金山挂360发现风险程序

显示全部楼层 · 发表于 2008-3-4 18:06:13

金山挂360发现风险程序

显示全部楼层 · 发表于 2008-3-4 18:08:42

Begin scan in 'D:\BOOK\DDC3D068.rar'
D:\BOOK\DDC3D068.rar
  [0] Archive type: RAR
  --> DDC3D068.EXE
   [DETECTION] Contains suspicious code HEUR/Malware
   [WARNING] The file was ignored

显示全部楼层 · 发表于 2008-3-4 18:28:02

AVAST报Win32:AutoRun-IC
蜘蛛报Trojan.Popwin.origin

显示全部楼层 · 发表于 2008-3-4 18:29:20

D:\download\DDC3D068.rar>>DDC3D068.EXE Heuri.Suspicious.ERNM 启发式扫描还未处理

显示全部楼层 · 发表于 2008-3-4 18:34:03

E:\VIRUS\DDC3D068.rar » RAR » DDC3D068.EXE - probably a variant of Win32/Genetik trojan

显示全部楼层 · 发表于 2008-3-4 18:36:13

Filename Result
DDC3D068.EXE MALWARE

The file 'DDC3D068.EXE' has been determined to be 'MALWARE'. Our analysts named the threat TR/Drop.Agent.gxb. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware

显示全部楼层 · 发表于 2008-3-4 19:00:04

W32.Popwin DDC3D068.EXE

铁壳报了

显示全部楼层 · 发表于 2008-3-4 19:01:54

DDC3D068.EXE 费尔启发报了

显示全部楼层 · 发表于 2008-3-4 19:05:21

DDC3D068.EXE
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\DDC3D068.rar
Status: 已发现病毒
病毒: Win32.Worm.Winko.I (BD 引擎)

显示全部楼层 · 发表于 2008-3-4 19:05:45

TO KL

http://bbs.kafan.cn/viewthread.php?tid=213086&pid=2935083&page=1&extra=page%3D1%26amp%3Bfilter%3D0%26amp%3Borderby%3Ddateline%26amp%3Bascdesc%3DDESC#pid2935083

去此贴样本同

Hello,

hjiq.dll - Trojan-PSW.Win32.OnLineGames.rxox,
last[1].exe_ - Worm.Win32.AutoRun.cvp,
tsqc.dll - Trojan-PSW.Win32.OnLineGames.rxoy,
xjxr.dll - Trojan-PSW.Win32.OnLineGames.ssw

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

[ 本帖最后由 wangjay1980 于 2008-3-4 21:30 编辑 ]

[病毒样本] 金山挂360发现风险程序

本帖子中包含更多资源