一支网马 48D16C

显示全部楼层 · 发表于 2007-9-21 15:35:31

一支

[ 本帖最后由 Nblock 于 2007-9-21 15:45 编辑 ]

显示全部楼层 · 发表于 2007-9-21 15:41:02

2007-09-21 15:39:22 创建文件    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\S168\S168.exe
文件路径:C:\Program Files\Common Files\fjOs0r.dll
触发规则:所有程序规则->文件规则->%systemdrive%\*.dll

2007-09-21 15:39:22 创建注册表值    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\S168\S168.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
注册表名称:{CC3596CB-D6C1-ECA1-AE51-DEEA63F6C21C}
触发规则:所有程序规则->系统设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

2007-09-21 15:39:22 修改注册表内容    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\S168\S168.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2626E66-D21B-E628-C1DF-1DACCFA36ED2}
注册表名称:[Key]
注册表数据:ED2}
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*

[ 本帖最后由 1688388728 于 2007-9-21 15:42 编辑 ]

显示全部楼层 · 发表于 2007-9-21 15:41:43

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\S168.rar'
C:\Documents and Settings\Administrator\My Documents\
  S168.rar
[0] Archive type: RAR
--> S168.exe
      [DETECTION] Is the Trojan horse TR/Autorun.BK
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-9-21 17:37:36

显示全部楼层 · 发表于 2007-9-21 18:12:58

Kaspersky Internet Security 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=130350 is infected with Trojan-PSW.Win32.OnLineGames.deu virus

显示全部楼层 · 发表于 2007-9-21 19:29:51

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 164
Paranoia Database - 5417
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\S168.exe

C:\Documents and Settings\uhthn\Desktop\S168.exe - Infected with SDB:Win32.Virus.autorun.ji - Deleted

1 Files scanned
1 Infected files found
0 Suspicious files found
0 Files cured
1 Files deleted

显示全部楼层 · 发表于 2007-9-21 21:29:31

已删除：木马程序 Trojan-PSW.Win32.OnLineGames.deu 文件　: G:\9.21\S168.rar/S168.exe//PE_Patch.UPX//UPX

[病毒样本] 一支网马 48D16C

本帖子中包含更多资源

本帖子中包含更多资源