csrss.exe

显示全部楼层 · 发表于 2008-6-17 20:55:05

已刪除: 特洛伊木馬程式 SpamTool.Win32.VB.ay 檔案: C:\Documents and Settings\kato9096\桌面\csrss.zip/csrss.exe

显示全部楼层 · 发表于 2008-6-17 21:03:32

危险进程(PID:1108): \csrss.exe

产品名称: fsdfs
文件版本: 1.0.0.0
公司名称: Microsoft Corp
文件描述: 无
数字签名: 没有发现签名

危险级别: 中
级别评分: 39.2008a00
状态: 进程已被结束，但还没有清除，等待进一步处理。

在线扫描发现它是一个“病毒”，推荐删除。

显示全部楼层 · 发表于 2008-6-17 21:04:42

Virus or unwanted program 'SPR/Spam.VB.AY.5 [riskware]'
detected in file 'C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF\csrss[1].zip.
Action performed: Deny access

显示全部楼层 · 发表于 2008-6-17 21:06:36

RS20.49.12未杀！

显示全部楼层 · 发表于 2008-6-17 21:12:21

The requested URL could not be retrieved

While trying to retrieve the URL:

http://bbs.kafan.cn/attachment.php?aid=
288890&k=c7af63bcd32b1ed3ef84bae84706627
1&t=1213708303

The following error was encountered:

The requested object is INFECTED with the following viruses: SpamTool.Win32.VB.ay

Please contact your service provider if you consider it incorrect.
Generated:
Tue Jun 17 21:12:09 2008
Kaspersky Internet Security 2009

显示全部楼层 · 发表于 2008-6-17 21:12:49

00003F5C 00403F5C    0 GetWindowsDirectoryA
00003FB8 00403FB8    0 FindWindowA
00003FFC 00403FFC    0 ShowWindow
00004040 00404040    0 GetSystemDirectoryA
0000408C 0040408C    0 GetWindow
000040EC 004040EC    0 GetWindowTextA
00004134 00404134    0 GetWindowTextLengthA
00004180 00404180    0 CtrlKey
000041B0 004041B0    0 GetAsyncKeyState
00004250 00404250    0 InternetOpenA
000042A8 004042A8    0 InternetOpenUrlA
000042F4 004042F4    0 InternetReadFile
00004340 00404340    0 InternetCloseHandle
0000438C 0040438C    0 CreateWindowExA
00004518 00404518    0 EnumWindows
000045B8 004045B8    0 GetUserDefaultLangID
00004628 00404628    0 GetSystemDefaultLangID
00004678 00404678    0 SendMessageA
00004730 00404730    0 C:\WINDOWS\system32\ieframe.oca
00003BE4 00403BE4    0 cellpadding
00003C9C 00403C9C    0 RUNDLL32.EXE
00003CBC 00403CBC    0 shell32.dll,OpenAs_RunDLL
000043F0 004043F0    0 wscript.shell
0000440C 0040440C    0 Enabled
00004430 00404430    0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
000044B8 004044B8    0 csrss
000044D0 004044D0    0 csrss.exe
000044E4 004044E4    0 RegWrite
000044FC 004044FC    0 MSNCleaner
00004804 00404804    0 IMWindowClass
000058A6 004058A6    0 http:///
000058FA 004058FA    0 http:///
0000C29A 0040D29A    0 InternalName
0000C2B4 0040D2B4    0 csrss
0000C2C6 0040D2C6    0 OriginalFilename
0000C2E8 0040D2E8    0 csrss.exe
我的红伞没报，中启发

显示全部楼层 · 发表于 2008-6-17 21:24:57

[Found possible virus] <W32/VB-Wird-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\csrss.zip->csrss.exe

---------------------------------------------------------------------
Scan ended: 2008-6-17, 21:23:19
Duration: 0:00:00

Scan result:

Scanned files:    6
Infected objects:    1
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-6-17 22:42:19

http://laws7777.googlepages.com/csrss.gtr

显示全部楼层 · 发表于 2008-6-17 23:46:33

BD挂...

[病毒样本] csrss.exe

本帖子中包含更多资源

2/0

F-Prot 4.4.4

是不是该地址呢？