X2

电影结束了

对象: sichost.exe
路径: C:\Documents and Settings\wangcheng\桌面
Status: 已发现病毒
病毒: Trojan.Generic.278374 (BD 引擎)
对象: ssdtti.sys
路径: C:\Documents and Settings\wangcheng\桌面
Status: 已发现病毒
病毒: Rootkit.Agent.XN (BD 引擎)

IllusionWing

all kill

Nerazzurri

2008-7-11        17:11:22        1215767482        Nerazzurri        1516        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\Nerazzurri\桌面\2.zip\sichost.exe" file.  
2008-7-11        17:11:25        1215767485        Nerazzurri        1516        Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\Documents and Settings\Nerazzurri\桌面\2.zip\ssdtti.sys" file.

Nerazzurri

Begin scan in 'C:\Documents and Settings\Nerazzurri\桌面\2.zip'
C:\Documents and Settings\Nerazzurri\桌面\2.zip
  [0] Archive type: ZIP
    --> sichost.exe
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aadi.2
        --> Object
            [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.XN.25
  --> ssdtti.sys
      [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.XN.25
      [NOTE]      The file was deleted!

ssy275

2

Palkia

病毒        2008-07-11  17:28:44        C:\Documents and Settings\Administrator\桌面\2.zip\sichost.exe        Win32.Troj.Agent.ks.348160        清除成功

wangjay1980

运行就露馅

1990-7-11 JAY19:24:26 Microsoft  Process exit C:\Documents and Settings\Owner\桌面\sichost.exe
1990-7-11 JAY19:24:25 Microsoft Completed: Suspicious driver installation  C:\DOCUMENTS AND SETTINGS\OWNER\桌面\SICHOST.EXE
1990-7-11 JAY19:24:25 Microsoft Detected: Suspicious driver installation  C:\DOCUMENTS AND SETTINGS\OWNER\桌面\SICHOST.EXE
1990-7-11 JAY19:23:59 Microsoft Detected: Suspicious driver installation  C:\DOCUMENTS AND SETTINGS\OWNER\桌面\SICHOST.EXE
1990-7-11 JAY19:23:58 Microsoft  Create C:\WINDOWS\system32\ssdtti.sys
1990-7-11 JAY19:23:58 Microsoft : KLSystemData/FD-C/ Create C:\WINDOWS\system32\ssdtti.sys
1990-7-11 JAY19:23:58 Microsoft : KLSystemData/KLSystemFiles/Drivers Create C:\WINDOWS\system32\ssdtti.sys
1990-7-11 JAY19:23:58 Microsoft  Create C:\WINDOWS\system32\Nessery.sys
1990-7-11 JAY19:23:58 Microsoft : KLSystemData/FD-C/ Create C:\WINDOWS\system32\Nessery.sys
1990-7-11 JAY19:23:58 Microsoft : KLSystemData/KLSystemFiles/Drivers Create C:\WINDOWS\system32\Nessery.sys
1990-7-11 JAY19:23:58 Microsoft  Create C:\WINDOWS\system32\discard.ini
1990-7-11 JAY19:23:58 Microsoft : KLSystemData/FD-C/ Create C:\WINDOWS\system32\discard.ini
1990-7-11 JAY19:23:58 Microsoft Denied: KLSystemData/KLStartupRegKeys/Winlogon_Shell Modification hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
1990-7-11 JAY19:23:58 Microsoft Denied: KLSystemData/KLStartupRegKeys/Command_Processor_AutoRun Modification hklm\SOFTWARE\Microsoft\Command Processor
1990-7-11 JAY19:23:56 Microsoft  Create C:\WINDOWS\system32\sovlost.exe
1990-7-11 JAY19:23:56 Microsoft : KLSystemData/FD-C/ Create C:\WINDOWS\system32\sovlost.exe
1990-7-11 JAY19:23:56 Microsoft : KLSystemData/KLSystemFiles/SystemExe Create C:\WINDOWS\system32\sovlost.exe
2008-7-11 JAY19:23:41 Microsoft  Process start C:\Documents and Settings\Owner\桌面\sichost.exe
2008-7-11 JAY19:23:41 Microsoft  Placed in group Low Restricted
2008-7-11 JAY19:23:37 WinRAR.exe  Create C:\Documents and Settings\Owner\桌面\sichost.exe