晚餐時間，大家測試看看囉。。。

显示全部楼层 · 发表于 2008-3-30 17:07:28

E:\virus\riben.rar » RAR » riben.exe » RAR » maikmr.exe - a variant of Win32/PSW.OnLineGames.NNS trojan - was a part of the deleted object
E:\virus\riben.rar » RAR » riben.exe » RAR » riben.jpg - is OK
E:\virus\riben.rar » RAR » riben.exe - a variant of Win32/PSW.OnLineGames.NNS trojan - was a part of the deleted object
E:\virus\riben.rar - a variant of Win32/PSW.OnLineGames.NNS trojan - deleted - quarantined

显示全部楼层 · 发表于 2008-3-30 17:11:49

http://www.gamanir.com/12/riben.exe

显示全部楼层 · 发表于 2008-3-30 17:40:36

金山毒霸 MISS

傅立叶? oh no ...

显示全部楼层 · 发表于 2008-3-30 18:43:57

AVG7.5家人没报

显示全部楼层 · 发表于 2008-3-30 21:12:19

McAfee PWS-OnlineGames.l.dll

显示全部楼层 · 发表于 2008-3-30 21:16:17

riben.exe
  riben.exe:Zone.Identifier
[0] Archive type: RAR SFX (self extracting)
--> maikmr.exe
      [DETECTION] Is the Trojan horse TR/Proxy.Delf.CA
      [WARNING] Infected files in archives cannot be repaired!
--> riben.jpg
      [INFO]    The file was moved to '485192fc.qua'!

显示全部楼层 · 发表于 2008-3-30 23:03:42

小红伞kill
微点过

显示全部楼层 · 发表于 2008-3-31 19:44:26

谁说微点过了

只不过晚报了点

时间处理结果木马名称木马进程名木马文件创建者
2008-03-31 19:46:35 处理成功未知木马 C:\WINDOWS\DEBUG\B831406A9770.DLL C:\DOCUMENTS AND SETTINGS\    \LOCAL SETTINGS\TEMP\RARSFX0\MAIKMR.EXE
2008-03-31 19:46:35 处理成功未知木马 C:\DOCUMENTS AND SETTINGS\    \LOCAL SETTINGS\TEMP\RARSFX0\MAIKMR.EXE C:\DOCUMENTS AND SETTINGS\    \桌面\RIBEN.EXE
2008-03-31 19:46:35 处理成功未知木马 C:\DOCUMENTS AND SETTINGS\    \桌面\RIBEN.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

显示全部楼层 · 发表于 2008-3-31 20:23:10

小红伞。。迅雷还没下完。。就报了。。。

显示全部楼层 · 发表于 2008-3-31 20:38:54

2008-03-31 20:37:54 运行应用程序操作:阻止
进程路径:C:\Documents and Settings\dell\桌面\riben.exe
文件路径:C:\windows\system32\rundll32.exe
命令行:C:\WINDOWS\system32\shimgvw.dll,ImageView_Fullscreen C:\DOCUME~1\dell\LOCALS~1\Temp\RarSFX0\riben.jpg
触发规则:所有程序规则->*

[已鉴定] 晚餐時間，大家測試看看囉。。。