[病毒样本] 1x

显示全部楼层 · 发表于 2009-6-23 10:43:09

a virus or unwanted program 'TR/Dropper.Gen' [trojan] was found.

显示全部楼层 · 发表于 2009-6-23 10:43:49

G:\virus\setup.rar/setup.exe detected: Trojan.Win32.Chifrax!IK

显示全部楼层 · 发表于 2009-6-23 10:51:17

2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:AppData
注册表数据:C:\Documents and Settings\Administrator\Application Data
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:AppData
注册表数据:C:\Documents and Settings\Administrator\Application Data
2009-06-23 10:49:33 文件保护(创建文件)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
文件路径:C:\Sandbox\Administrator\DefaultBox\drive\C\Program Files\Internet Explorer\__tmp_rar_sfx_access_check_6466312
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:Personal
注册表数据:D:\Backup\我的文档
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:Personal
注册表数据:D:\Backup\我的文档
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{df74d95f-4bef-11de-a88e-806d6172696f}
注册表名称:BaseClass
注册表数据:Drive
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{df74d95f-4bef-11de-a88e-806d6172696f}
注册表名称:BaseClass
注册表数据:Drive
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{df74d95c-4bef-11de-a88e-806d6172696f}
注册表名称:BaseClass
注册表数据:Drive
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{df74d95c-4bef-11de-a88e-806d6172696f}
注册表名称:BaseClass
注册表数据:Drive
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{df74d95e-4bef-11de-a88e-806d6172696f}
注册表名称:BaseClass
注册表数据:Drive
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{df74d95e-4bef-11de-a88e-806d6172696f}
注册表名称:BaseClass
注册表数据:Drive
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{df74d95d-4bef-11de-a88e-806d6172696f}
注册表名称:BaseClass
注册表数据:Drive
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{df74d95d-4bef-11de-a88e-806d6172696f}
注册表名称:BaseClass
注册表数据:Drive
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{df74d960-4bef-11de-a88e-806d6172696f}
注册表名称:BaseClass
注册表数据:Drive
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{df74d960-4bef-11de-a88e-806d6172696f}
注册表名称:BaseClass
注册表数据:Drive
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\machine\software\microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:Common Documents
注册表数据:C:\Documents and Settings\All Users\Documents
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\machine\software\microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:Common Documents
注册表数据:C:\Documents and Settings\All Users\Documents
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:Desktop
注册表数据:C:\Documents and Settings\Administrator\桌面
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:Desktop
注册表数据:C:\Documents and Settings\Administrator\桌面
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
注册表名称:ProxyBypass
注册表数据:Bypass
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
注册表名称:ProxyBypass
注册表数据:Bypass
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
注册表名称:IntranetName
注册表数据:netName
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
注册表名称:IntranetName
注册表数据:netName
2009-06-23 10:49:33 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
注册表名称:UNCAsIntranet
注册表数据:Intranet
2009-06-23 10:49:34 注册表保护(修改注册表内容)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
注册表名称:UNCAsIntranet
注册表数据:Intranet
2009-06-23 10:49:41 应用程序保护(运行应用程序)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
文件路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\setup\setup.exe
命令行:-el -s2 "-dC:\Program Files\Internet Explorer\" "-p" "-sp"

显示全部楼层 · 发表于 2009-6-23 11:20:47

过pctools和大蜘蛛

显示全部楼层 · 发表于 2009-6-23 11:33:05

Virus: Trojan.Generic.1656079 (Engine A)

Virus found while downloading Web content.

Address: bbs.kafan.cn

显示全部楼层 · 发表于 2009-6-23 11:35:52

to mp

显示全部楼层 · 发表于 2009-6-23 12:08:08

To McAfee

显示全部楼层 · 发表于 2009-6-23 14:18:23

rav2010 pass

显示全部楼层 · 发表于 2009-6-23 14:58:15

to kl

[病毒样本] 1x

本帖子中包含更多资源

本帖子中包含更多资源