系统时间被更改！但使用卡巴瑞星等软件扫不到任何病毒

sam.to

[object]http://www.yahovip.cn/4561.swf
                        [object]http://www.yahovip.cn/4562.swf

to kl,antivir

[ 本帖最后由 kato9096 于 2008-6-2 00:36 编辑 ]

sam.to

http://www.threatexpert.com/repo ... ec8c90446a39d870e4a
沒有提到更改系统时间??

您查询的IP:222.215.230.144

    * 本站主数据：四川省眉山市 电信
    * 查询结果2：四川省眉山市 电信
    * 查询结果3：四川省眉山市 电信

尽在不言中

左手

2008-06-02 18:57:00    修改文件      操作:阻止
进程路径:C:\Program Files\Tencent\TT\bin\TTraveler.exe
文件路径:D:\Personal\Temporary Internet Files\Content.IE5\O1U3S5U3\cm[4].htm
触发规则:所有程序规则->需要保护的文件->*.htm


2008-06-02 18:57:56    修改系统时间      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\ok.exe

触发规则:所有程序规则->*


2008-06-02 18:57:57    创建注册表值      操作:阻止
进程路径:C:\WINNT\system32\services.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\00001af4000086c4
注册表名称:[Key]
触发规则:所有程序规则->服务_普通模式->HKEY_LOCAL_MACHINE\SYSTEM\*controlset*\Services\*


2008-06-02 18:58:00    删除文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\ok.exe
文件路径:C:\00001af4000086c4.dat
触发规则:所有程序规则->需要保护的文件->C:\*.*


2008-06-02 18:58:01    修改其它进程内存      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\ok.exe
目标进程:C:\Program Files\Internet Explorer\iexplore.exe
触发规则:所有程序规则->*


2008-06-02 18:58:01    修改其它进程内存      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\ok.exe
目标进程:C:\Program Files\Internet Explorer\iexplore.exe
触发规则:所有程序规则->*


2008-06-02 18:58:01    运行应用程序      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\ok.exe
文件路径:C:\WINNT\system32\cmd.exe
命令行:/c delme.bat
触发规则:所有程序规则->禁止执行的系统程序->*\cmd.exe

sam.to

原帖由 kato9096 于 2008-6-2 00:34 发表
[object]http://www.yahovip.cn/4561.swf
                        [object]http://www.yahovip.cn/4562.swf

to kl,antivir

Hello,

4561.swf - Trojan-Downloader.SWF.Small.bc,
4562.swf - Trojan-Downloader.SWF.Small.bd

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Krylov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

sam.to

The file '4561.swf' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.SWF.Small.BC. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.04.122.
Filename         Result
4562.swf          MALWARE

The file '4562.swf' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.SWF.Small.BD. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.04.122.

紅傘和卡巴报的名都是一样

BING126

McAfee  MISS