今天找到的 bb8ca79b b25b5397

显示全部楼层 · 发表于 2007-11-3 10:18:01

咖啡杀3个启发2个

显示全部楼层 · 发表于 2007-11-3 13:27:44

D:\kawdcaz.exe - infected with Trojan.PWS.Gamania.origin
D:\kawdczy.dll - infected with Trojan.PWS.Gamania.origin

D:\ratbgtl.rar\ratbgtl.exe - infected with Trojan.MulDrop.9496

Drweb 4.44 Kill All

显示全部楼层 · 发表于 2007-11-3 15:19:32

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WMIPRVSE\KAWDCAZ.EXE
1) C:\DFD2780998.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WMIPRVSE\KAWDCAZ.EXE
1) C:\DFD2780998.BAT
是否删除可疑程序?
ratbgtl.exe微点PASS
wmiprvse.exe微点PASS

显示全部楼层 · 发表于 2007-11-3 18:12:05

KIS7
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.gpx 文件: D:\Downloads\wmiprvse.rar/kawdcaz.exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.gql 文件: D:\Downloads\wmiprvse.rar/kawdczy.dll
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.gqn 文件: D:\Downloads\ratbgtl.rar/ratbgtl.exe//UPack

显示全部楼层 · 发表于 2007-11-3 20:19:26

卡巴6：
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.gpx 文件: C:\Documents and Settings\Administrator\桌面\wmiprvse.rar/kawdcaz.exe
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.gql 文件: C:\Documents and Settings\Administrator\桌面\wmiprvse.rar/kawdczy.dll
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.gqn 文件: C:\Documents and Settings\Administrator\桌面\ratbgtl.rar/ratbgtl.exe//UPack

小红伞：
Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\wmiprvse.rar'
C:\Documents and Settings\Administrator\桌面\wmiprvse.rar
  [0] Archive type: RAR
  --> kawdcaz.exe
   [DETECTION] Is the Trojan horse TR/FWDisable.20842
  --> kawdczy.dll
   [DETECTION] Is the Trojan horse TR/FWDisable.20842
   [WARNING] The file was ignored!
Begin scan in 'C:\Documents and Settings\Administrator\桌面\ratbgtl.rar'
C:\Documents and Settings\Administrator\桌面\ratbgtl.rar
  [0] Archive type: RAR
  --> ratbgtl.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gqn
   [WARNING] The file was ignored!

BD2008：
Remaining issues:Object Name Threat Name Final Status
C:\Documents and Settings\Administrator\桌面\wmiprvse.rar=]kawdczy.dll BehavesLike:Trojan.WUDisable Infected
C:\Documents and Settings\Administrator\桌面\ratbgtl.rar=]ratbgtl.exe DeepScan:Generic.Dld.Agent.141568DD Infected
C:\Documents and Settings\Administrator\桌面\wmiprvse.rar=]kawdcaz.exe DeepScan:Generic.Dld.Agent.4E4F9FE5 Infected

[病毒样本] 今天找到的 bb8ca79b b25b5397