又见U盘病毒。

HC303

机子上的瑞星（20.19.20）MISS，已上报。
毒霸2007,报壳。
小红伞高启发报可疑，已上报。

SONGBOWEN

Begin scan in 'C:\Documents and Settings\Administrator\桌面\illyyva.rar'
C:\Documents and Settings\Administrator\桌面\illyyva.rar
  [0] Archive type: RAR
  --> illyyva.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [WARNING]   The file was ignored!


检测到：病毒 Virus.Win32.AutoRun.ww        文件: C:\Documents and Settings\Administrator\桌面\illyyva.rar/illyyva.exe//PE_Patch.MaskPE

The EQs

C:\Documents and Settings\Don johnson\桌面\illyyva.rar » RAR » illyyva.exe - probably a variant of Win32/Delf.NDF worm

Roboon

Roboon：程序:
D:\PROGRAM FILES\WINRAR\WINRAR.EXE
木马程序生成以下文件:
1) C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\TEMP\RAR$EX00.918\ILLYYVA.EXE
2) C:\PROGRAM FILES\COMMON FILES\SYSTEM\HUOCBKB.EXE
3) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\NYTXXEE.EXE
是否删除木马程序及其衍生物?

Roboon

Roboon：木马名称:未知木马

程序:
C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\TEMP\RAR$DR00.602\ILLYYVA.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

sam.to

学校的nod32杀了

SONGBOWEN

Antivirus	Version	Last Update	Result
AhnLab-V3	2007.11.21.0	2007.11.21	-
AntiVir	7.6.0.34	2007.11.21	HEUR/Crypted
Authentium	4.93.8	2007.11.21	Possibly a new variant of W32/Threat-HLLPEM-based!Maximus
Avast	4.7.1074.0	2007.11.20	Win32:AutoRun-FI
AVG	7.5.0.503	2007.11.20	Win32/PEMask
BitDefender	7.2	2007.11.21	Generic.Malware.SP!Pk!g.6929C581
CAT-QuickHeal	9.00	2007.11.20	(Suspicious) - DNAScan
ClamAV	0.91.2	2007.11.21	Trojan.Delf-818
DrWeb	4.44.0.09170	2007.11.21	Win32.HLLW.Autoruner.origin
eSafe	7.0.15.0	2007.11.14	-
eTrust-Vet	31.3.5313	2007.11.21	-
Ewido	4.0	2007.11.20	Heuristic.Win32.AVKiller
FileAdvisor	1	2007.11.21	-
Fortinet	3.14.0.0	2007.11.21	-
F-Prot	4.4.2.54	2007.11.21	W32/Heuristic-162!Eldorado
F-Secure	6.70.13030.0	2007.11.21	Virus.Win32.AutoRun.ww
Ikarus	T3.1.1.12	2007.11.21	-
Kaspersky	7.0.0.125	2007.11.21	Virus.Win32.AutoRun.ww
McAfee	5167	2007.11.20	-
Microsoft	1.3007	2007.11.21	Trojan:Win32/Anomaly.gen!B
NOD32v2	2674	2007.11.21	probably a variant of Win32/Delf.NDF
Norman	5.80.02	2007.11.20	-
Panda	9.0.0.4	2007.11.21	Trj/Autorun.EZ
Prevx1	V2	2007.11.21	-
Rising	20.19.20.00	2007.11.21	-
Sophos	4.23.0	2007.11.21	Mal/SillyFDC-A
Sunbelt	2.2.907.0	2007.11.21	VIPRE.Suspicious
Symantec	10	2007.11.21	W32.Dotex
TheHacker	6.2.9.135	2007.11.20	-
VBA32	3.12.2.5	2007.11.20	-
VirusBuster	4.3.26:9	2007.11.20	-
Webwasher-Gateway	6.0.1	2007.11.21	Heuristic.Crypted

googlehack

典型的u盘病毒，总是要autorun的

HC303

autorun.inf被我从U盘上删掉了。找不到咯。

wu19934718

费尔杀一个。