update x1 autorun

显示全部楼层 · 发表于 2008-5-3 19:08:25

McAfee found nothing

显示全部楼层 · 发表于 2008-5-3 19:23:44

C:\Documents and Settings\***.18F12FE200FB45E\桌面\Anti-Virus lab\dd.rar > RAR > dd.exe - Win32/AutoRun.JO 蠕虫的变种

显示全部楼层 · 发表于 2008-5-3 20:34:27

0001032C 1315032C    0 [autorun]
00010337 13150337    0 shell\open=
0001034C 1315034C    0 shell\open\Command=MSDOS.PIF
0001036A 1315036A    0 shell\open\Default=1
00010380 13150380    0 shell\explore=
0001039E 1315039E    0 shell\explore\command=MSDOS.PIF

00013269 13153269    0 GetProcAddress
0001327A 1315327A    0 VirtualProtect
0001328B 1315328B    0 VirtualAlloc
0001329A 1315329A    0 VirtualFree
000132A8 131532A8    0 ExitProcess
000132B6 131532B6    0 GetKeyboardType
000132C8 131532C8    0 RegQueryValueExA
000132DB 131532DB    0 SysFreeString
000132EB 131532EB    0 TlsSetValue
000132F9 131532F9    0 RegSetValueExA
0001330A 1315330A    0 lstrcpyA
00013315 13153315    0 TranslateMessage
00013328 13153328    0 ShellExecuteA
00013338 13153338    0 PathFileExistsA

显示全部楼层 · 发表于 2008-5-3 20:44:34

ArcaVir miss

显示全部楼层 · 发表于 2008-5-3 20:45:32

[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\dd.rar->dd.exe

---------------------------------------------------------------------
Scan ended: 2008-5-3, 20:45:19
Duration: 0:00:03

Scan result:

Scanned files:    6
Infected objects:    1
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-5-3 20:55:42

McAfee New Malware.u

[病毒样本] update x1 autorun

F-Prot 6.0.9.0