金山2008防网马拦截网马

kp2006

2007-10-21 00:18:53 浏览器后台下载了一个文件D:\Documents and Settings\Administrator.BAY41Y578QW2WH4\Local Settings\Temporary Internet Files\Content.IE5\O7KHY3CR\ysyupdate[1].exe。
2007-10-21 00:18:57 浏览器后台下载了一个文件D:\Documents and Settings\Administrator.BAY41Y578QW2WH4\Local Settings\Temporary Internet Files\Content.IE5\O7KHY3CR\ysyupdate[1].exe。
2007-10-21 00:19:38 浏览器后台下载了一个文件D:\Documents and Settings\Administrator.BAY41Y578QW2WH4\Local Settings\Temporary Internet Files\Content.IE5\O7KHY3CR\ysyupdate[1].exe。
2007-10-21 00:20:08 浏览器运行了有数字签名的程序C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\Antispy\KASMain.EXE。
2007-10-21 00:21:36 浏览器运行了有数字签名的程序D:\WINDOWS\winhlp32.exe。
2007-10-21 00:21:41 根据用户指令阻止了程序D:\DOCUME~1\ADMINI~1.BAY\LOCALS~1\Temp\scvhost.exe运行。
2007-10-21 00:22:09 浏览器后台下载了一个文件D:\Documents and Settings\Administrator.BAY41Y578QW2WH4\Local Settings\Temporary Internet Files\Content.IE5\O7KHY3CR\ysyupdate[1].exe。
2007-10-21 00:22:09 浏览器后台下载了一个文件D:\DOCUME~1\ADMINI~1.BAY\LOCALS~1\Temp\scvhost.exe。
2007-10-21 00:22:21 浏览器试图运行一个没有数字签名的模块D:\DOCUME~1\ADMINI~1.BAY\LOCALS~1\Temp\scvhost.exe，已被阻止



2楼的你急什么急

[ 本帖最后由 kp2006 于 2007-10-21 12:45 编辑 ]

promised

这里是样本区

微点卫士

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\SCVHOST.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\DRIVERS\PCIBUS.SYS
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\TEMPAQ.EXE
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\TEMPAQ.EXE
是否删除病毒程序及其衍生物?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\YSYUPDATE[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

cj_236.exe ，怪怪的

浪滔天

卡巴 125
已检测到: 病毒 Worm.Win32.Downloader.j        URL: http://bbs.kafan.cn/attachment.php?aid=141963//scvhost.exe//PE_Patch//UPack
已检测到: 病毒 Worm.Win32.Downloader.j        URL: http://bbs.kafan.cn/attachment.php?aid=141964//ysyupdate[1].exe//PE_Patch//UPack

The EQs

C:\Documents and Settings\Don johnson\桌面\ysyupdate[1].rar » RAR » ysyupdate[1].exe - a variant of Win32/Jalous worm
C:\Documents and Settings\Don johnson\桌面\k.rar » RAR » scvhost.exe - a variant of Win32/Jalous worm
C:\Documents and Settings\Don johnson\桌面\k.rar » RAR » tempaq - probably a variant of Win32/Genetik trojan

timhas266

Start of the scan: Sunday, 21 October, 2007  13:19

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\樣本'
C:\Documents and Settings\tim\桌面\樣本\k.rar
  [0] Archive type: RAR
  --> scvhost.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.45056
      [INFO]      A backup was created as '478ce174.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
C:\Documents and Settings\tim\桌面\樣本\ysyupdate[1].rar
  [0] Archive type: RAR
  --> ysyupdate[1].exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.45056
      [INFO]      A backup was created as '4793e1ba.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: Sunday, 21 October, 2007  13:19
Used time: 00:02 min

The scan has been done completely.

      1 Scanning directories
      8 Files were scanned
      2 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      2 files were deleted
      0 files were repaired
      2 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      6 Files not concerned
      2 Archives were scanned
      0 Warnings
      0 Notes

The EQs

那个文件沙盘显示没有动作。。。

dolphin

RS08 完全没反应..