一记事本..

显示全部楼层 · 发表于 2007-6-28 17:05:55

然，可能就是苏州的那个，网上bind_XXX还有my_XXXX好像都是他的。

运行后先连接到58.211.7.41，然后转到58.211.7.35下载一个病毒包，以前有夹cnnic的，现在没有了，但是会把一些垃圾网站加入收藏。

显示全部楼层 · 发表于 2007-6-28 17:20:23

[Scan path] C:\Documents and Settings\Administrator\桌面\readme\readme.exe
>>C:\Documents and Settings\Administrator\桌面\readme\readme.exe\data001 - Ok
>C:\Documents and Settings\Administrator\桌面\readme\readme.exe\data002 infected with Trojan.DownLoader.24708
C:\Documents and Settings\Administrator\桌面\readme\readme.exe - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 4
Infected objects found: 1
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 45 Kb/s
Scan time: 00:00:00

显示全部楼层 · 发表于 2007-6-28 17:20:42

显示全部楼层 · 发表于 2007-6-28 17:28:33

Virus: Win32:Trojan-gen. {Other}

Virus found while downloading Web content.

Address: bbs.kafan.cn

显示全部楼层 · 发表于 2007-6-28 20:57:47

运行后怎么冒出来这两个..

2007-6-28 20:51:32 AMON file C:\windows\system32\ddvxz.dll a variant of Win32/TrojanDownloader.QQHelper trojan quarantined - deleted Event occurred on a new file created by the application: C:\Documents and Settings\Administrator\Local Settings\Temp\tempaq.

2007-6-28 20:51:29 AMON file C:\windows\system32\ugnlp.dll a variant of Win32/TrojanDownloader.QQHelper trojan quarantined - deleted Event occurred on a new file created by the application: C:\Documents and Settings\Administrator\Local Settings\Temp\tempaq.

然后提示什么'windows错误找不到模块XXX..',还好.. 不过还是漏了两个downloader

显示全部楼层 · 发表于 2007-6-28 21:01:20

没有影子
不敢运行

显示全部楼层 · 发表于 2007-6-28 21:14:10

原帖由 hj5abc 于 2007-6-28 20:57 发表
运行后怎么冒出来这两个..

2007-6-28 20:51:32 AMON file C:\windows\system32\ddvxz.dll a variant of Win32/TrojanDownloader.QQHelper trojan quarantined - deleted Event occurred on a new fi ...

那个就是毒了啦，没有后缀名的tempaq

显示全部楼层 · 发表于 2007-6-28 21:15:42

原帖由 woai_jolin 于 2007-6-28 21:01 发表
没有影子
不敢运行

我就运行了
用returnil
在临时文件夹里面生成两个东西要求联网
直接上报

显示全部楼层 · 发表于 2007-6-28 21:20:01

我的卡巴7也扫不出来，晕！

显示全部楼层 · 发表于 2007-6-28 21:21:31

kis6没反应

一记事本..

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源