\system32\mgoj.dll
触发规则:所有程序规则->文件规则->%systemdrive%\*.dll

timhas266

Kaspersky Internet Security 7.0

The requested URL http://bbs.kafan.cn/attachment.php?aid=127857 is infected with Trojan-Downloader.Win32.Agent.dkk virus

wangjay1980

这不是那个一直挂红伞和微点的嘛

kkgh

瑞星08主动防御拦截

taihuxian

Virus: Trojan-Downloader.Win32.Agent.dkk

Virus found while downloading Web content.

Address: bbs.kafan.cn