24ae25

显示全部楼层 · 发表于 2007-9-10 18:14:28

瑞星、金山、江民全过..

显示全部楼层 · 发表于 2007-9-10 18:21:29

s368.rar >>RAR >>s368.exe - Win32/PSW.OnLineGames.NBR 木马的变种

显示全部楼层 · 发表于 2007-9-10 18:23:58

过fs

显示全部楼层 · 发表于 2007-9-10 18:54:58

卡巴斯基互联网安全套装 7.0The requested URL http://bbs.kafan.cn/attachment.php?aid=126085 is infected with Virus.Win32.AutoRun.ls virus

2007-09-10 18:53:31 创建文件    操作:阻止
进程路径:D:\病毒库\s368\s368.exe
文件路径:C:\Program Files\Internet Explorer\OnlO0r.dll
触发规则:所有程序规则->文件规则->%systemdrive%\*.dll

2007-09-10 18:53:31 创建文件    操作:阻止
进程路径:D:\病毒库\s368\s368.exe
文件路径:C:\Program Files\Common Files\fjOs0r.dll
触发规则:所有程序规则->文件规则->%systemdrive%\*.dll

2007-09-10 18:53:31 创建注册表值    操作:阻止
进程路径:D:\病毒库\s368\s368.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
注册表名称:{CC3596CB-D6C1-ECA1-AE51-DEEA63F6C21C}
触发规则:所有程序规则->系统设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

2007-09-10 18:53:31 修改注册表内容    操作:阻止
进程路径:D:\病毒库\s368\s368.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2626E66-D21B-E628-C1DF-1DACCFA36ED2}
注册表名称:[Key]
注册表数据:ED2}
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*

2007-09-10 18:53:31 修改注册表内容    操作:阻止
进程路径:D:\病毒库\s368\s368.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2626E66-D21B-E628-C1DF-1DACCFA36ED2}
注册表名称:[Key]
注册表数据:ED2}

[ 本帖最后由 1688388728 于 2007-9-11 05:17 编辑 ]

显示全部楼层 · 发表于 2007-9-10 19:05:27

Scan performed at: 2007-9-10 19:04:53
Scanning Log
NOD32 version 2518 (20070910) NT
Command line: D:\Documents and Settings\EKINCHENG\桌面\s368.rar

Date: 10.9.2007 Time: 19:04:55
Anti-Stealth technology is enabled.
Scanned disks, folders and files: D:\Documents and Settings\EKINCHENG\桌面\s368.rar
D:\Documents and Settings\EKINCHENG\桌面\s368.rar ?RAR ?s368.exe - a variant of Win32/PSW.OnLineGames.NBR trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 19:04:55 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-9-10 19:12:52

Begin scan in 'D:\病毒测试\未解压样本\s368.rar'
D:\病毒测试\未解压样本\s368.rar
  [0] Archive type: RAR
  --> s368.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
   [WARNING] The file was ignored!

End of the scan: 2007年9月10日  19:12
Used time: 00:21 min
我的是病毒库比较古老的AVIRA

显示全部楼层 · 发表于 2007-9-10 20:20:44

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\S368.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\ONLO0R.BAK
2) C:\PROGRAM FILES\INTERNET EXPLORER\ONLO0R.DLL
3) C:\PROGRAM FILES\COMMON FILES\FJOS0R.DLL
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-9-10 21:50:53

[DETECTION] Contains suspicious code HEUR/Crypted

[病毒样本] 24ae25

本帖子中包含更多资源