Kaspersky Anti-Virus Found nothing

绅博周幸

病毒行为分析：

Sandbox: W32/Malware; [ General information ]

* Accesses executable file from resource section.
* File length: 115763 bytes.

[ Changes to filesystem ]
* Creates file C:\WINDOWS\SYSTEM32\realsched.exe.
* Creates file C:\WINDOWS\TEMP\delmeexe.bat.
* Creates file C:\WINDOWS\SYSTEM32\realsched.dll.

[ Changes to registry ]
* Creates key "HKLM\System\CurrentControlSet\Services\RPCS".
* Sets value "ImagePath"="C:\WINDOWS\SYSTEM32\realsched.exe" in key "HKLM\System\CurrentControlSet\Services\RPCS".
* Sets value "DisplayName"="Remote Procedure Call System(RPCS)" in key "HKLM\System\CurrentControlSet\Services\RPCS".
* Sets value "Description"="����������RPC�������ݿ⡣" in key "HKLM\System\CurrentControlSet\Services\RPCS".

[ Process/window information ]
* Creates an event called .
* Creates service "RPCS (Remote Procedure Call System(RPCS))" as "C:\WINDOWS\SYSTEM32\realsched.exe".
* Modifies other process memory.
* Creates a remote thread.

worker321

avk的bd报
反病毒专家 AntiVirusKit 2006 扫描病毒日志记录
版本 16.0.7
双引擎反病毒签名 2007-2-24
开始时间: 2007-2-25 17:04
引擎: KAV 引擎 (AVK 16.10153), BD 引擎 (BD 16.6079)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: realsched.exe
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\realsched.zip
        Status: 已发现病毒
        病毒: BehavesLike:Win32.ExplorerHijack (BD 引擎)
对象: realsched.zip
        路径: C:\Documents and Settings\Administrator\桌面
        Status: 已发现病毒
        病毒: BehavesLike:Win32.ExplorerHijack (BD 引擎)
扫描完成: 2007-2-25 17:04
    已检查 1 个文件
    已发现 1 个染毒文件
    发现 0 个可疑文件

风野胤

nod的

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\realsched.zip'
C:\Documents and Settings\Administrator\My Documents\
  realsched.zip
    [0] Archive type: ZIP
    --> realsched.exe
        [DETECTION] Contains signature of the worm WORM/Fujacks.L
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

hsjj2005

微点
木马名称:Trojan-PSW.Win32.QQRob.bsm

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TWIEX3\REALSCHED.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

hsjj2005

费尔右键扫描未报

jlennon

3张PP

[ 本帖最后由 jlennon 于 2007-2-26 00:15 编辑 ]