看看这个，进程有问题[MD5: BD9818]

显示全部楼层 · 发表于 2007-8-9 17:48:47

new_photos-imageshack.com
[CREATE FILE]
[BLOCK]                               E:\Test\pics\new_photos-imageshack.com
                                    Command Line:"E:\Test\pics\new_photos-imageshack.com"
[ACCESS TO]                         Folder: C:\
                                    File: a.bat

new_photos-imageshack.com
[CREATE FILE]
[BLOCK]                               E:\Test\pics\new_photos-imageshack.com
                                    Command Line:"E:\Test\pics\new_photos-imageshack.com"
[ACCESS TO]                         Folder: C:\WINDOWS\system32\
                                    File: s2.exe

new_photos-imageshack.com
[REGISTRY - SET VALUE]
[BLOCK]                               E:\Test\pics\new_photos-imageshack.com
                                    Command Line:"E:\Test\pics\new_photos-imageshack.com"
[ACCESS TO]                         Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
                                    Value: sy

new_photos-imageshack.com
[REGISTRY - CREATE KEY]
[BLOCK]                               E:\Test\pics\new_photos-imageshack.com
                                    Command Line:"E:\Test\pics\new_photos-imageshack.com"
[ACCESS TO]                         Key: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\

new_photos-imageshack.com
[REGISTRY - CREATE KEY]
[BLOCK]                               E:\Test\pics\new_photos-imageshack.com
                                    Command Line:"E:\Test\pics\new_photos-imageshack.com"
[ACCESS TO]                         Key: HKCU\Software\Microsoft\OLE\

new_photos-imageshack.com
[REGISTRY - SET VALUE]
[BLOCK]                               E:\Test\pics\new_photos-imageshack.com
                                    Command Line:"E:\Test\pics\new_photos-imageshack.com"
[ACCESS TO]                         Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\
                                    Value: Common AppData

new_photos-imageshack.com
[ACCESS NETWORK]
[BLOCK]                               E:\Test\pics\new_photos-imageshack.com
                                    Command Line:"E:\Test\pics\new_photos-imageshack.com"
[ACCESS TO]                         Direction:Outgoing  Protocol:TCP Remote Address:67.159.50.221: 25999

显示全部楼层 · 发表于 2007-8-9 17:49:35

红伞挂

显示全部楼层 · 发表于 2007-8-9 17:50:39

已检测到: 木马程序 Backdoor.Win32.Rbot.crm URL: http://bbs.kafan.cn/attachment.p ... otos-imageshack.com

卡巴收监

显示全部楼层 · 发表于 2007-8-9 17:51:13

小A飘了;
瑞星2008测试飞了.
---------------------------------------
瑞星2008脱壳技术研究分析专家

显示全部楼层 · 发表于 2007-8-9 17:51:51

小A怎么飘?卡巴都没飘,水上报下阿~!哭死了

显示全部楼层 · 发表于 2007-8-9 17:53:52

显示全部楼层 · 发表于 2007-8-9 17:57:23

只有卡巴一家报啊

显示全部楼层 · 发表于 2007-8-9 18:44:38

程序:
D:\病毒库\PICS\NEW_PHOTOS-IMAGESHACK.COM
1) C:\A.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

程序:
C:\WINDOWS\SYSTEM32\DRIVERS\IMMDRV.SYS
是否删除RootKit程序?

显示全部楼层 · 发表于 2007-8-10 10:54:21

eq 修改其他进程内存

显示全部楼层 · 发表于 2007-8-10 11:00:26

有人上报了吗，dr.web杀

C:\virus\new_photos-imageshack.com - infected with Trojan.MulDrop.7176

[病毒样本] 看看这个，进程有问题[MD5: BD9818]

本帖子中包含更多资源

本帖子中包含更多资源