三个[MD5: 35C799 D456BA 55D18D]

显示全部楼层 · 发表于 2007-8-26 20:20:28

[MD5: 35C799 D456BA 55D18D]

显示全部楼层 · 发表于 2007-8-26 20:22:37

F:\ATSPY.rar »RAR »AUTORUN.EXE - a variant of Win32/AutoRun.Q worm

.kas .sys pass

显示全部楼层 · 发表于 2007-8-26 20:24:37

显示全部楼层 · 发表于 2007-8-26 20:45:57

2007-8-26 20:44 [Guard] Malware found
   Virus or unwanted program 'DR/Delphi.Gen [DR/Delphi.Gen]'
   detected in file 'C:\Documents and Settings\X\桌面\AUTORUN.EXE.
   Action performed: Deny access

2007-8-26 20:44 [Guard] Malware found
   Virus or unwanted program 'DR/Delphi.Gen [DR/Delphi.Gen]'
   detected in file 'C:\Documents and Settings\X\桌面\AUTORUN.EXE.
   Action performed: Deny access

2007-8-26 20:44 [Guard] Malware found
   Virus or unwanted program 'DR/Delphi.Gen [DR/Delphi.Gen]'
   detected in file 'C:\Documents and Settings\X\桌面\AUTORUN.EXE.
   Action performed: Deny access

2007-8-26 20:44 [Guard] Malware found
   Virus or unwanted program 'HEUR/Malware [HEUR/Malware]'
   detected in file 'C:\Documents and Settings\X\桌面\KASEXT.KAS.
   Action performed: Move file to quarantine

显示全部楼层 · 发表于 2007-8-26 21:26:03

ATSPY.SYS, KASEXT.KAS

No malicious code were found in these files.

Please quote all when answering.

--
Best regards, Denis Maslennikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: ATSPY.zip

显示全部楼层 · 发表于 2007-8-26 21:26:32

AUTORUN.exed - Virus.Win32.AutoRun.ip,

显示全部楼层 · 发表于 2007-8-26 21:29:01

D:\Documents and Settings\EKINCHENG\桌面\ATSPY.rar - a variant of Win32/AutoRun.Q worm - deleted - quarantined
D:\Documents and Settings\EKINCHENG\桌面\ATSPY.rar » RAR » KASEXT.KAS - is OK
D:\Documents and Settings\EKINCHENG\桌面\ATSPY.rar » RAR » AUTORUN.EXE - a variant of Win32/AutoRun.Q worm
D:\Documents and Settings\EKINCHENG\桌面\ATSPY.rar » RAR » ATSPY.SYS - is OK
ess

显示全部楼层 · 发表于 2007-8-26 21:34:52

AVAST1个

显示全部楼层 · 发表于 2007-8-26 22:53:08

显示全部楼层 · 发表于 2007-8-26 23:26:05

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\AUTORUN.EXE
由
E:\AUTORUN.INF
自启动运行!
并生成以下文件:
1) E:\AUTORUN.EXE
2) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSWIN64.JMP
3) E:\AUTORUN.INF
以及可由此INF文件引导自启的文件:
E:\AUTORUN.EXE

是否删除木马程序及其衍生物?

[病毒样本] 三个[MD5: 35C799 D456BA 55D18D]

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块