来个样本

显示全部楼层 · 发表于 2008-8-2 15:48:53

我以為你用卡巴

显示全部楼层 · 发表于 2008-8-2 16:37:51

000C89F5 004C89F5    0 FileINI:28672,793077,muma2.exe
00001907 00401907    0 \Pack.vbp
00001CA0 00401CA0    0 C:\Temp
00001CFC 00401CFC    0 avp.exe
00001D34 00401D34    0 CCenter.exe,Ravmon.exe,RavmonD.exe,RavTask.exe,Rav.exe,RavStub.exe,KVXP.exe,kissvc.exe,KvMonXP.exe,KVCenter.exe,KVSrvXP.exe,kavstart.exe,kwatch.exe,kavsvc.exe,kav.exe,runiep.exe,Rsaupd.exe,nod32kui.exe,avguard.exe,avcenter.exe,nod32krn.exe,avp.exe,360safe.exe,360tray.exe,kav32.exe,katmain.exe,kpfwsvc.exe,kpfw32.exe,rfwmain.exe,rfwproxy.exe,rfwsrv.exe,sched.exe,KWatch.exe,wscntfy.exe,wuauclt.exe
000027D8 004027D8    0 FileINI:
000027F0 004027F0    0 C:\Temp\
00002A44 00402A44    0 Wscript.Shell
00002A64 00402A64    0 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
00002B60 00402B60    0 CCenter.exe
00002B7C 00402B7C    0 Ravmon.exe
00002B98 00402B98    0 RavmonD.exe
00002BB4 00402BB4    0 Rav.exe

显示全部楼层 · 发表于 2008-8-2 16:57:36

红伞拒绝下载,监控就拦截

显示全部楼层 · 发表于 2008-8-2 17:03:29

发现未知木马，是否删除？
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.172\HEIEHI.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2008-8-2 20:31:41

McAfee MISS

显示全部楼层 · 发表于 2008-8-2 22:19:45

RS20.55.52未杀！

显示全部楼层 · 发表于 2008-8-3 13:54:44

已删除：木马程序 Trojan-Spy.Win32.FlyStudio.kb 文件　: G:\Temp\Virus\heiehi.rar/heiehi.exe//data0000

显示全部楼层 · 发表于 2008-8-3 18:29:22

Hello. This file is already detected. Please update your bases.

Please quote all when answering. Do not forget to include you registration data.
-----------------
Regards, Tatarinov Ivan
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

> Attachment: 297496.rar

[病毒样本] 来个样本

回复 10楼 yuhaoyin 的帖子

2/0