6

shaw530

是不是啊？江民也全过了

sunfaye

不会这么牛吧？

sam.to

Hello,

gmsoft.dll - Trojan-Downloader.Win32.Agent.ffe,
gmsoft.exe_ - Trojan-Downloader.Win32.Agent.ffd,
initgm.exe_ - Trojan-Downloader.Win32.Agent.fff

These files are already detected. Please update your antivirus
bases.

gmun.exe_

No malicious code was found in this file.

Install.exe_ - Trojan-Downloader.Win32.Agent.ffh

New malicious software was found in this file. It's detection
will be included in the next update. Thank you for your help.

schunin.exe_ - not-a-virus:AdWare.Win32.SPia.e

This file is an Advertizing Tool, it is detected by
extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

Please quote all when answering.

--
Best regards, Vladimir Lebedev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 939
Paranoia Database - 48881
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder (2)

C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\gmun.exe - Suspected TROJAN-DOWNLOADER (HTTP://...)
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\initgm.exe - Suspected TROJAN-DOWNLOADER (HTTP://...)
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\Install.exe - Suspected TROJAN-DOWNLOADER (HTTP://...)
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\schunin.exe - Suspected TROJAN-DOWNLOADER (HTTP://{REMOVED}/...)
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\gmsoft.dll - Infected ADWARE.CINMUS.2 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\gmsoft.exe - Suspected TROJAN-DOWNLOADER.AGENT.1

6 Files scanned
1 Infected files found
5 Suspected files found
0 Files disinfected
1 Files deleted

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\gm.rar'
C:\Users\morgan\Documents\
  gm.rar
    [0] Archive type: RAR
    --> gmun.exe
    --> initgm.exe
        [DETECTION] Is the Trojan horse TR/Dldr.Agent.fff
        [WARNING]   Infected files in archives cannot be repaired!
    --> Install.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> schunin.exe
    --> gmsoft.dll
        [DETECTION] Is the Trojan horse TR/Dldr.Agent.ffe
        [WARNING]   Infected files in archives cannot be repaired!
    --> gmsoft.exe
        [DETECTION] Is the Trojan horse TR/Dldr.Agent.ffd
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年11月18日  10:30
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
      7 Files were scanned
      3 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      1 Archives were scanned
      5 Warnings
      0 Notes

Graybird

Filename Result
gmun.exe  CLEAN

The file 'gmun.exe' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

Filename Result
initgm.exe  MALWARE

The file 'initgm.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Agent.fff. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.00.227.

Filename Result
Install.exe  MALWARE

The file 'Install.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Agent.ffh. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

Filename Result
schunin.exe  MALWARE

The file 'schunin.exe' has been determined to be 'MALWARE'. Our analysts named the threat ADSPY/SPia.I. The term "ADSPY/" denotes adware or spyware. This type of malware is able to change browser settings for example by manipulating registry settings or by using of NTFS-streams. Very often IEexploits are used to manipulate the browserhelp.dll.Detection will be added to our virus definition file (VDF) with one of the next updates.

Filename Result
gmsoft.dll  MALWARE

The file 'gmsoft.dll' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Agent.ffe. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.00.227. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

Filename Result
gmsoft.exe  MALWARE

The file 'gmsoft.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Agent.ffd. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.00.227.