MD5Check.exe [md5:5794bae]

微点卫士

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MD5CHECK.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\MD5CHECK.EXE
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\BOOT.EXE
3) C:\WINDOWS.0\WINDOWS UPDATE.EXE
是否删除木马程序及其衍生物?

壳猛，运行估计都报
2007-9-5 15:24:41        文件监控        文件        C:\Sandbox\DefaultBox\user\current\Local Settings\Temp\boot.exe        Win32/Hupigon 木马 变种        已隔离 - 已删除                应用程序试图创建新文件时发生事件: F:\virus\MD5Check.exe. 文件已移至隔离区，你可以关闭此窗口。

timhas266

Start of the scan: Wednesday, 5 September, 2007  16:48

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\MD5Check.rar'
C:\Documents and Settings\tim\桌面\MD5Check.rar
  [0] Archive type: RAR
  --> MD5Check.exe
      [DETECTION] Is the Trojan horse TR/Drop.Binder.W
      [INFO]      A backup was created as '47136d88.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

promised

C:\ABC\MD5Check.rar:\MD5Check.exe - 可疑代码段 被发现 (Level: 115)
C:\ABC\MD5Check.rar