一个，有联网[MD5: 222DE4]

显示全部楼层 · 发表于 2007-8-21 21:36:37

Outbound 58.211.7.35

CreateFile C:\Documents and Settings\xxx\Favorites\ÊÕ²Ø.url
CreateFile C:\WINDOWS\system32\drivers\ipn6.sys
CreateRegKey \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\ipn6
CreateRegValue \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ipn6\ImagePath
CreateRegValue \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ipn6\DisplayName
CreateRegValue \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ipn6\Group
CreateRegValue \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ipn6\ErrorControl
CreateRegValue \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ipn6\Start
CreateRegValue \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ipn6\Type
CreateRegValue \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ipn6\setonce
CreateFile C:\WINDOWS\system32\drivers\v2uxmzgn.sys
CreateRegKey \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\v2uxmzgn
CreateRegValue \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\v2uxmzgn\ImagePath
CreateFile C:\WINDOWS\system32\5blzp9.dll

[ 本帖最后由 zane_xzz 于 2007-8-21 21:38 编辑 ]

显示全部楼层 · 发表于 2007-8-21 21:37:50

AVG不报

显示全部楼层 · 发表于 2007-8-21 21:38:08

卡巴又挂

显示全部楼层 · 发表于 2007-8-21 21:38:10

NOD32 C:\Documents and Settings\Administrator\桌面\mminstall.rar >>RAR >>mminstall.exe - Win32/TrojanDownloader.QQHelper.NDF 木马的变种

显示全部楼层 · 发表于 2007-8-21 21:39:08

Check system areas...
Check selected directories and files...
Object: [UPX]
In archive: C:\Documents and Settings\Administrator\桌面\mminstall.exe
Status: Virus detected
Virus: Win32:Agent-JQE [Trj] (Engine B)
Object: mminstall.exe
Path: C:\Documents and Settings\Administrator\桌面
Status: Virus detected
Virus: Win32:Agent-JQE [Trj] (Engine B)
Analysis complete: 8/21/2007 21:33
1 files checked
1 infected files detected
0 suspected files detected

显示全部楼层 · 发表于 2007-8-21 21:40:42

又是qqhelp

显示全部楼层 · 发表于 2007-8-21 21:43:01

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MMINSTALL.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\DRIVERS\SWII2.SYS
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-8-21 21:45:51

avast报Win32:Agent-JQE [Trj]

显示全部楼层 · 发表于 2007-8-21 21:53:41

这个是专门针对卡巴的

显示全部楼层 · 发表于 2007-8-21 22:30:24

红伞pass

[病毒样本] 一个，有联网[MD5: 222DE4]

本帖子中包含更多资源