又是ORZ.EXE(找到了本体了）

Sebastian

Starting the file scan:

Begin scan in 'D:\new\orz.exe'
D:\new\orz.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
        [2] Archive type: RSRC
        --> Object
          [DETECTION] Is the TR/Crypt.CY.11 Trojan
    [NOTE]      A backup was created as '4a4ad0fb.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!


End of the scan: 2009年3月30日  22:00
Used time: 00:00 Minute(s)

The scan has been done completely.

      0 Scanned directories
      1 Files were scanned
      1 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      1 files were deleted
      0 Viruses and unwanted programs were repaired
      1 Files were moved to quarantine
      0 Files were renamed
      0 Files cannot be scanned
      0 Files not concerned
      0 Archives were scanned
      0 Warnings
      1 Notes

328397663

2009-3-30 22:06:02        检测到威胁: Trojan-GameThief.Win32.OnLineGames.bkzf        C:\Documents and Settings\Administrator\桌面\新建文件夹\orz\orz.exe/NSPack               
2009-3-30 22:06:09        已删除: Trojan-GameThief.Win32.OnLineGames.bkzf        C:\Documents and Settings\Administrator\桌面\新建文件夹\orz\orz.exe

moshidianzi

太深奥了。。

SUZAKU

卡巴斯基杀毒报告

扫描文件数：

~Frm压缩包：5

orz压缩包：4

查杀（病毒、木马）数：

~Frm压缩包：1

orz压缩包：1

详细杀毒报告列表：

~Frm压缩包：

2009-3-30 22:39:06        检测到威胁: HEUR:Trojan.Win32.Generic        C:\Documents and Settings\Try\桌面\新建文件夹\~Frm.zip/~Frm.exe               

orz压缩包：

2009-3-30 22:41:11        已删除: Trojan-GameThief.Win32.OnLineGames.bkzf        C:\Documents and Settings\Try\桌面\新建文件夹\orz.zip/orz.exe               

ledled

Name: Packed/NSPack
Type: Sequence

Description:


Files:
c:\users\administrator\desktop\orz.exe

liu5678

NIS 报了TROJAN KILLAV

黑衣~魂

DW
orz.exe;Probably MULDROP.Trojan;;
~Frm.zip;Probably MULDROP.Trojan

smallyou93

原帖由 martionhao 于 2009-3-30 21:06 发表
2009-03-30 20:48:58 文件保护(创建文件)     操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\orz.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp ...

创建一个bat

调出cmd删除自身了