今天真奇怪 又碰到病毒了

江湖的fans

试了第一个

2009-07-13 16:42:48        注册表保护(修改注册表内容)     操作:阻止
进程路径:C:\WINDOWS\System32\esanp.exe
注册表路径:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
注册表名称:SavedLegacySettings
2009-07-13 16:42:48        注册表保护(修改注册表内容)     操作:阻止
进程路径:C:\WINDOWS\System32\esanp.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths
注册表名称:Directory
更改后:C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5
更改前:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2009-07-13 16:42:48        应用程序保护(运行应用程序)     操作:阻止并结束进程
进程路径:C:\Documents and Settings\Administrator\桌面\du\1[1].exe
文件路径:C:\WINDOWS\System32\cmd.exe
命令行:/c  del C:\DOCUME~1\ADMINI~1\桌面\du\1_1_~1.EXE > nul
2009-07-13 16:42:40        文件保护(修改文件)     操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\du\1[1].exe
文件路径:(隐藏文件)C:\WINDOWS\system32\esanp.exe



=====================================================================

行为超多啊~在windows文件夹下创建了esanp.exe 然后把它注册为服务 修改IE的注册表

再要求联网

zhoufish

A清空

allinwonderi

-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.4.4
Virus signature file from: 2009-7-13, 1:08

Scan name: [Custom Scan]
Path to scan: C:\Test\du.rar

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2009-7-13, 20:57:46
---------------------------------------------------------------------

[Found security risk]        <W32/QQhelper.C.gen!Eldorado (not disinfectable, generic)>        C:\Test\du.rar->du\1691[1].exe
[Found security risk]        <W32/QQhelper.C.gen!Eldorado (not disinfectable, generic)>        C:\Test\du.rar->du\1[1].exe
[Found security risk]        <W32/QQhelper.C.gen!Eldorado (not disinfectable, generic)>        C:\Test\du.rar->du\2[1].exe
[Found security risk]        <W32/QQhelper.C.gen!Eldorado (not disinfectable, generic)>        C:\Test\du.rar->du\3[1].exe
[Found possible virus]        <W32/VBTrojan.4!Maximus (not disinfectable)>        C:\Test\du.rar->du\ctfmen.exe->(UPX)
[Found Trojan]        <W32/QHost.B.gen!Eldorado (not disinfectable, generic)>        C:\Test\du.rar->du\extext2849156t.exe
[Found Trojan]        <W32/QHost.B.gen!Eldorado (not disinfectable, generic)>        C:\Test\du.rar->du\extext2849250t.exe
[Found Trojan]        <W32/QHost.B.gen!Eldorado (not disinfectable, generic)>        C:\Test\du.rar->du\extext2849281t.exe
[Found Trojan]        <W32/QHost.B.gen!Eldorado (not disinfectable, generic)>        C:\Test\du.rar->du\extext2863015t.exe
[Found Trojan]        <W32/QHost.B.gen!Eldorado (not disinfectable, generic)>        C:\Test\du.rar->du\extext721578t.exe
[Found Trojan]        <W32/QHost.B.gen!Eldorado (not disinfectable, generic)>        C:\Test\du.rar->du\extext73546t.exe
[Found Trojan]        <W32/QHost.B.gen!Eldorado (not disinfectable, generic)>        C:\Test\du.rar->du\extext73937t.exe
[Found Trojan]        <W32/QHost.B.gen!Eldorado (not disinfectable, generic)>        C:\Test\du.rar->du\extext74562t.exe
[Found Trojan]        <W32/QHost.B.gen!Eldorado (not disinfectable, generic)>        C:\Test\du.rar->du\extext75031t.exe
[Found Trojan]        <W32/QHost.B.gen!Eldorado (not disinfectable, generic)>        C:\Test\du.rar->du\extext76703t.exe
[Found Trojan]        <W32/QHost.B.gen!Eldorado (not disinfectable, generic)>        C:\Test\du.rar->du\extext76796t.exe
[Found Trojan]        <W32/QHost.B.gen!Eldorado (not disinfectable, generic)>        C:\Test\du.rar->du\extext79390t.exe
[Contains infected objects]        C:\Test\du.rar
[Quarantined]        C:\Test\du.rar->du\scvhost.exe->(embedded)

---------------------------------------------------------------------
Scan ended:        2009-7-13, 20:57:47
Duration:        0:00:01

Scan result:

Scanned files:                 1
Infected objects:         17
Disinfected objects:         0
Quarantined files:         1
---------------------------------------------------------------------

haol

漏掉一個



[ 本帖最后由 haol 于 2009-7-13 22:59 编辑 ]

清风皓月

ESET牛啊，全灭了

[ 本帖最后由 清风皓月 于 2009-7-13 23:22 编辑 ]