3e5aab

显示全部楼层 · 发表于 2007-9-5 17:30:43

AhnLab-V3 2007.9.5.0 2007.09.05 -
AntiVir 7.6.0.5 2007.09.05 TR/PSW.Linea.UZH.59
Authentium 4.93.8 2007.09.05 -
Avast 4.7.1029.0 2007.09.04 Win32:QQPass-MH
AVG 7.5.0.485 2007.09.05 PSW.Generic5.JWY
BitDefender 7.2 2007.09.05 Generic.PWStealer.5B8E6517
CAT-QuickHeal 9.00 2007.09.04 (Suspicious) - DNAScan
ClamAV 0.91.2 2007.09.05 -
DrWeb 4.33 2007.09.05 DLOADER.Trojan
eSafe 7.0.15.0 2007.09.04 Suspicious Trojan/Worm
eTrust-Vet 31.1.5111 2007.09.05 -
Ewido 4.0 2007.09.04 -
FileAdvisor 1 2007.09.05 -
Fortinet 3.11.0.0 2007.09.05 -
F-Prot 4.3.2.48 2007.09.05 -
F-Secure 6.70.13030.0 2007.09.05 W32/Malware
Ikarus T3.1.1.12 2007.09.05 Trojan-Downloader.Win32.VB.avo
Kaspersky 4.0.2.24 2007.09.05 -
McAfee 5112 2007.09.04 -
Microsoft 1.2803 2007.09.05 PWS:Win32/QQpass.CZ
NOD32v2 2505 2007.09.04 probably a variant of Win32/PSW.QQShou
Norman 5.80.02 2007.09.04 -
Panda 9.0.0.4 2007.09.05 Suspicious file
Prevx1 V2 2007.09.05 -
Rising 19.39.22.00 2007.09.05 -
Sophos 4.21.0 2007.09.05 Mal/Heuri-E
Sunbelt 2.2.907.0 2007.09.05 VIPRE.Suspicious
Symantec 10 2007.09.05 -
TheHacker 6.1.9.178 2007.09.05 -
VBA32 3.12.2.3 2007.09.04 MalwareScope.Trojan-PSW.Game.7
VirusBuster 4.3.26:9 2007.09.04 -
Webwasher-Gateway 6.0.1 2007.09.05 Trojan.PSW.Linea.UZH.59

显示全部楼层 · 发表于 2007-9-5 17:31:30

-09-05 17:30:37 加载库文件    操作:阻止
进程路径:D:\病毒库\MM\MM.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSInfo\atmQQ2.dll
触发规则:黑名单->禁止运行->%ProgramFiles%\Common Files\Microsoft Shared\MSINFO\*

2007-09-05 17:30:39 创建注册表值    操作:阻止
进程路径:D:\病毒库\MM\MM.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
注册表名称:{D544C22D-1F70-4B1E-873D-D8DABEB26695}
触发规则:所有程序规则->系统设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

2007-09-05 17:30:39 运行应用程序    操作:阻止
进程路径:D:\病毒库\MM\MM.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c ""D:\病毒库\MM\BT.BAT" "
触发规则:所有程序规则->禁止程序->*\cmd.exe

显示全部楼层 · 发表于 2007-9-5 17:37:18

显示全部楼层 · 发表于 2007-9-5 17:38:27

老毒换新衣

显示全部楼层 · 发表于 2007-9-5 18:22:18

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\MM.rar'
C:\Documents and Settings\tim\桌面\MM.rar
  [0] Archive type: RAR
  --> MM.exe
   [DETECTION] Is the Trojan horse TR/PSW.Linea.UZH.59
   [INFO]    A backup was created as '470c83a1.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-9-5 19:28:58

显示全部楼层 · 发表于 2007-9-5 19:33:22

ヒツナャノテ

显示全部楼层 · 发表于 2007-9-5 20:48:13

MM.exe - Trojan-PSW.Win32.QQPass.acu

显示全部楼层 · 发表于 2007-9-5 22:06:10

symantec飘过

[病毒样本] 3e5aab

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源