可疑文件 s.exe[MD5:A9EC0]

BING126

McAfee 报了 winine.exe   New-Malware.ek

cstar007

2007-11-17 20:36:54    修改注册表内容      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\IXP000.TMP\0_lh.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG
注册表名称:Seed
触发规则:应用程序规则->禁止添加->%systemdrive%\*\Temp*\*

2007-11-17 20:36:33    运行应用程序      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\s.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\IXP000.TMP\0_lh.exe
触发规则:所有程序规则->禁止运行->%systemdrive%\*\Temp*\*

2007-11-17 20:36:55    安装服务或者驱动      操作:阻止
进程路径:C:\WINDOWS\system32\services.exe
文件路径:C:\WINDOWS\system32\winine.exe
触发规则:所有程序规则->*


2007-11-17 20:36:53    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\s.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
注册表名称:wextract_cleanup0
注册表数据:rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\"
触发规则:所有程序规则->系统自动运行->*\Software\Microsoft\Windows\CurrentVersion\Run*

EQ的日志里记录的 我复制了一些

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 906
Paranoia Database - 48810
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder (2)

C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\s.exe - Infected BACKDOOR.HUPIGON.10 - Deleted

1 Files scanned
1 Infected files found
0 Suspected files found
0 Files disinfected
1 Files deleted

googlehack

这个东西尺寸还够大的~·