Downloader [e55308]

微点卫士

微点：
程序:
C:\WINDOWS.0\SYSTEM32\REG.EXE
修改注册表项:
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
是否阻止?
程序:
C:\WINDOWS.0\SYSTEM32\SVSH0ST.EXE
是可疑程序!
试图修改系统时间!
是否阻止该进程继续运行?
程序:
C:\WINDOWS.0\SYSTEM32\SVSH0ST.EXE
是否删除木马程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN.EXE
可疑程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\SVSH0ST.EXE
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\WINDOWS.0\SYSTEM32\SVSH0ST.EXE
是否删除病毒程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN.EXE
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DOWN.BAT
是否删除可疑程序?

taihuxian

C:\Documents and Settings\Administrator\桌面\Down.zip »ZIP »Down.exe - a variant of Win32/AutoRun.K worm

hahacomcn

Start of the scan: 2007年8月21日  14:25

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\Down.zip'
C:\Documents and Settings\Administrator\桌面\Down.zip
  [0] Archive type: ZIP
  --> Down.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen

jimmyleo

原帖由 电影结束了 于 2007-8-21 12:55 发表
所有的被改ＨＴＭＬ红伞全报病毒．．．．．．
...

恰恰说明antivir的强大
因为改了的都是系统原带的html像一些例子的演示
都改变指向了
你要是打开么也玩玩了……

uhthn2002

vba32miss.............

碧水寒潭

Start of the scan: 2007年8月21日  15:58

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\Down.zip
  [0] Archive type: ZIP
  --> Down.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年8月21日  15:58
Used time: 00:08 min

The scan has been done completely.

      1 Scanning directories
      2 Files were scanned
      1 viruses and/or unwanted programs were found
      0 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found