修改一段代码过卡巴斯基扫描

zszzd

程序:
C:\DOCUMENTS AND SETTINGS\LL\LOCAL SETTINGS\TEMP\RAR$EX00.843\2.EXE
是否删除木马程序及其衍生物?

lhc-yuan

红伞，报！！！

电影结束了

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File MD5
1	%Temp%\tmp1.tmp	29,696 bytes	0x801FAC32E87C360DD816E155AAC9CAE0

• Note:
  • %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

• There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	37,376 bytes

• There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
svchost.exe	%System%\svchost.exe	24,576 bytes

• Notes:
  • %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Other details

• The following Internet Connection was established:

Server Name	Server Port	Connect as User	Connection Password
216.255.186.237	80	(null)	(null)

电影结束了

zwl2828

所请求的目标已被感染了下列病毒: Backdoor.Win32.Small.dzm