无名称exe,挂很多[b78ebd]

promised

软件名称	引擎版本	病毒库版本	病毒库时间	扫描结果	时间
a-squared	3.0.0.123	2007.09.02	2007-09-02	-	3.988
Arcavir	1.0.4	200709020952	2007-09-02	-	1.189
AVAST	1.0.8	000772-0	2007-09-03	-	3.123
AVG	7.5.48.442	269.13.3/986	2007-09-03	-	1.492
BitDefender	7.60825.825645	7.14606	2007-09-03	-	3.040
CA (VET)	8.4.0.24	31.1.5105	2007-09-03	-	0.853
ClamAV	0.91.1	4136	2007-09-03	Trojan.Agent-5462	0.016
ewido	4.0.0.2	2007.09.02	2007-09-02	-	2.076
F-SECURE	5.51.6100	2007.09.03.02	2007-09-03	-	2.526
IKARUS	T3.1.1.12	2007.09.03.69438	2007-09-03	Trojan.Win32.Agent.abe	1.265
MKS_VIR	2.01	2007.09.03	2007-09-03	-	2.061
NOD32	2.70.8	2499	2007-09-03	a variant of Win32/Agent.ABE trojan	0.009
nProtect	2007-09-03.00	40260	2007-09-03	-	8.982
QuickHeal	9.00	2007.09.01	2007-09-01	-	2.200
SOPHOS	2.49.1	4.21	2007-09-03	-	2.334
VBA32	3.12.2.3	20070901.0836	2007-09-01	-	0.681
VirusBuster	4.3.19:9	9.099.15/11.0	2007-09-02	-	0.949
冰岛杀毒	3.16.16	2007.09.02	2007-09-02	-	0.424
卡巴斯基	5.5.10	2007.09.03	2007-09-03	-	0.028
大蜘蛛	4.33	2007.09.03	2007-09-03	-	5.795
小红伞	7.4.1.66	6.39.1.79	2007-09-03	TR/Spy.Agent.ABE	2.346
江民杀毒	10.00.650	2007.09.02	2007-09-02	-	0.729
熊猫卫士	9.04.03.0001	2007.09.02	2007-09-02	-	3.101
瑞星	19.0	19.39.02.00	2007-09-03	-	1.362
诺曼	5.91.05	5.90	2007-09-02	-	3.095
赛门铁克	1.3.0.24	20070902.006	2007-09-02	-	0.210
趋势	8.500-1001	4.689.00	2007-09-03	-	0.037
迈克菲	5.1.00	5110	2007-08-31	-	0.701
金山毒霸	2007.6.20.249	2007.9.3	2007-09-03	-	0.810

微点卫士

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\VKAOLK68.DLL
2) C:\WINDOWS.0\SYSTEM32\DRIVERS\VKAOLK68.SYS
是否删除木马程序及其衍生物?

残缺的唯美

--> .exe
      [DETECTION] Is the Trojan horse TR/Spy.Agent.ABE
      [INFO]      A backup was created as '47450437.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

moonsilver

挂了

[ 本帖最后由 moonsilver 于 2007-9-3 21:52 编辑 ]

moonsilver

创建C:\WINDOWS\SYSTEM32\DRIVERS\CGBLWV47.SYS
修改C:\WINDOWS\SYSTEM32\DRIVERS\CGBLWV47.SYS
创建C:\WINDOWS\SYSTEM32\CGBLWV47.DLL
修改C:\WINDOWS\SYSTEM32\CGBLWV47.DLL
注册表项：HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\CGBLWV47\
创建键:
加载驱动文件：
\REGISTRY\MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\CGBLWV47

1688388728

2007-09-03 21:29:48    创建文件      操作:阻止
进程路径:D:\病毒库\.zip[1]\.exe
文件路径:C:\WINDOWS\system32\zrozeq87.dll
触发规则:所有程序规则->文件规则->%systemdrive%\*.dll

solcroft

jhtl

红伞太强了 不服不行啊。

小邪邪

咖啡超级防护罩

小邪邪

咖啡中级防护罩