今天发现的一个病毒

dreams521

to mpav

shardliyilin

AVG 红伞没反映

allinwonderi

[ General information ]
    * Attempts to run Visual Basic Script (VBS).
    * File length:       104253 bytes.
    * MD5 hash: 557880cdec4a3077694ea49e715e04ca.

[ Changes to filesystem ]
    * Creates directory C:.
    * Creates directory C:\WINDOWS.
    * Creates directory C:\WINDOWS\.
    * Creates directory C:\WINDOWS\\system32.
    * Creates directory C:\WINDOWS\\system32\.
    * Creates file C:\WINDOWS\system32\yexrscr.bat.
    * Creates file C:\WINDOWS\system32\yxfgscr.vbs.

[ Changes to registry ]
    * Accesses Registry key "HKCU\Software\WinRAR SFX".
    * Creates key "HKCU\Software\WinRAR SFX".
    * Sets value "C%%WINDOWS%%system32%%"="C:\WINDOWS\\system32\\" in key "HKCU\Software\WinRAR SFX".

[ Process/window information ]
    * Creates a dialogbox with caption "WinRAR \xea\xe3\x8b\x87\xf6".
    * Buttons found in dialogbox: id102[278,173]"O\xc8(&W)..." id1[211,223]"\x89\xc5" id2[278,223]"\xd6\x88" .
    * Creates a window with name "".
    * Pressing button with id 1 "".
    * Attemps to NULL C:\WINDOWS\\system32\\yxfgscr.vbs NULL.

[ Signature Scanning ]
    * C:\WINDOWS\system32\yexrscr.bat (1270 bytes) : no signature detection.
    * C:\WINDOWS\system32\yxfgscr.vbs (124 bytes) : no signature detection.

qingjiangpu

IK 红伞miss all

嘻哈伟少

原帖由 18qaz 于 2009-7-10 19:03 发表
过eset4，CA

  我的eav杀了额
难道是更新了么

BING126

McAfee 报了可疑月神。。

尤金卡巴斯基

2009/7/11 18:36:59        已清除        木马程序 Trojan.BAT.Agent.qv        G:\Temp\Virus\ycze.zip/ycze.scr/yexrscr.bat

Sherry.ai

RS MIss

洒家谈谈

norton miss