晚餐時間，大家測試看看囉。。。

蔚藍領域

http://www.gamanir.com/12/riben.asp?=11/02/d2/1102d29qd2591.127d2b.jpg

[ 本帖最后由 蔚藍領域 于 2008-3-30 16:41 编辑 ]

醉一生爱妍

居然是个EXE下载地址，我寒

江民08无视

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File MD5
1	%Temp%\RarSFX0\maikmr.exe	183,808 bytes	0x07B359FFD6FD715B2A62F44BDF91414F
2	%Temp%\RarSFX0\riben.jpg	24,617 bytes	0xC129F4D7F831AB490E9B56AF525E6C41
3	[file and pathname of the sample #1]	306,337 bytes	0x4B4E2A5229953F70D6CAF4A07F779F75

• Note:
  • %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directory was created:
  • %Temp%\RarSFX0

Memory Modifications

• There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	147,456 bytes

Registry Modifications

• The following Registry Key was created:
  • HKEY_CURRENT_USER\Software\WinRAR SFX

• The newly created Registry Value is:
  • [HKEY_CURRENT_USER\Software\WinRAR SFX]
    • C%%WINDOWS%temp = "%Temp%\RarSFX0"

[ 本帖最后由 garyyan456 于 2008-3-30 16:48 编辑 ]

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.Lineage.n

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.37.61

Palkia

Palkia

我的还是60版啊。。。

aerbeisi

[Found security risk]         <W32/OnlineGames.E.gen!GSA (not disinfectable, generic)>        C:\test\riben.exe->(RAR)->maikmr.exe->rsrcPE->(Klone.AF)

loveyuwei

<img src="images/smilies/default/1.gif" smilieid="1" border="0" alt="" /> KAV8.0，RC1。

The EQs

C:\Documents and Settings\Don johnson\桌面\riben.rar » RAR » riben.exe » RAR » maikmr.exe - a variant of Win32/PSW.OnLineGames.NNS trojan

Starting the file scan:
Begin scan in 'D:\riben.rar'
D:\riben.rar
  [0] Archive type: RAR
    --> riben.exe
      [1] Archive type: RAR SFX (self extracting)
      --> maikmr.exe
          [DETECTION] Is the Trojan horse TR/Proxy.Delf.CA
      [INFO]      The file was deleted!

[ 本帖最后由 Exia 于 2008-3-30 16:48 编辑 ]

宝贝要升天了

程序:
C:\DOCUMENTS AND SETTINGS\MILLSHANGSHANG\LOCAL SETTINGS\TEMP\RARSFX3\MAIKMR.EXE
是可疑程序!
试图修改系统时间!
是否阻止该进程继续运行?