[76535B]

显示全部楼层 · 发表于 2007-10-6 15:35:16

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\window.rar'
C:\Documents and Settings\Administrator\桌面\window.rar
  [0] Archive type: RAR
  --> window.exe
   [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-10-6 15:42:31

2007-10-6 15:42:20 1191656540 Administrator 3952 Sign of "Win32:Nilage-AI [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\window.rar\window.exe\[Embedded#DATAINFO]" file.
2007-10-6 15:42:22 1191656542 Administrator 3952 Sign of "Win32:Nilage-AI [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\window.rar\window.exe" file.

显示全部楼层 · 发表于 2007-10-6 15:50:21

ESS。。。。。。。

显示全部楼层 · 发表于 2007-10-6 16:03:11

显示全部楼层 · 发表于 2007-10-6 16:05:50

rs挂了

显示全部楼层 · 发表于 2007-10-6 19:22:03

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 325
Paranoia Database - 6878
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\window.exe

C:\Documents and Settings\uhthn\Desktop\window.exe - Infected Win32.Trojan-PSW.Delf.b

1 Files scanned
1 Infected files found
0 Suspected files found
0 Files cured
1 Files deleted

显示全部楼层 · 发表于 2007-10-6 20:56:15

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WINDOW.EXE
由
C:\AUTORUN.INF
自启动运行!
并生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\NEWTEMP.BAK
2) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\NEWTEMP.DLL
3) C:\PEGEFILE.PIF
4) C:\AUTORUN.INF
以及可由此INF文件引导自启的文件:
C:\PEGEFILE.PIF

是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-10-6 21:12:56

pass

[病毒样本] [76535B]

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源