zlob

显示全部楼层 · 发表于 2008-7-23 15:12:14

Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL: http://bbs.kafan.cn/attachment.p ... d6&t=1216797124
Information: Is the TR/Clicker.Agent.ABW.1 Trojan

Generated by AntiVir WebGuard 8.0.15.0, AVE 8.1.1.11, VDF 7.0.5.155

显示全部楼层 · 发表于 2008-7-23 15:16:16

irus detected: Trj/Multidropper.RBD Antivirus protection 2008-7-23 3:15:19 PM Deleted Path: http://bbs.kafan.cn/attachment.p ... d7&t=1216797278[attachment.php]

显示全部楼层 · 发表于 2008-7-23 15:17:35

显示全部楼层 · 发表于 2008-7-23 15:23:05

红伞KILL

显示全部楼层 · 发表于 2008-7-23 15:53:18

金山 0

显示全部楼层 · 发表于 2008-7-23 15:56:55

费尔动态防御拦截

显示全部楼层 · 发表于 2008-7-23 16:13:57

2008-7-22 23:06:50 c:\documents and settings\administrator\桌面\setup_axplugin.exe 创建文件 C:\Sandbox\Administrator\DefaultBox\drive\C\WINDOWS\sysawpbkvnq.exe 允许
2008-7-22 23:06:51 c:\documents and settings\administrator\桌面\setup_axplugin.exe 写文件 C:\Sandbox\Administrator\DefaultBox\drive\C\WINDOWS\sysawpbkvnq.exe 允许
2008-7-22 23:06:54 c:\documents and settings\administrator\桌面\setup_axplugin.exe 创建新进程 c:\sandbox\administrator\defaultbox\drive\c\windows\sysawpbkvnq.exe 允许
2008-7-22 23:06:59 c:\documents and settings\administrator\桌面\setup_axplugin.exe 创建文件 C:\Sandbox\Administrator\DefaultBox\drive\C\WINDOWS\sysnxcphmgy.exe 允许
2008-7-22 23:07:05 c:\sandbox\administrator\defaultbox\drive\c\windows\sysawpbkvnq.exe 创建新进程 c:\windows\system32\cmd.exe 允许
2008-7-22 23:07:06 c:\documents and settings\administrator\桌面\setup_axplugin.exe 写文件 C:\Sandbox\Administrator\DefaultBox\drive\C\WINDOWS\sysnxcphmgy.exe 允许
2008-7-22 23:07:07 c:\windows\system32\cmd.exe 创建新进程 c:\windows\regedit.exe 允许
2008-7-22 23:07:10 c:\documents and settings\administrator\桌面\setup_axplugin.exe 向其他进程发生消息 c:\windows\system32\cmd.exe 允许
2008-7-22 23:07:10 c:\windows\system32\cmd.exe 创建新进程 c:\windows\system32\reg.exe 允许
2008-7-22 23:07:11 c:\documents and settings\administrator\桌面\setup_axplugin.exe 创建新进程 c:\sandbox\administrator\defaultbox\drive\c\windows\sysnxcphmgy.exe 允许
2008-7-22 23:07:12 c:\documents and settings\administrator\桌面\setup_axplugin.exe 创建文件 C:\Sandbox\Administrator\DefaultBox\drive\C\WINDOWS\syspyukrazv.exe 允许
2008-7-22 23:07:13 c:\documents and settings\administrator\桌面\setup_axplugin.exe 写文件 C:\Sandbox\Administrator\DefaultBox\drive\C\WINDOWS\syspyukrazv.exe 允许
2008-7-22 23:07:14 c:\sandbox\administrator\defaultbox\drive\c\windows\sysnxcphmgy.exe 创建新进程 c:\windows\system32\cmd.exe 允许
2008-7-22 23:07:14 c:\documents and settings\administrator\桌面\setup_axplugin.exe 创建新进程 c:\sandbox\administrator\defaultbox\drive\c\windows\syspyukrazv.exe 允许
2008-7-22 23:07:15 c:\documents and settings\administrator\桌面\setup_axplugin.exe 创建文件 C:\Sandbox\Administrator\DefaultBox\drive\C\WINDOWS\sysqkmwfedz.exe 允许
2008-7-22 23:07:16 c:\documents and settings\administrator\桌面\setup_axplugin.exe 写文件 C:\Sandbox\Administrator\DefaultBox\drive\C\WINDOWS\sysqkmwfedz.exe 允许
2008-7-22 23:07:18 c:\windows\system32\cmd.exe 创建新进程 c:\windows\regedit.exe 允许
2008-7-22 23:07:18 c:\sandbox\administrator\defaultbox\drive\c\windows\syspyukrazv.exe 创建新进程 c:\windows\system32\cmd.exe 允许
2008-7-22 23:07:20 c:\documents and settings\administrator\桌面\setup_axplugin.exe 向其他进程发生消息 c:\windows\system32\cmd.exe 允许
2008-7-22 23:07:22 c:\windows\system32\cmd.exe 创建新进程 c:\windows\system32\reg.exe 拒绝
2008-7-22 23:07:24 c:\windows\system32\cmd.exe 创建新进程 c:\windows\regedit.exe 允许
2008-7-22 23:07:27 c:\documents and settings\administrator\桌面\setup_axplugin.exe 创建新进程 c:\sandbox\administrator\defaultbox\drive\c\windows\sysqkmwfedz.exe 拒绝
2008-7-22 23:07:30 c:\windows\system32\cmd.exe 创建新进程 c:\windows\system32\reg.exe 拒绝

来来去去都是那几个动作

显示全部楼层 · 发表于 2008-7-23 20:33:41

McAfee miss

显示全部楼层 · 发表于 2008-7-23 20:38:40

Win32:Trojan-gen {Other}

[病毒样本] zlob

本帖子中包含更多资源

本帖子中包含更多资源