MSN蠕虫（1c90ec）

孤独更可靠

又更新了

不懂怎么说

卡吧、金山、偌顿、大蜘蛛都飘了

分析在：

http://hi.baidu.com/%B9%C2%B6%C0%B8%FC%BF%C9%BF%BF/blog/item/60c67f3da9154eed3d6d97a6.html

mofunzone

被伞击飞

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\My_Pictures2007.zip'
C:\Documents and Settings\Administrator\My Documents\
  My_Pictures2007.zip
    [0] Archive type: ZIP
    --> picture59.jpeg-www.photobucket.com
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

绅博周幸

Starting the file scan:

Begin scan in 'D:\My_Pictures2007.zip'
D:\My_Pictures2007.zip
  [0] Archive type: ZIP
  --> picture59.jpeg-www.photobucket.com
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!

Redevil

Kaspersky Internet Security 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=127475 is infected with Heur.Trojan.Generic virus

mofunzone

A-Squared	Found  nothing
AntiVir	Found TR/Crypt.ULPM.Gen
ArcaVir	Found  nothing
Avast	Found  nothing
AVG Antivirus	Found SHeur.MUO
BitDefender	Found Trojan.Peed.Gen
ClamAV	Found  nothing
CPsecure	Found  nothing
Dr.Web	Found  nothing
F-Prot Antivirus	Found  nothing
F-Secure Anti-Virus	Found  nothing
Fortinet	Found  nothing
Kaspersky Anti-Virus	Found  nothing
NOD32	Found  nothing
Norman Virus Control	Found W32/Malware.APQJ
Panda Antivirus	Found W32/MSNWorm.AF.worm
Rising Antivirus	Found  nothing
Sophos Antivirus	Found Mal/HckPk-A
VirusBuster	Found  nothing
VBA32	Found  nothing

zlq7zj

解压报

tracydk

2007-09-14 13:07:03    创建注册表值      操作:阻止
进程路径:F:\病毒样本\My_Pictures2007\picture59.jpeg-www.photobucket.com
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
注册表名称:Server Runtime Server Subsystem
注册表数据:C:\WINDOWS\system\csrss.exe
触发规则:所有程序规则->系统自动运行->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*


2007-09-14 13:07:09    运行应用程序      操作:允许
进程路径:F:\病毒样本\My_Pictures2007\picture59.jpeg-www.photobucket.com
文件路径:C:\WINDOWS\system\csrss.exe
触发规则:所有程序规则->*

kp2006

瑞星2008主动防御恶意行为报恶意代码

[ 本帖最后由 kp2006 于 2007-9-14 13:19 编辑 ]

soft_killer

MP

kkgh

瑞星08直接干掉