6ge

Palkia

allinwonderi

[Found password stealer]        <W32/OnlineGames.A.gen!Eldorado (not disinfectable, generic)>        C:\Test\桌面\90DDCFDE.TTF
[Quarantined]        C:\Test\桌面\90DDCFDE.TTF
[Found possible security risk]        <W32/Heuristic-KPP!Eldorado (not disinfectable)>        C:\Test\桌面\COMRES.DLL
[Quarantined]        C:\Test\桌面\COMRES.DLL
[Found possible security risk]        <W32/Heuristic-KPP!Eldorado (not disinfectable)>        C:\Test\桌面\COMRES1.TTF
[Quarantined]        C:\Test\桌面\COMRES1.TTF
[Found possible security risk]        <W32/Heuristic-210!Eldorado (damaged, not disinfectable)>        C:\Test\桌面\QIDONG.EXE->(UPack)->(UPack)
[Quarantined]        C:\Test\桌面\QIDONG.EXE->(UPack)->(UPack)
[Found password stealer]        <W32/OnlineGames.A.gen!Eldorado (not disinfectable, generic)>        C:\Test\桌面\SHE32.DLL
[Quarantined]        C:\Test\桌面\SHE32.DLL
[Found possible security risk]        <W32/Heuristic-210!Eldorado (damaged, not disinfectable)>        C:\Test\桌面\VERCLSID.EXE->(UPack)->(UPack)
[Quarantined]        C:\Test\桌面\VERCLSID.EXE->(UPack)->(UPack)

---------------------------------------------------------------------
Scan ended:        2009-5-24, 21:10:21
Duration:        0:00:03

Scan result:

Scanned files:                 11
Infected objects:         6
Disinfected objects:         0
Quarantined files:         6
----------------------------------------------------------

sam.to

24/5/2009 21:11:59        已偵測: Trojan-GameThief.Win32.OnLineGames.bmbd        C:\Documents and Settings\kato9096\桌面\254\COMRES1.TTF               
24/5/2009 21:12:00        已偵測: Trojan-GameThief.Win32.Magania.bdiu        C:\Documents and Settings\kato9096\桌面\254\QIDONG.EXE               
24/5/2009 21:12:00        已偵測: Trojan-GameThief.Win32.Magania.bdiu        C:\Documents and Settings\kato9096\桌面\254\VERCLSID.EXE               

to kl

BING126

McAfee 报了3个。。

HC303

Virus or unwanted program 'TR/Spy.Gen [trojan]'
detected in file 'H:\桌面\90DDCFDE.TTF.
Virus or unwanted program 'TR/PSW.OnlineGames.bmbd [trojan]'
detected in file 'H:\桌面\COMRES1.TTF.
Virus or unwanted program 'TR/Dropper.Gen [trojan]'
detected in file 'H:\桌面\QIDONG.EXE.
Virus or unwanted program 'TR/Dropper.Gen [trojan]'
detected in file 'H:\桌面\VERCLSID.EXE.
Virus or unwanted program 'TR/Spy.Gen [trojan]'
detected in file 'H:\桌面\SHE32.DLL.
miss one

einnawy

红伞miss1

黑衣~魂

dr.web
COMRES1.TTF;D:\Documents and Settings\Administrator\桌面;Trojan.Fonts.origin;Deleted.;
QIDONG.EXE;D:\Documents and Settings\Administrator\桌面;Probably BACKDOOR.Trojan;Renamed.;
VERCLSID.EXE;D:\Documents and Settings\Administrator\桌面;Probably BACKDOOR.Trojan;Renamed.;
to miss

sam.to

Hello,

90DDCFDE.TTF - Trojan-GameThief.Win32.WOW.onb,
COMRES.DLL - Trojan-GameThief.Win32.OnLineGames.bmcg

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

nosferatu

elst5523183

往system32创建exe并隐藏
2009-05-25 05:29:00    创建文件      
进程路径:E:\download\test\桌面\QIDONG.EXE
文件路径:C:\WINDOWS\system32\verclsid.exe

2009-05-25 05:29:00    修改文件      
进程路径:E:\download\test\桌面\QIDONG.EXE
文件路径:(隐藏文件)C:\WINDOWS\system32\verclsid.exe

创建字体
2009-05-25 05:29:00    创建文件      
进程路径:E:\download\test\桌面\QIDONG.EXE
文件路径:C:\WINDOWS\fonts\57ef2e25.ttf

往system32创建dl, l注入到explorer中.并调用
2009-05-25 05:29:00    创建文件      
进程路径:E:\download\test\桌面\QIDONG.EXE
文件路径:C:\WINDOWS\system32\she32.dll

2009-05-25 05:29:00    修改注册表内容      
进程路径:E:\download\test\桌面\QIDONG.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
注册表名称:Shell
更改后:Explorer.exe,rundll32 shell32 Control_RunDLL "she32.dll"
更改前:Explorer.exe

2009-05-25 05:29:00    运行应用程序      
进程路径:E:\download\test\桌面\QIDONG.EXE
文件路径:C:\WINDOWS\system32\rundll32.exe
命令行:shell32 Control_RunDLL "she32.dll"

往temp创建bat.调用cmd删除qidong.exe跟自己本身
2009-05-25 05:29:00    创建文件      
进程路径:E:\download\test\桌面\QIDONG.EXE
文件路径:E:\Temp\del9.tmp.bat

2009-05-25 05:31:07    删除文件      
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:E:\download\test\桌面\QIDONG.EXE

2009-05-25 05:31:07    删除文件      
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:E:\Temp\delA.tmp.bat