新鲜的盗号木马一只~

qq890

卡巴斯基报了Trojan-PSW.Win32.OnLineGames.mlk virus

29159011

已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.mlk        URL: http://bbs.kafan.cn/attachment.p ... xe//UPack//PE_Patch

zwl2828

C:\Users\Wesley\Downloads\k11989010379.rar » RAR » k11989010379.exe - a variant of Win32/PSW.OnLineGames.NFL trojan

yangpizhi

-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.4.2
Virus signature file from: 2007-12-29, 1:27

Scan name: [Custom Scan]
Path to scan: C:\Documents and Settings\Administrator\桌面\k11989010379.rar

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2007-12-29, 18:41:39
---------------------------------------------------------------------

[Found security risk]         <W32/Injector.A.gen!Eldorado (not disinfectable, generic)>        C:\Documents and Settings\Administrator\桌面\k11989010379.rar->k11989010379.exe
[Contains infected objects]        C:\Documents and Settings\Administrator\桌面\k11989010379.rar
[Quarantined]        C:\Documents and Settings\Administrator\桌面\k11989010379.rar->k11989010379.exe

---------------------------------------------------------------------
Scan ended:        2007-12-29, 18:41:41
Duration:        0:00:01

Scan result:

Scanned files:                 1
Infected objects:         1
Disinfected objects:         0
Quarantined files:         1
---------------------------------------------------------------------

a256886572008

2007-12-29 18:47:53    執行應用程序      操作:允許
程序路徑:C:\WINDOWS\explorer.exe
檔案路徑:D:\k11989010379.exe
觸發規則:所有程序規則->系統程式_黑名單->?:\*


2007-12-29 18:47:57    建立檔案      操作:允許
程序路徑:D:\k11989010379.exe
檔案路徑:C:\WINDOWS\upxdnd.exe
觸發規則:所有程序規則->全域設定_可執行檔案1_普通模式->*.exe


2007-12-29 18:47:59    建立登錄檔值      操作:封鎖
程序路徑:D:\k11989010379.exe
登錄檔路徑:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
登錄檔名稱:upxdnd
登錄檔數值:C:\WINDOWS\upxdnd.exe
觸發規則:所有程序規則->自動執行_普通模式->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*


2007-12-29 18:48:01    建立檔案      操作:允許
程序路徑:D:\k11989010379.exe
檔案路徑:C:\WINDOWS\system32\upxdnd.dll
觸發規則:所有程序規則->全域設定_可執行檔案1_普通模式->*.dll

2007-12-29 18:48:05    修改其它程序記憶體      操作:允許
程序路徑:D:\k11989010379.exe
目標程序:C:\WINDOWS\explorer.exe
觸發規則:所有程序規則->系統程式_白名單->%windir%\explorer.exe


2007-12-29 18:48:06    建立遠端執行緒      操作:允許
程序路徑:D:\k11989010379.exe
目標程序:C:\WINDOWS\explorer.exe
觸發規則:所有程序規則->系統程式_白名單->%windir%\explorer.exe


2007-12-29 18:48:09    安裝整體掛鉤      操作:封鎖
程序路徑:C:\WINDOWS\explorer.exe
檔案路徑:C:\WINDOWS\system32\upxdnd.dll
觸發規則:所有程序規則->*


2007-12-29 18:48:10    刪除檔案      操作:允許
程序路徑:C:\WINDOWS\explorer.exe
檔案路徑:D:\k11989010379.exe
觸發規則:所有程序規則->全域設定_可執行檔案1_普通模式->*.exe

qigang

Rising20.24.52未杀！

bytin

nod32 v2.7


C:\Documents and Settings\use1\桌面\新建文件夹\k11989010379.rar >>RAR >>k11989010379.exe - Win32/PSW.OnLineGames.NFL 木马的变种

95518

费尔报w32.viking.k

95518

驱逐舰没有反应
郁闷啊

葬禮

C:\Documents and Settings\Saber\Desktop\k11989010379.rar=]k11989010379.exe DeepScan:Generic.PWS.Games.1.A12092B0 Delete Failed (file was in an archive)