N

killloop

金山 瑞星




扫描其中一个。

扫描结果 :	5%的杀软(2/38)报告发现病毒
时间 :	2009/06/20 02:21:52 (CST)

软件名称	引擎版本	病毒库版本	病毒库时间	扫描结果	时间
a-squared	4.5.0.1	20090619170318	2009-06-19	-	40.127
安博士V3	2009.06.20.00	2009.06.20	2009-06-20	-	0.727
AntiVir	8.2.0.193	7.1.4.117	2009-06-19	-	0.525
安天	2.0.18	2.0.18.	0002-18-00	-	0.018
Arcavir	2009	200906191229	2009-06-19	-	0.051
Authentium	5.1.1	200906191027	2009-06-19	-	1.179
AVAST!	4.7.4	090618-0	2009-06-18	-	0.005
AVG	8.5.286	270.12.80/2187	2009-06-19	-	3.633
BitDefender	7.81008.3438914	7.26071	2009-06-19	-	3.384
CA (VET)	9.0.0.143	31.6.6568	2009-06-19	-	5.537
ClamAV	0.95.1	9486	2009-06-19	-	0.017
Comodo	3.9	1373	2009-06-19	-	0.818
CP Secure	1.1.0.715	2009.06.19	2009-06-19	-	11.024
Dr.Web	4.44.0.9170	2009.06.19	2009-06-19	-	5.008
F-Prot	4.4.4.56	20090619	2009-06-19	-	1.355
F-Secure	5.51.6100	2009.06.19.02	2009-06-19	-	0.121
飞塔	2.81-3.117	10.514	2009-06-19	-	0.203
GData	19.5920/19.368	20090619	2009-06-19	Trojan-Spy.Win32.Agent.aweb [Engine:A]	4.453
ViRobot	20090619	2009.06.19	2009-06-19	-	0.416
Ikarus	T3.1.01.59	2009.06.19.72892	2009-06-19	-	3.407
江民杀毒	11.0.706	2009.06.19	2009-06-19	-	2.164
卡巴斯基	5.5.10	2009.06.19	2009-06-19	Trojan-Spy.Win32.Agent.aweb	0.080
金山毒霸	2009.2.5.15	2009.6.19.21	2009-06-19	-	0.524
迈克菲	5.3.00	5650	2009-06-18	-	3.156
Microsoft	1.4803	2009.06.19	2009-06-19	-	5.080
mks_vir	2.01	2009.06.19	2009-06-19	-	3.311
Norman	6.01.09	6.01.00	2009-06-19	-	4.007
熊猫卫士	9.05.01	2009.06.19	2009-06-19	-	2.194
趋势科技	8.700-1004	6.208.04	2009-06-19	-	0.054
Quick Heal	10.00	2009.06.19	2009-06-19	-	1.298
瑞星	20.0	21.34.44.00	2009-06-19	-	0.816
Sophos	2.87.1	4.42	2009-06-19	-	2.555
Sunbelt	5197	5197	2009-06-18	-	1.264
赛门铁克	1.3.0.24	20090619.004	2009-06-19	-	0.057
nProtect	20090619.01	4366732	2009-06-19	-	5.680
The Hacker	6.3.4.3	v00348	2009-06-17	-	0.845
VBA32	3.12.10.7	20090618.1511	2009-06-18	-	2.873
VirusBuster	4.5.11.10	10.107.18/1647938	2009-06-19	-	2.059

killloop

完整



C:\Program Files\Rising\RFW\Update\setup.exe 被替换，微点没有有效拦截，官方说微点没拦截到的上报可以奖励序列号。爱谁报谁报。

等等等

[ 本帖最后由 killloop 于 2009-6-20 03:16 编辑 ]

zwl2828

This threat is classified as a Trojan - Dropper. As its name suggests, a dropper trojan contains malicious or potentially unwanted software which it ‘drops’ and installs on the affected system. Commonly, the dropper installs a backdoor which allows remote, surreptitious access to infected systems. This backdoor may then be used by remote attackers to upload and install further malicious or potentially unwanted software on the system.

haoge868

微点报了么 ?

kingmuro

已检测：木马程序 Trojan-Dropper.Win32.Agent.auem        文件：D:\My Documents\桌面\test\JNH8.7\JNH8.7.EXE//NPack

kingmuro

JNH8.7.EXE;D:\My Documents\桌面\test\JNH8.7;Trojan.PWS.Gamania.19096;;

HC303

第一个A2KILL
G:\virus\SENDMAC.rar/SENDMAC.EXE         detected: Trojan-Spy.Win32.Agent!IK
其余的在下.

HC303

完整红伞
Beginning disinfection:
G:\virus\JNH8.7\JNH8.7.EXE
    [DETECTION] Contains recognition pattern of the DR/Delphi.Gen dropper

A2
G:\virus\JNH8.7\JNH8.7.EXE.VIR         detected: Packed.Win32.PePatch!IK

浪人哭泣

卡巴都直接拒绝

hddu

9-06-21 07:54:29    运行应用程序      操作:阻止并结束进程
进程路径:E:\JNH8[1].7\JNH8.7.EXE
文件路径:C:\WINDOWS\system32\net.exe
命令行:stop "Security Center"
触发规则:所有程序规则->系统程序_黑名单->%windir%\system32\net*.exe