刚从U盘中分离出来的木马

wsdsxx

微点报的,根据风云所给的行为判断,差不多是木马
007-12-15 21:15:22  发现：新建文件!
文件：C:\WINDOWS\system32\7[1].exe
进程：G:\7[1].exe   询问放行
2007-12-15 21:15:28  发现：新建文件!
文件：C:\autorun.inf
进程：G:\7[1].exe   拦截
2007-12-15 21:15:32  发现：新建文件!
文件：D:\autorun.inf  询问放行

[ 本帖最后由 wsdsxx 于 2007-12-15 22:10 编辑 ]

Graybird

Starting the file scan:

Begin scan in 'E:\Virus\7[1].rar'
E:\Virus\7[1].rar
  [0] Archive type: RAR
  --> 7[1].EXE
      [DETECTION] Contains detection pattern of the SPR/Tool.HideProc.C.2 program
      [WARNING]   The file was ignored!

moonsilver

程序:
C:\DOCUMENTS AND SETTINGS\MOONSILVER\桌面\7[1].EXE
并生成以下文件:
1) C:\WINDOWS\SYSTEM32\7[1].EXE
2) C:\7[1].EXE
3) D:\7[1].EXE
4) C:\AUTORUN.INF
5) C:\7[1].EXE

是否删除木马程序及其衍生物?


mp

moonsilver

木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\MOONSILVER\桌面\7[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

欠妳緈諨

sweeb

老毒了，报的不少

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 1081
Paranoia Database - 50159
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\7[1].EXE

C:\Documents and Settings\Uhthn\Desktop\7[1].EXE - Suspected MaliciousScope:GENERIC.MALWARE.8

1 Files scanned
0 Infected files found
1 Suspected files found
0 Files disinfected
0 Files deleted

dericyeoh

已删除: 病毒 Virus.Win32.AutoRun.ain        文件: C:\Users\Deric Yeoh\Desktop\7[1].rar/7[1].EXE//ASPack

傻猪猪米走鸡

ena miss

scottxzt

2007-12-16 10:39:34,Trojan.DiskAutorun.dt.dhvm,木马,C:\Documents and Settings\dell\桌面\7[1].rar>>7[1].EXE,Manual scan