一个小毒 [MD5: 0850B3]

wangjay1980

如题

foxhound

A-Squared	Found nothing
AntiVir	Found TR/Agent.34708.B
ArcaVir	Found nothing
Avast	Found Win32:Lineage-545
AVG Antivirus	Found nothing
BitDefender	Found BehavesLike:Win32.ExplorerHijack (probable variant)
ClamAV	Found Trojan.Spy-3306
Dr.Web	Found Trojan.PWS.Wsgame
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found a variant of Win32/PSW.Agent.NDP
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

lanvin

用费尔运行了下

危险进程(PID:1676): C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX01.845\11.exe
注入危险线程 (TID:1644 ) 到 C:\windows\Explorer.EXE(PID: 1400)

注册表监控

报警类型: 发现多余的值
危险等级: 一般
注册表分支: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
注册表值名: u1
当前的类型: REG_SZ
正确的类型: REG_SZ
当前的值: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexplorer.exe
正确的值:
修复方法: 删除值
当前状态: 等待修复

blueline

看行为报盗号的应该是正确的

wangjay1980

detected: virus Invader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\1.zip/1.exe

taihuxian

Virus: Win32:Lineage-545 [Trj]

Virus found while downloading Web content.

Address: bbs.kafan.cn

蓝色牛仔裤

[Scan path] C:\Documents and Settings\Administrator\桌面\1.rar
>>C:\Documents and Settings\Administrator\桌面\1.rar\11.exe infected with Trojan.PWS.Wsgame
C:\Documents and Settings\Administrator\桌面\1.rar - archive contains infected objects

jack7087

驅逐艦殺.......

seamonkey

detected: virus Invader (modification)        URL: http://bbs.kafan.cn/attachment.php?aid=82511//11.exe

KAV-Longhorn

只靠病毒库是不行的,何况还有这么多卡巴的免杀啊....