qqpass[MD5: 8D5908 C2A089]

promised

C:\ABC\atmQQ2.dll - 特征码 'MalwareScope.Worm.Viking.4' 被发现
C:\ABC\MM.exe - 特征码 'Generic.PWStealer' 被发现

红心王子

留下了DLL

2007-10-20        16:46:21        1192869981        Administrator        2404        Sign of "Win32:Delf-CSQ [Trj]" has been found in "D:\Downloads\样本1.rar\MM.exe" file.

啊弥陀佛

微点砍掉

zxy900906

Scan Log
Version of virus signature database: 2604 (20071019)
Date: 20.10.2007  Time: 16:51:46
Scanned disks, folders and files: C:\Documents and Settings\Administrator\桌面\��1.rar
C:\Documents and Settings\Administrator\桌面\��1.rar » RAR » MM.exe - probably a variant of Win32/PSW.QQShou trojan
C:\Documents and Settings\Administrator\桌面\��1.rar » RAR » atmQQ2.dll - probably a variant of Win32/Genetik trojan

kkgh

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.QQPass.yva
病毒： Trojan.PSW.Win32.QQPass.yva

用户来源：互联网

nosferatu

tarting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\��1.rar'
C:\Documents and Settings\Administrator\桌面\��1.rar
  [0] Archive type: RAR
  --> MM.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> atmQQ2.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.QQPass.yva
病毒： Trojan.PSW.Win32.QQPass.yva

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.14.52

woai_jolin

BitDefender Log File !!!!!
Product : BitDefender Internet Security 2008
Version : BitDefender UIScanner v.11
Log date : 20:01:23 20/10/1997
Log path : C:\Documents and Settings\Administrator\Application Data\BitDefender\Desktop\Profiles\Logs\contextual\877348883_1_02.xml

Scan Paths:Path0000: G:\V\atmQQ2.dll
Path0001: G:\V\MM.exe


Scan Options:Scan for viruses : Yes
Scan for adware : Yes
Scan for spyware : Yes
Scan for applications : Yes
Scan for dialers : Yes
Scan for rootkits : No


Target selection options:Scan registry keys : No
Scan cookies : No
Scan boot sectors : No
Scan memory processes : No
Scan archives : No
Scan runtime packers : No
Scan emails : No
Scan all files : No
Heuristic Scan : No
Scanned extensions : (null)
Excluded extensions :  


Target ProcessingDefault action for infected objects : Disinfect
Default action for suspicious objects : None
Default action for hidden objects : None


Scan engines summaryNumber of virus signatures : 0
Archive plugins : 0
Email plugins : 0
Scan plugins : 0
Archive plugins : 0
System plugins : 0
Unpack plugins : 0


Overall scan summaryScanned items : 0
Infected items : 0
Suspicious items : 0
Resolved items : 0
Individual viruses found : 0
Scanned directories : 0
Scanned boot sectors : 0
Scanned archives : 0
Input-output errors : 0
Scan time : 00:00:00:01
Files per second : 0


Scanned processes summaryScanned : 0
Infected : 0


Scanned registry keys summaryScanned : 0
Infected : 0


Scanned cookies summaryScanned : 0
Infected : 0


Remaining issues:Object Name Threat Name Final Status
G:\V\MM.exe DeepScan:Generic.PWStealer.8E2F6E13 Disinfect Failed
G:\V\atmQQ2.dll DeepScan:Generic.PWStealer.DF66F982 Disinfect Failed


Resolved issues:Object Name Threat Name Final Status

woai_jolin

1997-10-20 20:01:45    运行应用程序      操作:允许
进程路径:C:\WINDOWS\Explorer.EXE
文件路径:G:\V\MM.exe
触发规则:黑名单->禁止执行程序的目录->G:\V\*


1997-10-20 20:01:45    创建文件      操作:阻止
进程路径:G:\V\MM.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll
触发规则:所有程序规则->全局设置_可执行文件1_普通模式->%SystemDrive%\*.dll


1997-10-20 20:01:47    创建注册表值      操作:阻止
进程路径:G:\V\MM.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
注册表名称:{7147BD02-68AB-E135-89BD-023579BCE135}
触发规则:所有程序规则->系统设置->HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks


1997-10-20 20:01:47    运行应用程序      操作:阻止
进程路径:G:\V\MM.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c ""G:\V\BT.BAT" "
触发规则:所有程序规则->系统程序_黑名单->*\cmd.exe

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 647
Paranoia Database - 48016
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder (2)

C:\Documents and Settings\uhthn\Desktop\New Folder (2)\MM.exe - Infected Win32.Trojan-PSW.QQPass.a
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\atmQQ2.dll - Infected Win32.Trojan-PSW.QQPass.a

2 Files scanned
2 Infected files found
0 Suspected files found
0 Files cured
2 Files deleted