1

tonger2003

jimmyleo

fast 這個好像更新得很輕快么～　呵呵

a750828

McAfee BackDoor-DKA

Graybird

Starting the file scan:

Begin scan in 'E:\Virus\fast.rar'
E:\Virus\fast.rar
  [0] Archive type: RAR
  --> fast.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was deleted!

jimmyleo

NSPM　北斗七星

Love=卡巴+费尔

费尔

458506

发现病毒: Win32.Worm.Winko.I

下载网页内容时, 发现病毒.

地址: bbs.kafan.cn

欠妳緈諨

jimmyleo

D:\Download\Scan\fast.exe - Signature 'Trojan-PWS.Win32.Agent.BU' found

        1 File scanned
          (0 Archives with 0 files)
        1 Signature found
        0 Suspect code-parts found
        Used time: 0:00.000

tonger2003

2005-12-19 22:24:37        C:\Documents and Settings\Administrator\桌面\fast\fast.exe        进程尝试注册它的副本为自动运行启动对象. 这种行为是木马的典型行为.
2005-12-19 22:24:37        C:\Documents and Settings\Administrator\桌面\fast\fast.exe        试图终止进程
2005-12-19 22:24:57        C:\Documents and Settings\Administrator\桌面\fast\fast.exe        试图终止进程: 成功
2005-12-19 22:25:03        \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\3B413121\ImagePath        回滚
2005-12-19 22:25:03        C:\WINDOWS\SYSTEM32\35C29035.EXE        回滚
2005-12-19 22:25:03        \REGISTRY\USER\S-1-5-21-1547161642-261903793-839522115-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0c055dc4-bd0a-11db-a623-806d6172696f}\BaseClass        回滚
2005-12-19 22:25:03        \REGISTRY\USER\S-1-5-21-1547161642-261903793-839522115-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0c055dc5-bd0a-11db-a623-806d6172696f}\BaseClass        回滚
2005-12-19 22:25:03        \REGISTRY\USER\S-1-5-21-1547161642-261903793-839522115-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c2b7800c-12ae-11dc-818e-00e04c39f322}\BaseClass        回滚
2005-12-19 22:25:03        \REGISTRY\USER\S-1-5-21-1547161642-261903793-839522115-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0c055dc7-bd0a-11db-a623-806d6172696f}\BaseClass        回滚
2005-12-19 22:25:03        \REGISTRY\USER\S-1-5-21-1547161642-261903793-839522115-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0c055dc6-bd0a-11db-a623-806d6172696f}\BaseClass        回滚
2005-12-19 22:24:37        C:\Documents and Settings\Administrator\桌面\fast\fast.exe        回滚已完成