mm.exe(第28次更新)已开新帖

显示全部楼层 · 发表于 2008-9-10 15:23:28

第7次更新

显示全部楼层 · 发表于 2008-9-10 16:03:43

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0907-1712\9.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0907-1712\MM.EXE
是可疑程序!
试图修改系统时间!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0908-2042\MM.EXE
是可疑程序!
试图修改系统时间!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0908-2047\1.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0908-2047\3.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\~50.TMP
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0910-0046\1.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\ATMLIBL.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0910-1522\1.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\ATMLICL.DLL
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2008-9-10 23:16:17

第8次更新

显示全部楼层 · 发表于 2008-9-11 15:52:16

第9次更新

显示全部楼层 · 发表于 2008-9-11 21:08:46

第10次更新

显示全部楼层 · 发表于 2008-9-12 16:57:04

第11次更新

显示全部楼层 · 发表于 2008-9-12 21:03:51

第12次更新

显示全部楼层 · 发表于 2008-9-12 21:08:27

Begin scan in 'C:\Users\TOSHIBA\Downloads\0912-1656(mm)'
C:\Users\TOSHIBA\Downloads\0912-1656(mm)\1.exe3
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE]    A backup was created as '492f69c5.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\0912-1656(mm)\mm.exe3
[DETECTION] Contains HEUR/Crypted suspicious code
[NOTE]    The detection was classified as suspicious.
[NOTE]    A backup was created as '48f86a04.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\0912-1656(mm)\x.gif
[0] Archive type: RAR
--> ￕￕￆﾬ                                                                                                 .exe
   [DETECTION] Contains HEUR/Crypted suspicious code
[NOTE]    A backup was created as '493169c5.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'C:\Users\TOSHIBA\Downloads\0912-2101(mm)'
C:\Users\TOSHIBA\Downloads\0912-2101(mm)\1.exe3
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE]    A backup was created as '492f69c6.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\0912-2101(mm)\3.exe3
[DETECTION] Contains HEUR/Malware suspicious code
[NOTE]    The detection was classified as suspicious.
[NOTE]    A backup was created as '4b40d5bf.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\0912-2101(mm)\9.exe3
[DETECTION] Contains HEUR/Crypted suspicious code
[NOTE]    The detection was classified as suspicious.
[NOTE]    A backup was created as '492f69b8.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\0912-2101(mm)\mm.exe3
[DETECTION] Contains HEUR/Crypted suspicious code
[NOTE]    The detection was classified as suspicious.
[NOTE]    A backup was created as '48f86a05.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\0912-2101(mm)\x.gif0
[0] Archive type: RAR
--> ￕￕￆﾬ                                                                                                 .exe
   [DETECTION] Contains HEUR/Crypted suspicious code
[NOTE]    A backup was created as '493169c6.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2008年9月12日  21:07
Used time: 00:03 Minute(s)

The scan has been done completely.

   2 Scanning directories
   11 Files were scanned
   2 viruses and/or unwanted programs were found
   6 Files were classified as suspicious:
   8 files were deleted
   0 files were repaired
   8 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   2 Archives were scanned
   0 Warnings
   8 Notes

显示全部楼层 · 发表于 2008-9-12 21:42:03

病毒 2008-09-12  21:41:28 C:\Documents and Settings\Administrator\桌面\0912-2101(mm).rar\3.exe3 Win32.TrojDownloader.Delf.43008 清除成功
病毒 2008-09-12  21:41:27 C:\Documents and Settings\Administrator\桌面\0912-2101(mm).rar\x.gif0\照片                                                                                                 .exe Win32.Troj.Downloader.if.58368 清除成功
病毒 2008-09-12  21:41:27 C:\Documents and Settings\Administrator\桌面\0912-2101(mm).rar\mm.exe3 Win32.Troj.Downloader.if.58368 清除成功
病毒 2008-09-12  21:41:27 C:\Documents and Settings\Administrator\桌面\0912-2101(mm).rar\9.exe3 Win32.Troj.Agent.741888 清除成功

显示全部楼层 · 发表于 2008-9-12 21:50:06

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.Win32.Agent.vmq
病毒： Worm.Win32.Autorun.etb
病毒： Trojan.DL.Win32.Direct.me

MAC 地址：00:11:2F:5A:58:BC

用户来源：互联网

软件版本：20.61.42

[病毒样本] mm.exe(第28次更新)已开新帖

12 次