1

tonger2003

Starting the file scan:

Begin scan in 'E:\新建文件夹 (2)\no.rar'
E:\新建文件夹 (2)\no.rar
  [0] Archive type: RAR
  --> no.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [WARNING]   The file was ignored!

aerbeisi

C:\test\no.rar ?RAR ?no.exe - 未查明的 NewHeur_PE 病毒 [7]

The file 'no.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Agent.mxa. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Crypted.

wjzdw

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.GameABC.a

MAC 地址：00:11:D8:2A:98:47

用户来源：局域网

软件版本：20.39.41

spatra

微点报未知：
程序:
C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\USER\CURRENT\LOCAL SETTINGS\TEMP\RAR$EX00.187\NO.EXE
木马程序生成以下文件:
1) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\DRIVE\C\WINDOWS\SYSTEM32\DRIVERS\DISDN\FLOWER.EXE
2) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\DRIVE\C\WINDOWS\SYSTEM32\FLOWER.EXE
是否删除木马程序及其衍生物?

Palkia

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\no.rar'
C:\Documents and Settings\Administrator\桌面\no.rar
  [0] Archive type: RAR
  --> no.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      A backup was created as '482d427e.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

allinwonderi

[Scanning : C:\Documents and Settings\All Users\Documents\Test]


C:\Documents and Settings\All Users\Documents\Test\no.rar<RAR>:no.exe <- Trojan.Eggdrop.U : No action



Scanned objects : 2

Infected objects : 1

allinwonderi

FP6 miss. To Frisk

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GameABC.a

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.39.42