978177

显示全部楼层 · 发表于 2007-7-24 20:35:01

Scan performed at: 2007-7-24 20:34:45
Scanning Log
NOD32 version 2416 (20070724) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本.zip
Operating memory - is OK

Date: 24.7.2007 Time: 20:34:51
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本.zip
C:\Documents and Settings\EQ2\桌面\样本.zip ?ZIP ?s168.exe - a variant of Win32/PSW.OnLineGames.NBR trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 20:34:51 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-7-24 20:35:13

显示全部楼层 · 发表于 2007-7-24 20:36:43

McAfee報PWS-OnlineGames.a (ED)

显示全部楼层 · 发表于 2007-7-24 20:37:03

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.zip'
C:\Documents and Settings\Administrator\桌面\样本.zip
  [0] Archive type: ZIP
  --> s168.exe
   [DETECTION] Is the Trojan horse TR/Autorun.BK
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-24 20:38:46

不杀上报

显示全部楼层 · 发表于 2007-7-24 20:51:07

金山挂!!!

微点:
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.704\S168.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\MSVCRT.BAK
2) C:\PROGRAM FILES\INTERNET EXPLORER\MSVCRT.DLL
3) C:\PROGRAM FILES\COMMON FILES\RELIVE.DLL
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-7-24 20:54:03

卡巴挂

显示全部楼层 · 发表于 2007-7-24 20:55:54

小红伞干掉了,一声就搞定了~

显示全部楼层 · 发表于 2007-7-24 20:57:23

F:\样本.zip:<ZIP>\s168.exe : is suspected of Trojan-PSW.Game.18 (paranoid heuristics)

[病毒样本] 978177

本帖子中包含更多资源

本帖子中包含更多资源