疑似机器狗穿了sd

显示全部楼层 · 发表于 2008-3-14 00:28:37

唉，楼主用的什么杀软啊，为什么不用红伞呢。

显示全部楼层 · 发表于 2008-3-14 00:50:50

应该是一个变种

显示全部楼层 · 发表于 2008-3-14 02:17:55

穿不了Sandboxie

显示全部楼层 · 发表于 2008-3-14 10:31:21

Scanning Report
14 March 2008 10:31:13 - 10:31:14
Computer name: PUMA-PC
Scanning type: Scan target
Target: C:\Users\Administrator\Desktop\dog.rar

--------------------------------------------------------------------------------

Result: 2 malware found
Trojan-PSW.Win32.OnLineGames.sea (virus)
C:\Users\Administrator\Desktop\dog.rar\dog\AtiSrv.exe
Trojan-Downloader.Win32.Delf.epw (virus)
C:\Users\Administrator\Desktop\dog.rar\dog\usbhcid.sys

--------------------------------------------------------------------------------

Statistics
Scanned:
Files: 3
Not scanned: 0
Result:
Viruses: 2
Spyware: 0
Suspicious items: 0
Riskware: 0
Actions:
Disinfected: 0
Renamed: 0
Deleted: 0
Quarantined: 0
Failed: 0
Boot Sectors:
Scanned: 0
Infected: 0
Suspicious items: 0
Disinfected: 0

--------------------------------------------------------------------------------

Options
Definitions version:
Viruses: 2008-03-13_09
Spyware: 2008-03-13_09
Scanning Engines:
F-Secure AVP: 7.00.171, 2008-03-13
F-Secure Libra: 2.04.01, 2008-03-12
F-Secure Orion: 1.02.38, 2008-03-13
F-Secure Draco: 1.00.35, 2008-02-13
Scanning options:
Scan all files
Scan inside archives
Actions:
Viruses: Quarantine and delete
Spyware: Quarantine and delete

显示全部楼层 · 发表于 2008-3-14 17:17:22

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.DL.Win32.Mnless.zan
病毒： Trojan.DL.Win32.Direct.me

用户来源：互联网

软件版本：20.35.40

显示全部楼层 · 发表于 2008-3-21 01:18:03

其实你们捕捉到的都是机器狗下载的东西,根本没捕捉到真正的机器狗.

显示全部楼层 · 发表于 2008-3-21 07:47:46

咖啡 8.5

2008-3-21 7:47:06 未采取操作 a C:\Documents and Settings\a\桌面\dog.rar\ATISRV.EXE PWS-Mmorpg.gen(特洛伊)
2008-3-21 7:47:08 未采取操作 a C:\Documents and Settings\a\桌面\dog.rar\USBHCID.SYS Downloader.gen.a(特洛伊)

显示全部楼层 · 发表于 2008-3-21 13:00:44

惯用伎俩

显示全部楼层 · 发表于 2008-3-21 22:33:36

我试过不是，

2008-03-21 22:19:23 运行应用程序    操作:允许(自动创建规则)
进程路径:C:\Documents and Settings\Administrator\桌面\dog\dog\AtiSrv.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\启动\AtiSrv.exe

2008-03-21 22:19:25 创建文件    操作:允许(自动创建规则)
进程路径:C:\Documents and Settings\All Users\「开始」菜单\程序\启动\AtiSrv.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\usbcams3.sys

2008-03-21 22:19:27 创建注册表值    操作:允许(自动创建规则)
进程路径:C:\WINDOWS\system32\services.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Sc Manager
注册表名称:[Key]

2008-03-21 22:19:29 安装服务或者驱动    操作:允许(自动创建规则)
进程路径:C:\WINDOWS\system32\services.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\usbcams3.sys

2008-03-21 22:19:30 创建注册表值    操作:允许(自动创建规则)
进程路径:C:\WINDOWS\system32\services.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Sc Manager
注册表名称:ImagePath

2008-03-21 22:19:33 加载驱动程序    操作:允许(自动创建规则)
进程路径:C:\WINDOWS\system32\services.exe
驱动路径:C:\Documents and Settings\Administrator\Local Settings\Temp\usbcams3.sys

2008-03-21 22:19:34 删除文件    操作:允许(自动创建规则)
进程路径:C:\Documents and Settings\All Users\「开始」菜单\程序\启动\AtiSrv.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\usbcams3.sys

2008-03-21 22:19:36 创建注册表值    操作:允许(自动创建规则)
进程路径:C:\Documents and Settings\All Users\「开始」菜单\程序\启动\AtiSrv.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com
注册表名称:[Key]

2008-03-21 22:19:38 创建注册表值    操作:允许(自动创建规则)
进程路径:C:\Documents and Settings\All Users\「开始」菜单\程序\启动\AtiSrv.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com
注册表名称:Debugger

以下一直创建注册表，一直不停止，看来不想活了。

显示全部楼层 · 发表于 2008-3-21 23:26:42

"23:25"       "文件监控"       "文件"       "TROJ_KEYLOGGE.AP"       "dog\AtiSrv.exe (C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JNBL1313\dog[1].rar)"       "隔离成功"       ""
"23:25"       "文件监控"       "文件"       "TROJ_DELF.HQS"       "dog\usbhcid.sys (C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JNBL1313\dog[1].rar)"       "隔离成功"       ""
"23:25"       "文件监控"       "文件"       "---"       "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JNBL1313\dog[1].rar (C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JNBL1313\dog[1].rar)"       "隔离未完成，单击威胁名称，以确定应该如何手动处理此安全威胁"       ""
"23:25"       "文件监控"       "文件"       "TROJ_KEYLOGGE.AP"       "dog\AtiSrv.exe (C:\Documents and Settings\Administrator\桌面\dog.rar)"       "隔离成功"       ""
"23:25"       "文件监控"       "文件"       "TROJ_DELF.HQS"       "dog\usbhcid.sys (C:\Documents and Settings\Administrator\桌面\dog.rar)"       "隔离成功"       ""
"23:25"       "文件监控"       "文件"       "---"       "C:\Documents and Settings\Administrator\桌面\dog.rar (C:\Documents and Settings\Administrator\桌面\dog.rar)"       "隔离成功"       ""

[其他相关] 疑似机器狗穿了sd

回复 15楼 1x2l 的帖子