今次flashget被感染的木马

mofunzone

90%几率不是误报，不等卡巴的回复了，怎么这么慢？
8个小时了。。

ranguangning

antivir kill

红心王子

virus.rar           149.31/149.31KB     100.00%    在线扫描      它是一个“木马”    2008-5-21 15:14:05   2008-5-21 15:14:33

电影结束了

估计过TF...
把它上报了....

第一个

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File MD5
1	%Temp%\svc.exe	90,112 bytes	0xA6B7556393238AA1E7BCF81CE255AFD5
2	[file and pathname of the sample #1]	167,936 bytes	0x5F3BECB924349DC64864B2D992F30A13

• Note:
  • %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

• There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	167,936 bytes

第二个

• The following files were created in the system:

#	Filename(s)	File Size	File MD5
1	%System%\dmserveresl.dll	23,552 bytes	0x1639D9964C9E1B2ECCA95C8217D3E70D
2	%System%\dmsvct.dll	61,952 bytes	0xA89F7A6A0A662F0B71BFB1C39290D08D
3	%System%\mssockkj.dll	20,480 bytes	0x577C74473FE3672047F73225E98F0301

• Note:
  • %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	98,304 bytes

http://www.threatexpert.com/report.aspx?md5=5f3becb924349dc64864b2d992f30a13
http://www.threatexpert.com/report.aspx?md5=a6b7556393238aa1e7bcf81ce255afd5

[ 本帖最后由 电影结束了 于 2008-5-21 15:22 编辑 ]

无尽藏海

[扫描路径] E:\VIRUS\virus21.rar
>E:\VIRUS\virus21.rar\svc.exe - 确定
>>E:\VIRUS\virus21.rar\tmp.exe 可能已被感染了 ：  MULDROP.Trojan
E:\VIRUS\virus21.rar - 发现压缩文件中有被感染的对象

HC303

微点没有反应。

gaojun7206

virus.rar
    [0] Archive type: RAR
    --> svc.exe
        [DETECTION] Is the Trojan horse TR/Hijacker.Gen
    --> tmp.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [WARNING]   The file was ignored!

virus.rar\tmp.exe 可能已被感染了 ：  MULDROP.Trojan

挪威的冬天

金山毒霸 0

scottxzt

Begin scan in 'C:\Documents and Settings\Administrator\桌面\virus.rar'
C:\Documents and Settings\Administrator\桌面\virus.rar
  [0] Archive type: RAR
  --> svc.exe
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
  --> tmp.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was successfully wiped!
      [NOTE]      The file was deleted!

tracydk

启发全杀了