1x

失落的手链

瑞星2010
Trojan.Win32.Generic.11EA5749

zhoufish

Avast干掉

wcj20236

微点主防报已知：

木马名称：Trojan.Win32.Generic.fld
程序：
C:\DOCUMENTS AND SETTINGS\WCJ20236\桌面\ESANP\ESANP.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

allinwonderi

[ Changes to filesystem ]
    * Deletes file C:\WINDOWS\SYSTEM32\esanp.exe.
    * Creates file C:\WINDOWS\SYSTEM32\esanp.exe.
    * Deletes file c:\ab.exe.
    * Creates file C:\ab.exe.

[ Changes to registry ]
    * Accesses Registry key "HKLM\SYSTEM\CURRENtcoNtrolset\services\esanp".
    * Creates key "HKLM\System\CurrentControlSet\Services\esanp".
    * Sets value "ImagePath"="C:\WINDOWS\SYSTEM32\esanp.exe" in key "HKLM\System\CurrentControlSet\Services\esanp".
    * Sets value "DisplayName"="esanp" in key "HKLM\System\CurrentControlSet\Services\esanp".
    * Sets value "Description"="esanp" in key "HKLM\System\CurrentControlSet\Services\esanp".
    * Accesses Registry key "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\Set".
    * Creates key "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\Set".
    * Sets value "Beizhu"="JK" in key "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\Set".
    * Accesses Registry key "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0".

[ Network services ]
    * Downloads file from http://avzhan.3322.org:81/2.exe as c:\ab.exe.
    * Connects to "avzhan.3322.org:81" on port 80 (TCP).
    * Opens URL: avzhan.3322.org:81/2.exe.
    * Connects to "dddmon.3322.org" on port 1672 (TCP).
    * Sends data stream (497 bytes) to remote address "dddmon.3322.org", port 1672.

[ Security issues ]
    * Starting downloaded file - potential security problem.

[ Process/window information ]
    * Creates service "esanp (esanp)" as "C:\WINDOWS\SYSTEM32\esanp.exe".
    * Creates process "esanp.exe".
    * Creates process "ab.exe".

[ 本帖最后由 allinwonderi 于 2009-7-13 20:51 编辑 ]

悠柚

那个文件
Virus: Gen:Trojan.Heur.PT.1030CFCFCF (Engine A)

allinwonderi

嗯，可能和主体是一样的

xes117

让我看看

尤金卡巴斯基

启发Kill，To KL

zqmm100

avast:
Win32:Trojan-gen{Other}