字母发的样本里的发现

显示全部楼层 · 发表于 2008-8-11 13:16:15

00012180 00412F80    0 c:\Program Files\uusee\UUSeePlayer.exe
000121B0 00412FB0    0 SVCH0ST
000121C0 00412FC0    0 Software\Microsoft\Windows\CurrentVersion\Run
000121F8 00412FF8    0 http://38vp.cn/gov.txt
00012218 00413018    0 \gov.txt
0001222C 0041302C    0 \bb1.exe
00012240 00413040    0 \bb2.exe
00012254 00413054    0 \bb3.exe
00012268 00413068    0 \bb4.exe
0001227C 0041307C    0 \bb5.exe
00012290 00413090    0 \bb6.exe
000122A4 004130A4    0 \bb7.exe
000122B8 004130B8    0 \bb8.exe
000122CC 004130CC    0 \bb9.exe
000122E0 004130E0    0 \bb10.exe
00012504 00413304    0 _deleteme.bat
0001252C 0041332C    0 del "
00012548 00413348    0 if exist "
0001255C 0041335C    0 goto try
00012570 00413370    0 del %0
00012704 00413504    0 C:\Program Files\Funshion Online\Funshion\Uninstall.exe
0001273C 0041353C    0 C:\Zcom\uninst.exe
00012750 00413550    0 C:\Program Files\uusee\uninstuusee.exe
00012778 00413578    0 C:\Program Files\PPStream\uninst.exe

显示全部楼层 · 发表于 2008-8-11 15:09:15

费尔 Trojan.Cap88714.ecju

显示全部楼层 · 发表于 2008-8-11 17:02:04

The file 'C:\Users\Morgan\Desktop\s.exe'
contained a virus or unwanted program 'TR/Dldr.Delphi.Gen' [trojan]
Action(s) taken:
The file was deleted!

显示全部楼层 · 发表于 2008-8-11 19:53:09

金山 0

显示全部楼层 · 发表于 2008-8-11 20:26:01

我也是。

显示全部楼层 · 发表于 2008-8-11 20:37:13

一定不是毒

[病毒样本] 字母发的样本里的发现

回复 2楼 spicalhook 的帖子

本帖子中包含更多资源