U盘的

zlq7zj

貌似是新的！！

The EQs

C:\Documents and Settings\Don johnson\桌面\Windows.rar » RAR » Windows.scr - a variant of Win32/PSW.OnLineGames.NBR trojan

平淡

woai_jolin

2007-10-13 23:52:58    运行应用程序      操作:允许
进程路径:C:\WINDOWS\Explorer.EXE
文件路径:G:\V\Windows.scr
命令行:/S
触发规则:黑名单->禁止执行程序的目录->G:\V\*


2007-10-13 23:52:58    创建文件      操作:阻止
进程路径:G:\V\Windows.scr
文件路径:C:\Program Files\360safe\MFC42.DLL
触发规则:所有程序规则->全局设置_可执行文件1_普通模式->%SystemDrive%\*.dll


2007-10-13 23:52:58    创建文件      操作:阻止
进程路径:G:\V\Windows.scr
文件路径:C:\Program Files\360safe\MFC42.DLL\10I11O10.\
触发规则:所有程序规则->全局设置_普通模式->%SystemDrive%\*


2007-10-13 23:52:58    创建文件      操作:阻止
进程路径:G:\V\Windows.scr
文件路径:C:\Program Files\Internet Explorer\OnlO0r.bak
触发规则:所有程序规则->全局设置_普通模式->%SystemDrive%\*


2007-10-13 23:52:58    创建文件      操作:阻止
进程路径:G:\V\Windows.scr
文件路径:C:\Program Files\Internet Explorer\OnlO0r.bak
触发规则:所有程序规则->全局设置_普通模式->%SystemDrive%\*


2007-10-13 23:52:58    创建文件      操作:阻止
进程路径:G:\V\Windows.scr
文件路径:C:\Program Files\Internet Explorer\OnlO0r.bak
触发规则:所有程序规则->全局设置_普通模式->%SystemDrive%\*


2007-10-13 23:52:58    创建文件      操作:阻止
进程路径:G:\V\Windows.scr
文件路径:C:\Program Files\Internet Explorer\OnlO0r.dll
触发规则:所有程序规则->全局设置_可执行文件1_普通模式->%SystemDrive%\*.dll


2007-10-13 23:52:58    创建文件      操作:阻止
进程路径:G:\V\Windows.scr
文件路径:C:\Program Files\Common Files\fjOs0r.dll
触发规则:所有程序规则->全局设置_可执行文件1_普通模式->%SystemDrive%\*.dll


2007-10-13 23:53:01    创建注册表值      操作:阻止
进程路径:G:\V\Windows.scr
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
注册表名称:{CC3596CB-D6C1-ECA1-AE51-DEEA63F6C21C}
触发规则:所有程序规则->系统设置->HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks


2007-10-13 23:53:03    创建注册表值      操作:阻止
进程路径:G:\V\Windows.scr
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2626E66-D21B-E628-C1DF-1DACCFA36ED2}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*


2007-10-13 23:53:04    创建注册表值      操作:阻止
进程路径:G:\V\Windows.scr
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2626E66-D21B-E628-C1DF-1DACCFA36ED2}
注册表名称:[Key]
触发规则:所有程序规则->IE浏览器设置->HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\Windows.rar'
C:\Documents and Settings\Administrator\桌面\Windows.rar
  [0] Archive type: RAR
  --> Windows.scr
      [DETECTION] Is the Trojan horse TR/Spy.QQLogger.F
      [WARNING]   The file was ignored!

Nerazzurri

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at:        0:39:42 2007-10-14

+ Scan result:       



C:\Documents and Settings\Crusade\桌面\Windows.rar/Windows.scr -> Dropper.Agent : Cleaned.


::Report end

傻猪猪米走鸡

ENA报马！

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\Windows.rar'
C:\Users\morgan\Documents\
  Windows.rar
  Windows.rar:Zone.Identifier
    [0] Archive type: RAR
    --> Windows.scr
        [DETECTION] Is the Trojan horse TR/Spy.QQLogger.F
        [WARNING]   Infected files in archives cannot be repaired!
    --> autorun.inf
        [INFO]      The file was deleted!

残缺的唯美

Result: 1 malware found
Trojan-Spy.Win32.QQLogger.g (virus)
C:\Users\Administrator\Desktop\Windows.rar\Windows.scr

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 521
Paranoia Database - 10427
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder (2)

C:\Documents and Settings\uhthn\Desktop\New Folder (2)\Windows.scr - Infected Win32.Virus.autorun.2
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\autorun.inf - Infected Virus.autorun.12

2 Files scanned
2 Infected files found
0 Suspected files found
0 Files cured
2 Files deleted