过卡8交互模式

老菜鸟

晕！mamutu什么也没有提示啊。

wangjay1980

晕，怎么我这里是这样啊，没什么啊


DNSChanger.exe   (events: 9)
2008-11-2 JAY20:13:05 Placed in group Low Restricted  
2008-11-2 JAY20:13:05 Process start C:\Documents and Settings\Owner\桌面\DNSChanger.exe  
2008-11-2 JAY20:13:16 Create C:\DOCUME~1\Owner\LOCALS~1\Temp\nsaF.tmp Allowed: KLSystemData/FD-C/
2008-11-2 JAY20:13:16 Delete C:\Documents and Settings\Owner\Local Settings\Temp\nsaF.tmp Allowed: KLSystemData/FD-C/
2008-11-2 JAY20:13:16 Create C:\DOCUME~1\Owner\LOCALS~1\Temp\jah30200.exe Allowed: KLSystemData/FD-C/
2008-11-2 JAY20:13:16 Create C:\Documents and Settings\Owner\Local Settings\Temp\jah30200.exe  
2008-11-2 JAY20:13:47 Create C:\DOCUME~1\Owner\LOCALS~1\Temp\nsq10.tmp Allowed: KLSystemData/FD-C/
2008-11-2 JAY20:13:47 Delete C:\Documents and Settings\Owner\Local Settings\Temp\nsq10.tmp Allowed: KLSystemData/FD-C/
2008-11-2 JAY20:13:47 Create C:\DOCUME~1\Owner\LOCALS~1\Temp\nsq10.tmp\modern-header.bmp Allowed: KLSystemData/FD-C/



jah30200.exe   (events: 14)
2008-11-2 JAY20:13:47 Placed in group Low Restricted  
2008-11-2 JAY20:13:47 Process start C:\DOCUME~1\Owner\LOCALS~1\Temp\jah30200.exe  
2008-11-2 JAY20:13:47 Create HKEY_CLASSES_ROOT\*/DocumentInfo  
2008-11-2 JAY20:14:03 Create C:\DOCUME~1\Owner\LOCALS~1\Temp\tmp11.tmp Allowed: KLSystemData/FD-C/
2008-11-2 JAY20:14:03 Create C:\DOCUME~1\Owner\LOCALS~1\Temp\tmp11.tmp Allowed: KLSystemData/FD-C/
2008-11-2 JAY20:14:03 Create C:\DOCUME~1\Owner\LOCALS~1\Temp\tmp12.tmp Allowed: KLSystemData/FD-C/
2008-11-2 JAY20:14:03 Create C:\DOCUME~1\Owner\LOCALS~1\Temp\tmp12.tmp Allowed: KLSystemData/FD-C/
2008-11-2 JAY20:14:04 Modification C:\DOCUME~1\Owner\LOCALS~1\Temp\tmp12.tmp Allowed: KLSystemData/FD-C/
2008-11-2 JAY20:14:04 Modification C:\Documents and Settings\Owner\Local Settings\Temp\tmp12.tmp Allowed: KLSystemData/FD-C/
2008-11-2 JAY20:14:04 Modification C:\Documents and Settings\Owner\Local Settings\Temp\tmp12.tmp  
2008-11-2 JAY20:14:04 Delete C:\Documents and Settings\Owner\Local Settings\Temp\tmp12.tmp Allowed: KLSystemData/FD-C/
2008-11-2 JAY20:14:04 Modification C:\Documents and Settings\Owner\Local Settings\Temp\tmp11.tmp  
2008-11-2 JAY20:14:04 Delete C:\Documents and Settings\Owner\Local Settings\Temp\tmp11.tmp Allowed: KLSystemData/FD-C/
2008-11-2 JAY20:14:04 Process exit C:\DOCUME~1\Owner\LOCALS~1\Temp\jah30200.exe  


没发现你说的行为

luxiao200888

过AVG to avg lab

浪滔天

原帖由 wangjay1980 于 2008-11-2 20:17 发表
晕，怎么我这里是这样啊，没什么啊
390568

DNSChanger.exe   (events: 9)
2008-11-2 JAY20:13:05 Placed in group Low Restricted  
2008-11-2 JAY20:13:05 Process start C:\Documents and Settings\Owner\桌 ...

分区下没创建 autorun.inf ？可能必须在系统启动 spoolsv.exe 的情况下才行，你看看你的这个服务有没有启动。

liu5678

KIS 2008下载的时候没提示阻止。
但是扫描的时候报了。

hello1577

C:\Documents and Settings\Administrator\桌面\DNSChanger.rar.tw!\DNSChanger.exe\data002 - 已感染 Trojan.Packed.673

压缩包中有被感染的对象