可疑

qianwenxiang

systrey.exe 是DIY小鬼头的东东，不发了
除了wafileio.dll之外全部确认为木马or广告了

[ 本帖最后由 qianwenxiang 于 2008-2-20 22:23 编辑 ]

Graybird

Starting the file scan:

Begin scan in 'E:\Antivir\Data20.rar'
E:\Antivir\Data20.rar
  [0] Archive type: RAR
  --> MSWINSCK.OCX
      [DETECTION] Is the Trojan horse TR/Spy.100352
  --> Wa3Api.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!

The file 'setup.exe' has been determined to be 'UNDER ANALYSIS'.

The file 'Wa3FileIO.dll' has been determined to be 'UNDER ANALYSIS'.

The file 'Wa3Api.dll' has been determined to be 'UNDER ANALYSIS'.

上报~

[ 本帖最后由 Graybird 于 2008-2-20 20:56 编辑 ]

冷冷

IK
I:\virus\February\20\Data20.rar:\MSWINSCK.OCX - Signature 'Trojan-Spy.100352' found
I:\virus\February\20\Data20.rar:\setup.exe - Signature 'not-a-virus:AdWare.Win32.ShowBehind.a' found
I:\virus\February\20\Data20.rar:\Wa3FileIO.dll
I:\virus\February\20\Data20.rar:\Wa3Api.dll
I:\virus\February\20\Data20.rar

        5 Files scanned
          (1 Archiv with 4 files)
        2 Signatures found
        0 Suspect code-parts found
        Used time: 0:00.141

qigang

rising20.32.22未杀！

rest1min

江民杀毒软件报告文件

        北京江民新科技术有限公司

        扫描引擎 11.00.703
        病毒库日期 2008-02-20
        更新日期 2008-02-20

扫描目标 C:\Documents and Settings\Administrator\桌面\Data20.rar

开始时间 2008-02-20 22:04:19

在 C:\Documents and Settings\Administrator\桌面\Data20.rar->Wa3Api.dll 中发现 Trojan/PSW.GamePass.gek 病毒, 已删除
正常结束。

扫描结果:
                 文件数 :708                                 病毒体 :1         
                   删除 :1                                     解毒 :0         
    扫描速度(千字节/秒) :21658                             扫描时间 :00:00:08
    扫描文件速度(个/秒) :88

Graybird

The file 'setup.exe' has been determined to be 'MALWARE'. Our analysts named the threat DR/Agent.GUS. The term "DR/" denotes a program that is able to place a virus or a malware discretely on a system.Detection will be added to our virus definition file (VDF) with one of the next updates.

The file 'Wa3FileIO.dll' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

The file 'Wa3Api.dll' has been determined to be 'MALWARE'. Our analysts named the threat ADSPY/Agent.UX. The term "ADSPY/" denotes adware or spyware. This type of malware is able to change browser settings for example by manipulating registry settings or by using of NTFS-streams. Very often IEexploits are used to manipulate the browserhelp.dll.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

qianwenxiang

多谢上报 看来FILSECLAB木有误报 这些玩意跑到系统文件夹还木有运行 难道沙盘又泄露了.. 崩溃 ..

wolffshen

FS找到危险软件
Monitor.Win32.PCRecord (危险软件)
D:\Virus\Test\setup.exe 操作: 删除

挪威的冬天

金山全 MISS

wangjay1980

还是上报卡巴看怎么说吧

detected: riskware not-a-virus:Monitor.Win32.PCRecord.c        File: C:\Documents and Settings\Owner\×ÀÃæ\Data20.rar/setup.exe//setup1.exe//data.rar/ycngr.exe//ASPack


Hello,

MSWINSCK.OCX, Wa3Api.dll, Wa3FileIO.dll

No malicious code were found in these files.



[ 本帖最后由 wangjay1980 于 2008-2-21 08:28 编辑 ]