Kryptik 木馬

a256886572008

2011-11-08 00:31:05   C:\Documents and Settings\Roger\桌面\virus\idcp\calc.exe   Sandboxed As   Partially Limited   

2011-11-08 00:31:31   C:\DOCUME~1\Roger\LOCALS~1\Temp\4er157.tmp   Sandboxed As   Partially Limited   

2011-11-08 00:31:42   C:\Documents and Settings\Roger\Local Settings\Temp\~unins6953.bat   Sandboxed As   Partially Limited   

2011-11-08 00:31:42   C:\WINDOWS\system32\conime.exe   Sandboxed As   Partially Limited   

2011-11-08 00:31:48   C:\Documents and Settings\Roger\Local Settings\Temp\4er157.tmp   Modify File   C:\WINDOWS\system32\msdtc3.exe   

2011-11-08 00:31:48   C:\Documents and Settings\Roger\Local Settings\Temp\4er157.tmp   Modify Key   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer   

訪問網路

下載地址：
http://www.vdisk.cn/down/index/9090761A5127

http://www.vdisk.cn/down/index/9090760A2749

a256886572008

2011-11-08 00:38:59   C:\Documents and Settings\Roger\桌面\virus\idcp\msdtc3.exe   Sandboxed As   Partially Limited   

2011-11-08 00:39:00   C:\Documents and Settings\Roger\桌面\virus\idcp\msdtc3.exe   Modify File   C:\WINDOWS\system32\drivers\etc\hosts   

2011-11-08 00:39:00   C:\WINDOWS\system32\ipconfig.exe   Sandboxed As   Partially Limited   

2011-11-08 00:39:01   C:\WINDOWS\system32\conime.exe   Sandboxed As   Partially Limited   

2011-11-08 00:39:06   C:\Documents and Settings\Roger\桌面\virus\idcp\msdtc3.exe   Modify Key   HKUS\S-1-5-21-1004336348-1383384898-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable   

2011-11-08 00:39:06   C:\WINDOWS\system32\ipconfig.exe   Modify Key   HKLM\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\EventMessageFile   

改 host

dalianjhc1986

eset 拦截

郑伟用户

毒霸全杀

liuhsu

萧剑

360卫士 kill all

星晨

BitDefender
calc.exe Gen:Trojan.Heur.FU.aiW@aO2L!lk
msdtc3.exe Trojan.QHosts.AVD

ADSLgg

红伞kill

留侯

大蜘蛛：
calc.exe - infected with Trojan.DownLoad2.22099
msdtc3.exe - infected with Trojan.Hosts.303

jayavira

最主要的三大引擎都kill