一支，用NOD32的小心了～

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.AvKiller.cu

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.51.52

Kitman

Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL:         http://bbs.kafan.cn/attachment.p ... 38&t=1215271699
Information:         Is the Trojan horse TR/Dropper.Gen

Generated by AntiVir WebGuard 8.0.13.0, AVE 8.1.0.64, VDF 7.0.5.52

barbara

原帖由 zxkf 于 2008-7-5 20:25 发表
一支，用NOD32的小心了～

你是蚋腥请来的枪手?

cs_virus

markrhy

红伞杀！！！

woai_jolin

2008-7-6 13:00:30        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\VQ33YTOK\cc20[1].exe        a variant of Win32/PSW.Agent.NHQ trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 13:00:26        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\7D2T2WT3\cc19[1].exe        a variant of Win32/PSW.Agent.NHQ trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 13:00:22        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\5SXJ8Z07\cc18[1].exe        a variant of Win32/PSW.Agent.NHQ trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 13:00:17        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\08FVYR04\cc17[1].exe        a variant of Win32/PSW.Agent.NHQ trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 13:00:13        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\VQ33YTOK\cc16[1].exe        probably a variant of Win32/PSW.OnLineGames.NML trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 13:00:07        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\7D2T2WT3\cc15[1].exe        a variant of Win32/PSW.Agent.NHQ trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 13:00:05        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\5SXJ8Z07\cc14[1].exe        a variant of Win32/PSW.OnLineGames.NXI trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 13:00:04        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\08FVYR04\cc13[1].exe        Win32/PSW.WOW.NDK trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 13:00:02        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\VQ33YTOK\cc12[1].exe        a variant of Win32/PSW.OnLineGames.NXI trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 13:00:01        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\7D2T2WT3\cc11[1].exe        probably a variant of Win32/PSW.OnLineGames.NML trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 13:00:00        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\5SXJ8Z07\cc10[1].exe        a variant of Win32/PSW.OnLineGames.NXI trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 12:59:58        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\08FVYR04\cc9[1].exe        probably a variant of Win32/PSW.OnLineGames.NML trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 12:59:57        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\VQ33YTOK\cc8[1].exe        probably a variant of Win32/PSW.OnLineGames.NML trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 12:59:56        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\7D2T2WT3\cc7[1].exe        probably a variant of Win32/PSW.OnLineGames.NML trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 12:59:56        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\5SXJ8Z07\cc6[1].exe        a variant of Win32/PSW.OnLineGames.NXI trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 12:59:55        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\08FVYR04\cc5[1].exe        probably a variant of Win32/PSW.OnLineGames.NML trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 12:59:54        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\VQ33YTOK\cc4[1].exe        a variant of Win32/PSW.Agent.NHQ trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 12:59:53        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\7D2T2WT3\cc2[1].exe        a variant of Win32/PSW.Agent.NHQ trojan        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 12:59:49        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\5SXJ8Z07\cc1[1].exe        probably unknown NewHeur_PE virus        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 12:59:47        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5\5SXJ8Z07\cc1[1].exe        probably unknown NewHeur_PE virus        cleaned by deleting (after the next restart) - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.
2008-7-6 12:59:36        Real-time file system protection        file        C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temp\1.tmp        Win32/Agent.KSQ trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Sandbox\Administrator\DefaultBox\user\all\「开始」菜单\程序\启动\explorer.exe.

solcroft

乖乖，怎么不实机运行看看？

尽在不言中

--> ms.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!


哦..我D乖乖

chicken

http://www.007king.com/cc1.exe
http://www.007king.com/cc2.exe
http://www.007king.com/cc3.exe
http://www.007king.com/cc4.exe
http://www.007king.com/cc5.exe
http://www.007king.com/cc6.exe
http://www.007king.com/cc7.exe
http://www.007king.com/cc8.exe
http://www.007king.com/cc9.exe
http://www.007king.com/cc10.exe
http://www.007king.com/cc11.exe
http://www.007king.com/cc12.exe
http://www.007king.com/cc13.exe
http://www.007king.com/cc14.exe
http://www.007king.com/cc15.exe
http://www.007king.com/cc16.exe
http://www.007king.com/cc17.exe
http://www.007king.com/cc18.exe
http://www.007king.com/cc19.exe
http://www.007king.com/cc20.exe
http://www.007king.com/cc21.exe
http://www.007king.com/cc22.exe
http://www.007king.com/cc23.exe
http://www.007king.com/cc24.exe
http://www.007king.com/cc25.exe
http://www.007king.com/cc26.exe
http://www.007king.com/cc27.exe
http://www.007king.com/cc28.exe
http://www.007king.com/cc29.exe
http://www.007king.com/cc30.exe
http://www.007king.com/cc31.exe
http://www.007king.com/cc32.exe
http://www.007king.com/cc33.exe

saber123