改主页据说很厉害的

kingmuro

2009-05-19 20:44:12        gxf        4044        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\gxf\桌面\110\ad\ad.exe" file.

BING126

to McAfee

抽风超人

现在的nis2009没有反应

zeadstone

微点主防可发现木马，但清理不干净，桌面生成两个IE快捷方式，删除后又自动生成。

JusT.Like

Last infection: bbs.kafan.cn
Infected with: Generic.Malware.dld!!.3E1EA864

loveyuwei

2009.05.19 22:14:44 ad.exe ISOLATE on start from explorer.exe
2009.05.19 22:14:44 ad.exe REDIRECT access to C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat (File)
2009.05.19 22:14:44 ad.exe REDIRECT access to C:\Documents and Settings\Administrator\Cookies\index.dat (File)
2009.05.19 22:14:44 ad.exe REDIRECT access to C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat (File)
2009.05.19 22:14:44 ad.exe READONLY access to HKU\S-1-5-21-1454471165-484763869-1708537768-500\Software\Microsoft\RAS AutoDial (Registry)<
2009.05.19 22:14:44 ad.exe READONLY access to \Device\NamedPipe\lsass (File)
2009.05.19 22:14:44 ad.exe REDIRECT access to HKU\S-1-5-21-1454471165-484763869-1708537768-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (Registry)
2009.05.19 22:14:44 ad.exe REDIRECT access to HKU\S-1-5-21-1454471165-484763869-1708537768-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride (Registry)
2009.05.19 22:14:44 ad.exe REDIRECT access to HKU\S-1-5-21-1454471165-484763869-1708537768-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL (Registry)
2009.05.19 22:14:44 ad.exe REDIRECT access to HKU\S-1-5-21-1454471165-484763869-1708537768-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings (Registry)
2009.05.19 22:14:44 ad.exe REDIRECT access to C:\WINDOWS\Debug\UserMode\userenv.log (File)

主页良好，继续空白页。

布施大行

伞  检出
        
          [检测]        Is the TR/Downloader.Gen Trojan

328397663

原帖由 fatezero 于 2009-5-19 20:13 发表
Hello,
ad.exe - Trojan-Downloader.Win32.Small.jtf
New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

不能检测..再次上报.并说明情况.

sam.to

原帖由 328397663 于 2009-5-20 00:21 发表

不能检测..再次上报.并说明情况.

20/5/2009 0:45:50        已偵測: Trojan-Downloader.Win32.Small.jtf        C:\Documents and Settings\kato9096\桌面\ad.rar/ad.exe

0:16的庫

[ 本帖最后由 sam.to 于 2009-5-20 00:49 编辑 ]

328397663

原帖由 sam.to 于 2009-5-20 00:46 发表

20/5/2009 0:45:50        已偵測: Trojan-Downloader.Win32.Small.jtf        C:\Documents and Settings\kato9096\桌面\ad.rar/ad.exe

0:16的庫

既然能侦查..

为什么还回复. . .

Hello,


ad.exe - Trojan-Downloader.Win32.Small.jtf

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.