感染EXE的磁碟机 = = 又素Lucky star

spiha

2008-06-09 11:39:13        文件保护(删除文件)     操作:阻止
进程路径:C:\WINDOWS\vmmreg32.exe
文件路径:C:\Program Files\Internet Explorer\Connection Wizard\isignup.exe
2008-06-09 11:39:12        文件保护(修改文件)     操作:阻止
进程路径:C:\WINDOWS\vmmreg32.exe
文件路径:C:\Program Files\Internet Explorer\Connection Wizard\isignup.exe
2008-06-09 11:39:10        文件保护(删除文件)     操作:阻止
进程路径:C:\WINDOWS\vmmreg32.exe
文件路径:C:\Program Files\Internet Explorer\Connection Wizard\inetwiz.exe
2008-06-09 11:39:08        文件保护(修改文件)     操作:阻止
进程路径:C:\WINDOWS\vmmreg32.exe
文件路径:C:\Program Files\Internet Explorer\Connection Wizard\inetwiz.exe
2008-06-09 11:39:07        文件保护(删除文件)     操作:阻止
进程路径:C:\WINDOWS\vmmreg32.exe
文件路径:C:\Program Files\Internet Explorer\Connection Wizard\icwtutor.exe
2008-06-09 11:39:05        文件保护(修改文件)     操作:阻止
进程路径:C:\WINDOWS\vmmreg32.exe
文件路径:C:\Program Files\Internet Explorer\Connection Wizard\icwtutor.exe
2008-06-09 11:39:03        文件保护(删除文件)     操作:阻止
进程路径:C:\WINDOWS\vmmreg32.exe
文件路径:C:\Program Files\Internet Explorer\Connection Wizard\icwrmind.exe
2008-06-09 11:39:01        文件保护(修改文件)     操作:阻止
进程路径:C:\WINDOWS\vmmreg32.exe
文件路径:C:\Program Files\Internet Explorer\Connection Wizard\icwrmind.exe
2008-06-09 11:39:00        文件保护(修改文件)     操作:阻止
进程路径:C:\WINDOWS\vmmreg32.exe
文件路径:C:\Program Files\Internet Explorer\Connection Wizard\icwconn2.exe
2008-06-09 11:38:58        文件保护(删除文件)     操作:阻止
进程路径:C:\WINDOWS\vmmreg32.exe
文件路径:C:\Program Files\Internet Explorer\Connection Wizard\icwconn2.exe
2008-06-09 11:38:57        文件保护(修改文件)     操作:阻止
进程路径:C:\WINDOWS\vmmreg32.exe
文件路径:C:\Program Files\Internet Explorer\Connection Wizard\icwconn2.exe
2008-06-09 11:38:57        文件保护(修改文件)     操作:阻止
进程路径:C:\WINDOWS\vmmreg32.exe
文件路径:C:\Program Files\Internet Explorer\Connection Wizard\icwconn2.exe
2008-06-09 11:38:56        文件保护(修改文件)     操作:阻止
进程路径:C:\WINDOWS\vmmreg32.exe
文件路径:C:\Program Files\Internet Explorer\Connection Wizard\icwconn2.exe

－ － 这个不是磁碟机吧。。
还有3.41不可能拦不住

知道 放过这个以后他不是感染文件么~
3.41都不报警

挪威的冬天

金山毒霸 0

Nblock

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\AVP.EXE
木马程序生成以下文件:
1) C:\WINDOWS\VMMREG32.EXE
是否删除木马程序及其衍生物?

woai_jolin

Dear Customer,

Thank you for contacting us regarding your inquiry.  We have created a FortiCare ticket for this inquiry.  The analyst is now processing the ticket and will reply to you shortly.


Regards,
AV Lab Analyst

To submit a suspicious file to FortiGuard Team:
http://www.fortiguardcenter.com/virus_scanner.html

To contact our technical support:
North American Technical Support
Phone: +1-866-648-4638

Europe, Middle East and Africa Technical Support
Contact your Fortinet Partner for live support

South East Asia countries with valid phone support contracts
Phone: 60-3-2711-7391

China, Japan, Korea, and other Asian countries
Contact your Fortinet Partner for live support
--80057DFE4073B94FFE42C96940C6781D468875315--

sbbdms

Kaspersky miss
TO KL

过不了小A的拦截器，现在觉的最直的信赖的还是小A。

鱼怪

卡巴和红伞都过了，伤心啊。这回中招了，强！
有些正常图标开始变成小女孩的头像，看看接下来该如何杀。

zenwalk

Filename Result
avp.exe  MALWARE

The file 'avp.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/VB.dek. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

scottxzt

这个和前一个动做有些不同,动作比较直接,还是三步.进程自行退出.