主动防御来运行 [MD5: 729E00]

taihuxian

TR/AutoRun.HJ

a256886572008

發一下，COMODO 美圖

Nblock

我的eq  江民瑞星卡巴来运行下

flo

卡7比较实在。（关闭文件保护）
2007-9-7 15:53:20        C:\FIREWALL.EXE        Process is trying to register its copy as an autorun startup object. This behaviour is typical of Trojans.
2007-9-7 15:53:20        C:\FIREWALL.EXE        Attempt to terminate process
2007-9-7 15:53:28        C:\FIREWALL.EXE        Attempt to terminate process: successfully
2007-9-7 15:53:20        C:\FIREWALL.EXE        C:\FIREWALL.EXE quarantined.
2007-9-7 15:53:30        \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinFirewall        Rollback
2007-9-7 15:53:30        C:\905c0769f9a06c95a24ddf945\patcher.exe        Rollback
2007-9-7 15:53:30        C:\905c0769f9a06c95a24ddf945\        Rollback
2007-9-7 15:53:30        C:\DOCUME~1\JUJUMA~1.COM\LOCALS~1\Temp\~DF8D34.tmp        Rollback
2007-9-7 15:53:20        C:\FIREWALL.EXE        Rollback completed

[ 本帖最后由 flo 于 2007-9-7 16:01 编辑 ]

ssy275

结果: 找到 1 恶意软件
Virus.Win32.AutoRun.hj (病毒)
C:\Documents and Settings\ssy\桌面\virus.rar\FIREWALL.EXE

Nblock

Rollback completed有装卡巴7的冲动 微点卡巴7一起监控。。 谁有卡巴7的下载链接

timhas266

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\virus.rar'
C:\Documents and Settings\tim\桌面\virus.rar
  [0] Archive type: RAR
  --> FIREWALL.EXE
      [DETECTION] Is the Trojan horse TR/AutoRun.HJ
      [INFO]      A backup was created as '475310c6.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

野马

批处理还没出来就杀掉了...有没直接点的

[ 本帖最后由 野马 于 2007-9-7 17:46 编辑 ]

xiaopangmd

2007-9-7 17:52:02        Scanning Log
2007-9-7 17:52:02        Version of virus signature database: 2511 (20070907)
2007-9-7 17:52:02        Date: 7.9.2007  Time: 17:52:02
2007-9-7 17:52:02        Scanned disks, folders and files: C:\Documents and Settings\Martin\桌面\virus.rar
2007-9-7 17:52:18        C:\Documents and Settings\Martin\桌面\virus.rar » RAR » FIREWALL.EXE - probably unknown NewHeur_PE virus [7]
2007-9-7 17:52:18        Number of scanned files: 2
2007-9-7 17:52:18        Number of threats found: 1
2007-9-7 17:52:18        Time of completion: 17:52:18  Total scanning time: 16 sec (00:00:16)
2007-9-7 17:52:18       
2007-9-7 17:52:18        Notes:
2007-9-7 17:52:18        [7] File is probably infected with an unknown virus.