[MD5: C6337E]

tonger2003

timhas266

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\Tonger2003.zip'
C:\Documents and Settings\tim\桌面\Tonger2003.zip
  [0] Archive type: ZIP
  --> s168.exe
      [DETECTION] Is the Trojan horse TR/Autorun.BK
      [INFO]      A backup was created as '4749d236.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

欠妳緈諨

S168,过不了AVAST

gho

2007-9-3        17:22:54        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\桌面\s168.exe        New Malware.n (Trojan)

moonsilver

Worm.Win32.Autorun.fb

扫描开始时间: 2007-9-3 17:38:01
扫描日志
NOD32 版本 2498 (20070902) NT
命令行: F:\virus\Tonger2003.zip

日期: 2007年9月3日  时间: 17:38:02
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: F:\virus\Tonger2003.zip
F:\virus\Tonger2003.zip ?ZIP ?s168.exe<病毒 - Win32/PSW.OnLineGames.NBR 木马 变种>
已扫描文件数量: 1
已发现病毒数量: 1
完成时间: 17:38:02 总共扫描时间: 0 秒 (00:00:00)

wangjay1980

s168.exe   Trojan-PSW.Win32.Delf.zi

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 2684
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\s168.exe

C:\Documents and Settings\uhthn\Desktop\s168.exe - Infected with PDB-967 Malware program (Paranoia Database) - Deleted

1 Files scanned
1 Infected files found
0 Suspicious files found
0 Files cured
1 Files deleted

1688388728

2007-09-03 17:46:43    创建文件      操作:阻止
进程路径:D:\病毒库\Tonger2003\s168.exe
文件路径:C:\Program Files\Internet Explorer\rksldk.dll
触发规则:所有程序规则->文件规则->%systemdrive%\*.dll


2007-09-03 17:46:43    创建文件      操作:阻止
进程路径:D:\病毒库\Tonger2003\s168.exe
文件路径:C:\Program Files\Common Files\goskdl.dll
触发规则:所有程序规则->文件规则->%systemdrive%\*.dll


2007-09-03 17:46:43    创建注册表值      操作:阻止
进程路径:D:\病毒库\Tonger2003\s168.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
注册表名称:{DC7596CB-D6CC-DCA3-DE52-DEEA63F6C61D}
触发规则:所有程序规则->系统设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks


2007-09-03 17:46:43    修改注册表内容      操作:阻止
进程路径:D:\病毒库\Tonger2003\s168.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1626E66-C26B-C628-E1DF-CDACCFA26EE1}
注册表名称:[Key]
注册表数据:EE1}
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-09-03 17:46:43    修改注册表内容      操作:阻止
进程路径:D:\病毒库\Tonger2003\s168.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1626E66-C26B-C628-E1DF-CDACCFA26EE1}
注册表名称:[Key]
注册表数据:EE1}
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*

微点卫士

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S168.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\RKSLDK.BAK
2) C:\PROGRAM FILES\INTERNET EXPLORER\RKSLDK.DLL
3) C:\PROGRAM FILES\COMMON FILES\GOSKDL.DLL
是否删除木马程序及其衍生物?