再来一个Autorun.exe,隐藏的好深！

qieyige

在我机器里找到的，里面的文件标识为隐藏、系统文件。看不见，但是还是被我找到了。小东西还穿着马甲呢。

[ 本帖最后由 qieyige 于 2007-10-5 08:35 编辑 ]

jigong9898

没逃过红伞的五指山。

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\AutoRun.rar'
C:\Documents and Settings\Administrator\桌面\AutoRun.rar
  [0] Archive type: RAR
  --> AutoRun.exe
      [DETECTION] Is the Trojan horse TR/PSW.QQGame.AI.1
      [INFO]      The file was deleted!

微点卫士

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\AUTORUN.EXE
由
E:\AUTORUN.INF
自启动运行!
并生成以下文件:
1) E:\AUTORUN.EXE
2) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSWIN74.JMP
3) E:\AUTORUN.INF
以及可由此INF文件引导自启的文件:
E:\AUTORUN.EXE

Redevil

Kaspersky Internet Security 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=135463 is infected with Trojan-PSW.Win32.QQGame.ai virus

changzheng2

AutoRun.exe : Not detected by Sandbox (Signature: W32/Malware.AYGT)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: W32/Malware.AYGT
    * Compressed: YES

[ General information ]
    * Decompressing UPX.
    * Accesses executable file from resource section.
    * **Locates window "malegebazideq [class NULL]" on desktop.
    * **Locates window "wocaonilaomuq [class NULL]" on desktop.
    * File length:        33063 bytes.
    * MD5 hash: 2cbef55713cad85ec3937bf71818a069.

[ Changes to filesystem ]
    * Deletes file E:\AutoRun.exe.
    * Deletes file C:\Program Files\Internet Explorer\PLUGINS\SysWin74.Jmp.
    * Creates file C:\Program Files\Internet Explorer\PLUGINS\SysWin74.Jmp.
    * Deletes file C:\Program Files\Internet Explorer\PLUGINS\WinSys84.Sys.
    * Creates file C:\Program Files\Internet Explorer\PLUGINS\WinSys84.Sys.

jyxtay

同样也逃不过小A的魔掌

solcroft

a256886572008

残缺的唯美

Result: 1 malware found
Trojan-PSW.Win32.QQGame.ai (virus)
C:\Users\Administrator\Desktop\AutoRun.rar\AutoRun.exe