机器狗+[凝逸防御-机器狗]成功防御机器狗!

凝逸反毒

凝逸防御-机器狗 http://bbs.kafan.cn/viewthread.php?tid=168283&extra=page%3D1&frombbs=1




2007-12-01 09:45:53 文件保护(创建文件)     操作:允许
进程路径:F:\机器狗\机器狗23(1).exe
文件路径:C:\windows\system32\drivers\pcihdd.sys



启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <upxdnd><C:\windows\upxdnd.exe>  []
    <LotusHlp><C:\windows\LotusHlp.exe>  []
    <WinForm><C:\windows\WinForm.exE>  []
    <MsIMMs32><C:\windows\MsIMMs32.exE>  []
    <GenProtect><C:\windows\GenProtect.exE>  []
    <msccrt><C:\windows\msccrt.exe>  []
    <MsPrint32D><C:\windows\MsPrint32D.exe>  []
    <AVPSrv><C:\windows\AVPSrv.exE>  []
    <DbgHlp32><C:\windows\DbgHlp32.exe>  []
    <WinSysW><C:\windows\49400L.exe>  []
    <WinSysM><C:\windows\49400M.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{B7777BE4-DD7E-4EFF-8F13-56C4ADD3F454}><C:\windows\system32\ydkqydjpvy.dll>  [Microsoft Corporation]
    <{36FF2E71-1F0D-4E07-9213-E6740C57322E}><C:\windows\system32\ejqxmrwcinsy.dll>  [Microsoft Corporation]
    <{4DF4F122-943D-40f8-B3F2-72BD70E60D6C}><C:\windows\system32\ProcSvr01.dll>  []
    <{B836BC72-54DA-48DB-B1CD-041BE4B67A61}><C:\windows\system32\wbipagmrw.dll>  [Microsoft Corporation]
    <{17124B04-2AAB-4207-BFE6-C77D2687BBBF}><C:\windows\system32\gmtantyejp.dll>  [Microsoft Corporation]
    <{68E1C213-98FE-42C6-82A8-584AD1215F3B}><C:\windows\system32\ouygqvbgmrwci.dll>  [Microsoft Corporation]
=====

Graybird

Starting the file scan:

Begin scan in 'E:\机器狗explorer.rar'
E:\机器狗explorer.rar
  [0] Archive type: RAR
  --> explorer.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [WARNING]   The file was ignored!

gogo8989

FS报

发现1个恶意软件
Trojan-Downloader.Win32.Agent.blm (病毒)

sam.to

Kaspersky Internet Security 7.0

The requested URL http://bbs.kafan.cn/attachment.php?aid=165862 is infected with Trojan-Downloader.Win32.Agent.blm virus

傻猪猪米走鸡

F:\virus\机器狗explorer.rar » RAR » explorer.exe - Win32/TrojanDownloader.Agent.BLM trojan

gho

C:\Documents and Settings\gho\桌面\explorer.exe        Generic Downloader.ab (Trojan)

gho

deleted: Trojan program Trojan-Downloader.Win32.Agent.blm        File: I:\hanxiaojun\&raquo;ú&AElig;÷&sup1;·explorer.rar/explorer.exe

jianjianliu1983

连诺顿都报了 哈哈～～～～～～～～～～

scottxzt

木马名称:Trojan-Downloader.Win32.EDog.b

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\EXPLORER.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

微点卫士

毒霸