worm

Palkia

软件名称	引擎版本	病毒库版本	病毒库时间	扫描结果	时间
a-squared	4.5.0.8	20100116023211	2010-01-16	Riskware.Win32.Injector!IK	4.115
AntiVir	8.2.1.142	7.10.2.203	2010-01-16	WORM/Palevo.ntf.10	0.158
Arcavir	2009	201001160204	2010-01-16	-	0.052
Authentium	5.1.1	201001152349	2010-01-15	-	1.336
AVAST!	4.7.4	100117-0	2010-01-17	Win32:Trojan-gen	0.010
AVG	8.5.288	270.14.146/2627	2010-01-17	Dropper.Generic.BLYX	0.302
BitDefender	7.81008.4861389	7.29917	2010-01-17	Trojan.Agent.AOGL	4.197
CA (VET)	35.1.0	7239	2010-01-15	-	7.839
ClamAV	0.95.2	10304	2010-01-16	-	0.020
Comodo	3.13.579	3409	2010-01-17	-	0.935
CP Secure	1.3.0.5	2010.01.16	2010-01-16	W32.P2P.W.Palevo.ntf	0.070
Dr.Web	4.44.0.9170	2010.01.16	2010-01-16	Trojan.MulDrop.58844	8.948
F-Prot	4.4.4.56	20100116	2010-01-16	-	1.293
F-Secure	7.02.73807	2010.01.17.01	2010-01-17	P2P-Worm.Win32.Palevo.ntf [AVP]	9.346
GData	19.9999/19.681	20100116	2010-01-16	P2P-Worm.Win32.Palevo.ntf [Engine:A]	5.995
Ikarus	T3.1.01.80	2010.01.17.74981	2010-01-17	VirTool.Win32.Injector	4.259
Microsoft	1.5302	2010.01.17	2010-01-17	-	11.104
Norman	6.01.09	6.01.00	2010-01-16	-	4.006
nProtect	20100116.01	6893998	2010-01-16	Trojan.Agent.AOGL	4.058
Quick Heal	10.00	2010.01.16	2010-01-16	Win32.Worm.Pushbot.gen.8	1.648
Sophos	3.03.0	4.49	2010-01-17	-	3.168
Sunbelt	3.9.2390.2	5621	2010-01-16	-	10.395
The Hacker	6.5.0.6	v00153	2010-01-16	W32/Palevo.ntf	0.734
VBA32	3.12.12.1	20100115.0633	2010-01-15	P2P-Worm.Win32.Palevo.ntf	2.351
ViRobot	20100116	2010.01.16	2010-01-16	Worm.Win32.P2P-Palevo.87040.B	0.412
VirusBuster	4.5.11.10	10.119.6/2018150	2010-01-16	-	2.504
卡巴斯基	5.5.10	2010.01.17	2010-01-17	P2P-Worm.Win32.Palevo.ntf	0.061
安博士V3	2010.01.17.00	2010.01.17	2010-01-17	-	1.016
安天	2.0.18	20100112.3695772	2010-01-12	Worm/Win32.Palevo.ntf[P2P]	0.119
江民杀毒	13.0.900	2010.01.16	2010-01-16	Worm/Palevo.ljk	4.631
熊猫卫士	9.05.01	2010.01.15	2010-01-15	Adware/AccesMembre	2.108
瑞星	20.0	22.30.06.03	2010-01-17	Trojan.Win32.DelfCode.ap	1.378
赛门铁克	1.3.0.24	20100112.005	2010-01-12	-	0.004
趋势科技	9.120-1004	6.776.02	2010-01-16	-	0.616
迈克菲	5.3.00	5863	2010-01-16	-	3.394
金山毒霸	2009.2.5.15	2010.1.16.20	2010-01-16	Worm.Palevo.108544	0.527
飞塔	11.382-	11.382	2010-01-16	-	0.249

wliao

DefenseWall

江湖的fans

Trojan.Win32.DelfCode.ap

ray1106

2010-01-17 16:42:29        注册表保护(创建注册表值)     操作:允许
进程路径:C:\WINDOWS\Explorer.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
注册表名称:Taskman

不断复制自我，插入explorer，修改winlogon，好像还有溢出攻击

jason_jiang

to MS

saibanzhizun

下来看看

kingmuro

rising2010

Trojan.Win32.DelfCode.ap

BING126

McAfee 报了可疑月神。。