nod32挂掉

solcroft

.

wangjay1980

流氓包？

solcroft

似乎是
试图安装BHO

醉一生爱妍

2007-01-18 14:16:58    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\install_cb.exe
文件路径:C:\WINDOWS\System32\CMD.EXE
命令行:/Q /C "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ac8zt2\install.bat"
触发规则:所有程序规则->系统程式_黑名单->*\cmd.exe

2007-01-18 14:17:00    运行应用程序      操作:允许(自动创建规则)
进程路径:C:\WINDOWS\System32\CMD.EXE
文件路径:C:\WINDOWS\System32\regsvr32.exe
命令行:    /s       C:\WINDOWS\dopfwrlmgf.dll

2007-01-18 14:17:07    运行应用程序      操作:允许
进程路径:C:\WINDOWS\System32\CMD.EXE
文件路径:C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temp\ac8zt2\eqlk.exe
命令行:  C:\WINDOWS\bxsnvqt.dll       bxsnvqt
触发规则:所有程序规则->*

2007-01-18 14:17:10    运行应用程序      操作:允许
进程路径:C:\WINDOWS\System32\CMD.EXE
文件路径:C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temp\ac8zt2\eqlk.exe
命令行: C:\WINDOWS\aslpmqk.dll       aslpmqk
触发规则:所有程序规则->*

2007-01-18 14:17:14    运行应用程序      操作:允许
进程路径:C:\WINDOWS\System32\CMD.EXE
文件路径:C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temp\ac8zt2\fknxwqf.exe
命令行:     reg
触发规则:所有程序规则->*

2007-01-18 14:17:16    运行应用程序      操作:允许
进程路径:C:\WINDOWS\System32\CMD.EXE
文件路径:C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temp\ac8zt2\eqlk.exe
命令行:    reflk
触发规则:所有程序规则->*

2007-01-18 14:17:22    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\install_cb.exe
文件路径:C:\WINDOWS\System32\CMD.EXE
命令行:/Q  /C "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nscB1.tmp.bat"
触发规则:所有程序规则->系统程式_黑名单->*\cmd.exe

2007-01-18 14:17:25    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\System32\CMD.EXE
文件路径:C:\Documents and Settings\Administrator\桌面\install_cb.exe
命令行:         
触发规则:所有程序规则->*

生成物，NOD无视

风野胤

流氓的话就不上报了
估计上报也是被无视

alskdjfhg

这么大的文件？

Graybird

Starting the file scan:

Begin scan in 'E:\Temp.rar'
E:\Temp.rar
  [0] Archive type: RAR
  --> nseAE.tmp
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Agent.PB
      [WARNING]   The file was ignored!
Begin scan in 'E:\WINDOWS.rar'
E:\WINDOWS.rar
  [0] Archive type: RAR
  --> aslpmqk.dll
      [DETECTION] Is the Trojan horse TR/Zlob.DCG
  --> bxsnvqt.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/Agent.PB
  --> dopfwrlmgf.dll
      [DETECTION] Is the Trojan horse TR/Zlob.DCH
      [WARNING]   The file was ignored!


End of the scan: 2008年1月18日  16:22
Used time: 00:18 min

The scan has been done completely.

      0 Scanning directories
      9 Files were scanned
      4 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      5 Files not concerned
      2 Archives were scanned
      2 Warnings
      0 Notes

The file 'nszAD.tmp' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

The file 'nscB1.tmp.bat' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

The file 'egodktf.dll' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Zlob.czk. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

The file 'fknxwqf.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Zlob.DCN. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

[ 本帖最后由 Graybird 于 2008-1-18 17:59 编辑 ]

liangxy

？？楼上的杀软是什么、。我看不出
ps：那我不是很危险？？

醉一生爱妍

原帖由 liangxy 于 2008-1-18 16:28 发表
？？楼上的杀软是什么、。我看不出
ps：那我不是很危险？？

人家那是大蜘蛛吧

Graybird

红伞~