【1A5D7D】在群里发现的一个病毒，KIS7 PASS

显示全部楼层 · 发表于 2007-11-3 01:17:51

C:\Documents and Settings\Uhthn\Desktop\我的照片.Exe : infected MalwareScope.Trojan-PSW.Game.7

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 786
Paranoia Database - 48413
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\我的照片.Exe

C:\Documents and Settings\Uhthn\Desktop\我的照片.Exe - Infected WIN32.TROJAN-PSW.QQPASS.A - Deleted

1 Files scanned
1 Infected files found
0 Suspected files found
0 Files disinfected
1 Files deleted

显示全部楼层 · 发表于 2007-11-3 10:18:58

瑞星08主动防御干掉

显示全部楼层 · 发表于 2007-11-3 11:16:42

[0] Archive type: RAR
  --> ÎÒµÄÕÕÆ¬.Exe
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
   [WARNING] The file was ignored!

End of the scan: 2007年11月3日  11:16
Used time: 00:01 min

The scan has been done completely.

   0 Scanning directories
   3 Files were scanned
   1 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-11-3 11:48:53

程序:
C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\RAR$EX00.707\我的照片.EXE
由
E:\AUTORUN.INF
自启动运行!
并生成以下文件:
1) E:\AUTORUN.EXE
2) E:\AUTORUN.INF
以及可由此INF文件引导自启的文件:
E:\AUTORUN.EXE

显示全部楼层 · 发表于 2007-11-3 13:24:41

C:\我的照片.Exe - infected with Trojan.PWS.Qqpass.origin

DRWEB 4.44 Kill

显示全部楼层 · 发表于 2007-11-3 22:02:06

显示全部楼层 · 发表于 2007-11-3 22:20:23

Start of the scan: 2007年11月3日  22:19

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\932.rar
  [0] Archive type: RAR
  --> ÎÒµÄÕÕÆ¬.Exe
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
   [INFO]    The file was deleted!

End of the scan: 2007年11月3日  22:19
Used time: 00:10 min

The scan has been done completely.

   1 Scanning directories
   2 Files were scanned
   1 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-11-3 22:48:07

C:\Users\Administrator\Desktop\932.rar » RAR » 我的照片.Exe - probably a variant of Win32/AutoRun.Q worm

显示全部楼层 · 发表于 2007-11-4 02:19:04

小A 、NOD32 报。

显示全部楼层 · 发表于 2007-11-4 06:28:53

[病毒样本] 【1A5D7D】在群里发现的一个病毒，KIS7 PASS

本帖子中包含更多资源

本帖子中包含更多资源