极品飞车的文件

显示全部楼层 · 发表于 2009-1-27 14:49:14

请求的对象被感染，发现下列病毒 Trojan.Win32.StartPage.dgr
能查了

显示全部楼层 · 发表于 2009-1-27 18:43:26

主页改成了这个

显示全部楼层 · 发表于 2009-2-19 10:11:05

NOD没反应…………

显示全部楼层 · 发表于 2009-2-19 10:14:18

Starting the file scan:

Begin scan in 'D:\playnfs12_.rar'
D:\playnfs12_.rar
[0] Archive type: RAR
--> playnfs12_.exe
   [DETECTION] Is the TR/StartPage.dgr Trojan
[NOTE]    The file was deleted!

End of the scan: 2009年2月19日  10:15
Used time: 00:09 Minute(s)

The scan has been done completely.

   0 Scanning directories
   2 Files were scanned
   1 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2009-2-19 10:16:40

to VB

显示全部楼层 · 发表于 2009-2-19 12:55:08

卡巴报 Trojan.Win32.StartPage.dgr

行为:

2009-2-19 12:53:54 playnfs12_.exe 启动进程 C:\DOCUMENTS AND SETTINGS\Administrator\桌面\playnfs12_\playnfs12_.exe
2009-2-19 12:53:55 playnfs12_.exe 拒绝: KLSystemData/重要文件/ 删除 C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk
2009-2-19 12:53:57 playnfs12_.exe 拒绝: KLPrivateData/KLPrivateUserFiles/My documents2 读取 C:\Documents and Settings\Administrator\My Documents\desktop.ini
2009-2-19 12:53:58 playnfs12_.exe 拒绝: KLPrivateData/KLPrivateUserFiles/My documents2 读取 C:\Documents and Settings\Administrator\My Documents\desktop.ini
2009-2-19 12:53:58 playnfs12_.exe 拒绝: KLPrivateData/KLPrivateUserFiles/My documents2 读取 C:\Documents and Settings\Administrator\My Documents\desktop.ini
2009-2-19 12:53:58 playnfs12_.exe 拒绝: KLSystemData/重要文件/ 创建 C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk
2009-2-19 12:53:59 playnfs12_.exe 拒绝: KLSystemData/KLSystemServicesRegKeys/Classes_CLSID 修改 hklm\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command
2009-2-19 12:53:59 playnfs12_.exe 退出进程 C:\DOCUMENTS AND SETTINGS\Administrator\桌面\playnfs12_\playnfs12_.exe

[病毒样本] 极品飞车的文件

本帖子中包含更多资源