[MD5: 217E3E 04F20A C10408 236BC4 1404CE]

zane_xzz

[MD5: 217E3E 04F20A C10408 236BC4 1404CE]

zane_xzz

Object: Pic168.gif
        Path: C:\Documents and Settings\Administrator\桌面
        Status: Virus detected
        Virus: HTML:Ascii-T [Expl] (Engine B)
Object: [UPX]
        In archive: C:\Documents and Settings\Administrator\桌面\S168.exe
        Status: Virus detected
        Virus: Win32:AutoRun-U (Engine B)
Object: S168.exe
        Path: C:\Documents and Settings\Administrator\桌面
        Status: Virus detected
        Virus: Win32:AutoRun-U (Engine B)
Object: S3682.exe\[Upack]
        In archive: C:\Documents and Settings\Administrator\桌面\calc.cab
        Status: Virus detected
        Virus: Win32:Tiny-LL [Trj] (Engine B)
Object: calc.cab
        Path: C:\Documents and Settings\Administrator\桌面
        Status: Virus detected
        Virus: Win32:Tiny-LL [Trj] (Engine B)
Object: Link168.gif
        Path: C:\Documents and Settings\Administrator\桌面
        Status: Virus detected
        Virus: HTML:Ascii-T [Expl] (Engine B)

无敌敏敏

Starting the file scan:

Begin scan in 'E:\桌面.rar'
E:\桌面.rar
  [0] Archive type: RAR
  --> S1682.exe
      [DETECTION] Contains suspicious code HEUR/Malware
    --> calc.cab
      [1] Archive type: CAB (Microsoft)
      --> S3682.exe
          [DETECTION] Is the Trojan horse TR/Agent.1416.1
  --> S168.exe
      [DETECTION] Is the Trojan horse TR/Autorun.BK
      [INFO]      The file was deleted!

capsshift

红伞启发的那一个，我用瑞星去试下。

taopaolang1982

C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » S1682.exe - a variant of Win32/TrojanDownloader.Tiny.Y trojan
C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » calc.cab » CAB » S3682.exe - Win32/TrojanDownloader.Tiny.Y trojan
C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » S168.exe - probably a variant of Win32/PSW.OnLineGames.NBR trojan

capsshift

瑞星报了红伞启发的。
但S168扫描放过了。

capsshift

运行了168.exe,好像主防拦截了，可不一会儿，下了一大堆东西。
看看自己的设置，原来是中防，好改高防再试一下。

capsshift

高防阻止了S168的一切行为。全部拒绝后，那个S168老老实实的待在那儿了。

啊弥陀佛

微点砍掉

欠妳緈諨