来看看这三个

zxkf

1043.exe
卡7前摄防御报告
2007-5-24 17:25:46 C:\WINDOWS\system32\services.exe HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\acpidisk ImagePath \??\C:\WINDOWS\system32\drivers\acpidisk.sys Unicode null-terminated string (with environment variable references) Create detected
2007-5-24 17:25:46 C:\WINDOWS\system32\services.exe HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\acpidisk ImagePath \??\C:\WINDOWS\system32\drivers\acpidisk.sys Unicode null-terminated string (with environment variable references) Create blocked

添加服务项 有鸽子行为 直接BLOCKD兼砍掉进程

Updaterun.exe
卡7防火墙
连网58.211.7.56～ 等了很久 没见下载 没见其它动作  进程不知何时自动退出 不报的正常

taihuxian

C:\Documents and Settings\Administrator\桌面\3.zip=>1043.exe=>(NSIS o)=>lzma_nsis0000        Detected: Adware.Cinmus.GN
C:\Documents and Settings\Administrator\桌面\3.zip=>1043.exe=>(NSIS o)=>lzma_nsis0000        Disinfection failed
C:\Documents and Settings\Administrator\桌面\3.zip=>1043.exe=>(NSIS o)=>lzma_nsis0000        Move failed
C:\Documents and Settings\Administrator\桌面\3.zip=>1043.exe=>(NSIS o)=>lzma_nsis0002        Detected: Adware.Cinmus.GN
C:\Documents and Settings\Administrator\桌面\3.zip=>1043.exe=>(NSIS o)=>lzma_nsis0002        Disinfection failed
C:\Documents and Settings\Administrator\桌面\3.zip=>1043.exe=>(NSIS o)=>lzma_nsis0002        Move failed
C:\Documents and Settings\Administrator\桌面\3.zip=>1043.exe=>(NSIS o)=>lzma_nsis0003        Detected: Adware.Cinmus.GN
C:\Documents and Settings\Administrator\桌面\3.zip=>1043.exe=>(NSIS o)=>lzma_nsis0003        Disinfection failed
C:\Documents and Settings\Administrator\桌面\3.zip=>1043.exe=>(NSIS o)=>lzma_nsis0003        Move failed

taihuxian

mhj144007

Dr.Web

Updaterun.exe;C:\Documents and Settings\Mahaijun\桌面\3;Adware.Baidu.origin;;
vhjtWLwQ5K_3026.dll;C:\Documents and Settings\Mahaijun\桌面\3;Trojan.Popwin.origin;;

fanrubin

卡巴官方回复说不是病毒
Hello,

1043.exe_ - not-a-virus:AdWare.Win32.Cinmus.j,

vhjtWLwQ5K_3026.dll - not-a-virus:AdWare.Win32.IEHlpr.e

These files are Advertizing Tools, they are detected by
extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

Updaterun.exe_ - Trojan-Downloader.Win32.Agent.bdn

This file is already detected. Please update your antivirus bases.

Please quote all when answering.

--
Best regards, Dmitry Shvetsov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: 3.rar

The EQs

本来就不是病毒。。。是adware

fanrubin

怎么有的杀软报病毒，我以为是呢

beat2

红伞的回复，和卡巴的有点分歧

The file '1043.exe' has been determined to be 'MALWARE'. Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates.

The file 'Updaterun.exe' has been determined to be 'MALWARE'. Our analysts discovered that the file is an adware or spyware program. Detection will be added to our virus definition file (VDF) with one of the next updates.

The file 'vhjtWLwQ5K_3026.dll' has been determined to be 'MALWARE'. Our analysts discovered that the file is an adware or spyware program. Detection will be added to our virus definition file (VDF) with one of the next updates.

mofunzone

实际我是鼓励antivir把全部的ad都算trj的，这样就不用p版了

我是小菜鸟

k7
已删除: 广告软件 not-a-virus:AdWare.Win32.Cinmus.j        文件: C:\Documents and Settings\wuwenli\桌面\3.zip/1043.exe//data0003
已删除: 广告软件 not-a-virus:AdWare.Win32.Cinmus.j        文件: C:\Documents and Settings\wuwenli\桌面\3.zip/1043.exe//data0004
已删除: 木马程序 Trojan-Downloader.Win32.Agent.bdn        文件: C:\Documents and Settings\wuwenli\桌面\3.zip/Updaterun.exe
已删除: 广告软件 not-a-virus:AdWare.Win32.IEHlpr.e        文件: C:\Documents and Settings\wuwenli\桌面\3.zip/vhjtWLwQ5K_3026.dll