4E6B49

显示全部楼层 · 发表于 2007-7-26 17:57:26

[0] Archive type: RAR
  --> go.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
   [INFO]    A backup was created as '46d76ffb.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-26 17:58:30

avast杀了

显示全部楼层 · 发表于 2007-7-26 18:05:23

显示全部楼层 · 发表于 2007-7-26 19:45:43

微点:
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.891\GO.EXE
由
C:\AUTORUN.INF
自启动运行!
并生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\NEWTEMP.BAK
2) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\NEWTEMP.DLL
3) C:\PEGEFILE.PIF
4) D:\PEGEFILE.PIF
5) C:\AUTORUN.INF
以及可由此INF文件引导自启的文件:
C:\PEGEFILE.PIF

是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-7-26 19:58:48

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.
http://www.bitdefender.com/vfind/?q=Generic.Malware.Sdld.2655F807

[病毒样本] 4E6B49

本帖子中包含更多资源