压缩前很肥[15BE9E]

promised

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\wxpSetup126.rar'
C:\Users\morgan\Documents\
  wxpSetup126.rar
    [0] Archive type: RAR
    --> wxpSetup126.exe
        [DETECTION] Is the Trojan horse TR/Dldr.Agent.dri
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

欠妳緈諨

changzheng2

wxpSetup126.exe : INFECTED with W32/Malware

[ DetectionInfo ]
    * SB name: W32/Malware
    * Compressed: NO

[ General information ]
    * Drops files in %WINSYS% folder.
    * **Locates window "NULL [class IEFrame]" on desktop.
    * Accesses executable file from resource section.

[ Changes to filesystem ]
    * Creates file C:\WINDOWS\SYSTEM32\8a08F8Lg.dll.
    * Creates file C:\WINDOWS\SYSTEM32\playasp.exe.txt.
    * Creates file C:\WINDOWS\SYSTEM32\playasp.exe.
    * Deletes file C:\WINDOWS\SYSTEM32\playasp.exe.txt.
    * Creates file C:\WINDOWS\SYSTEM32\jsshow.dll.txt.

[ Process/window information ]
    * Creates an event called .
    * Creates a mutex {0CC2EF0D-AE52-41B8-AB1E-26DB18A94FD4}.

[ Signature Scanning ]
    * C:\WINDOWS\SYSTEM32\8a08F8Lg.dll (33 bytes) : no signature detection.
    * C:\WINDOWS\SYSTEM32\playasp.exe (417280 bytes) : no signature detection.

微点卫士

广告软件名称:AdWare.Win32.MoKeAD.ee

程序:
C:\WINDOWS.0\SYSTEM32\JSHELP.EXE.TXT
是广告软件!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WXPSETUP126.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\PLAYASP.EXE
2) C:\WINDOWS.0\SYSTEM32\JSSHOW.DLL
3) C:\WINDOWS.0\SYSTEM32\DRIVERS\JSSHOW.SYS
是否删除木马程序及其衍生物?

Nerazzurri

solcroft

既然这个能防，就不测那个下载者了

残缺的唯美

D:\Documents and Settings\EKINCHENG\桌面\wxpSetup126.rar » RAR » wxpSetup126.exe - a variant of Win32/Adware.MoKeAD application
D:\Documents and Settings\EKINCHENG\桌面\wxpSetup126.rar - a variant of Win32/Adware.MoKeAD application - deleted - quarantined

wangfeng66

NOD 报间谍

king6808

已删除：木马程序 Trojan-Downloader.Win32.Delf.chj        文件: F:\10.1\wxpSetup126.rar/wxpSetup126.exe