是恶意还是木马。。SETUPLP。EXE

wl1234abc

最近公司的局网出现情况。。。其中一台机

新买的。。硬盘什么也没有。。在断网的情况下装好系统，NOD32升级离线包。。运行没事。。

一接入网中招了。。。在C盘下有SETUPLP。EXE文件。进程里有多个长文件名的文件。。还有FTP在下载。。NOD32一点反应也没有。。。

360的木马检查查出有木马。。木马克星不但查不了。。还挂了。。

现在付上SERENG的日志LOG和我在临时文件夹找到的几个文件。。


在杀了几天的情况下现在毒好像少了。。C盘的SETUPLP没了。就是TEMP下有好多EXE文件。。。。。进程里有两个CMD。还有未知的EXE一个。。。

实在抱歉。本人读书少写不顺。。忘各位大虾费心了。。。。。。。。。。。。

ledled

VirusBuster found nothing

fengyu75

红伞过。
DW跑了下 添加2条注册表 生成一个BAT:
:try
del   "C:\Users\Administrator\Desktop\Temp\d1ee637143.exe"
if   exist   "C:\Users\Administrator\Desktop\Temp\d1ee637143.exe"    goto   try
del   %0

wl1234abc

可能是恶意下载。。。先这样下载再来加毒。。有没有这种可能？？？

jlj383940

扫描报告
2009年2月25日 15:56:53 - 15:56:58

计算机名称: JLJ02
扫描类型: 扫描指定目标
目标: F:\下载\Temp.rar
结果: 发现 1 个恶意软件
Trojan-Downloader.Win32.Murlo.acs (病毒)
F:\下载\Temp.rar\d1ee637143.exe

328397663

2009-2-25 16:10:14        检测到威胁: Trojan-Downloader.Win32.Murlo.acs        C:\Documents and Settings\Administrator\桌面\Temp\d1ee637143.exe               
2009-2-25 16:10:14        已删除: Trojan-Downloader.Win32.Murlo.acs        C:\Documents and Settings\Administrator\桌面\Temp\d1ee637143.exe               

其余上报卡巴

kingmuro

过咖啡8.7i

江湖的fans

是个毒毒，调用cmd在后台联网

后门吗？还是下载器？我上报NOD32

Palkia

to rs

Kitman

Filename        Result         e8fd2a7c141.exe         MALWARE

The file 'e8fd2a7c141.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Spy.Agent.sak. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.
Filename        Result         1963abda144.exe         MALWARE

The file '1963abda144.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Drop.Agent.svn. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.
Filename        Result         d1ee637143.exe         MALWARE

The file 'd1ee637143.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Murlo.acs.1. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.01.02.76.
Filename        Result         mta47100.dll         KNOWN CLEAN

The file 'mta47100.dll' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'Microsoft Windows Server 2003 / Windows XP (KB958215)'.