MD5: 6A595D ~Temp9947.exe

tonger2003

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\~Temp9947.rar'
C:\Documents and Settings\Administrator\My Documents\
  ~Temp9947.rar
    [0] Archive type: RAR
    --> ~Temp9947.exe
        [DETECTION] Contains signature of the dropper DR/Delphi.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

kp2006

主动防御橙色警报

Process is trying to delete value in system registry key that belongs to group System Startup. These keys control the list of modules executed during Windows startup.

You are advised to grant access to these settings only if you are sure you want to allow this program to run automatically when your computer starts. Otherwise it is better to deny access.

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

Value: {1496D5ED-7A09-46D0-8C92-B8E71A4304DF}

Intrusive process:
D:\Documents and Settings\Administrator\桌面\~Temp9947\~Temp9947.exe
Process ID (PID): 3328

Attempt of process intrusion:
D:\WINDOWS\Explorer.EXE
Process ID (PID): 2008

[ 本帖最后由 kp2006 于 2007-6-6 10:57 编辑 ]

tonger2003

这个还是卡巴不报的病毒

Virus.Win32.AutoRun.

[ 本帖最后由 tonger2003 于 2007-6-6 11:02 编辑 ]

woai_jolin

ess pass

allenhippo

又来了啊，作者还真是孜孜不倦

solcroft

还是只免杀母体，不免杀生成物，不知有什么用

红心王子

卡巴延续到7
这个小毒还杀不了
记得之前有上报过
费尔也不报
KV都报了这个病毒

wangjay1980

~Temp9947.exe_ - Virus.Win32.AutoRun.am

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

zongkai

咖啡报木马，PWS-OnlineGames.a.dll