[MD5: CFE384]

tonger2003

The EQs

Scan performed at: 2007-7-25 23:05:35
Scanning Log
NOD32 version 2418 (20070725) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本.rar
Operating memory - is OK

Date: 25.7.2007  Time: 23:05:41
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本.rar
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?vik.exe - a variant of Win32/PSW.OnLineGames.NBR trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 23:05:41 Total scanning time: 0 sec (00:00:00)

电影结束了

C:\Documents and Settings\wangcheng\桌面\样本.rar\vik.exe infected with Win32.HLLW.Autoruner.175
DR .WEB

[ 本帖最后由 电影结束了 于 2007-7-25 23:08 编辑 ]

欠妳緈諨

lsyer

--> vik.exe
      [DETECTION] Is the Trojan horse TR/Autorun.BK
      [WARNING]   The file was ignored!

xxwpk007

卡巴飘了

1688388728

2007-7-25 23:10:15        C:\病毒库\样本\vik.exe        HKEY_USERS\SANDBOX_ADMINISTRATOR_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks        {B8A170A8-7AD3-4678-B2FE-F2D7381CC1B5}                        创建        探测到
2007-7-25 23:10:15        C:\病毒库\样本\vik.exe        HKEY_USERS\SANDBOX_ADMINISTRATOR_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks        {B8A170A8-7AD3-4678-B2FE-F2D7381CC1B5}                        创建        被阻止
2007-7-25 23:10:20        C:\病毒库\样本\vik.exe        HKEY_USERS\SANDBOX_ADMINISTRATOR_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks        {B8A170A8-7AD3-4678-B2FE-F2D7381CC1B5}                        创建        探测到
2007-7-25 23:10:20        C:\病毒库\样本\vik.exe        HKEY_USERS\SANDBOX_ADMINISTRATOR_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks        {B8A170A8-7AD3-4678-B2FE-F2D7381CC1B5}                        创建        被阻止

微点卫士

金山挂,费尔启发报壳

微点:
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.171\VIK.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\MSVCRT.BAK
2) C:\PROGRAM FILES\INTERNET EXPLORER\MSVCRT.DLL
3) C:\PROGRAM FILES\COMMON FILES\RELIVE.DLL
是否删除木马程序及其衍生物?

taitan001

F:\样本.rar:<RAR>\vik.exe : is suspected of Trojan-PSW.Game.18 (paranoid heuristics)