群共享里面下的，看看是不是老毒？

hddgmon

趋势启发报～
但是好像是很老的毒吧？

The EQs

Scan performed at: 2007-3-21 16:46:52
Scanning Log
NOD32 version 2130 (20070321) NT
Command line: C:\Documents and Settings\EQ2\桌面\QQ宠物速成伴侣.rar
Operating memory - is OK

Date: 21.3.2007  Time: 16:46:56
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\QQ宠物速成伴侣.rar
C:\Documents and Settings\EQ2\桌面\QQ宠物速成伴侣.rar ?RAR ?QQ宠物速成伴侣.exe - probably a variant of Win32/PSW.QQShou trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 16:46:56 Total scanning time: 0 sec (00:00:00)

观弈书童

金山报Win32.Troj.Agent.ps.86016

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-3-18
Start time: 2007-3-21 17:42
Engine(s): KAV engine (AVK 17.3377), BD-Engine (BD 17.2421)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: QQ宠物速成伴侣.exe
        In archive: C:\Documents and Settings\Administrator\桌面\QQ宠物速成伴侣.rar
        Status: Virus detected
        Virus: Trojan-PSW.Win32.QQPass.up (KAV engine), Trojan.PWS.QQPass.NB (BD-Engine)
Object: QQ宠物速成伴侣.rar
        Path: C:\Documents and Settings\Administrator\桌面
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.QQPass.up (KAV engine), Trojan.PWS.QQPass.NB (BD-Engine)
Analysis complete: 2007-3-21 17:42
    1 files checked
    1 infected files detected
    0 suspected files detected

allenhippo

norton

蓝色牛仔裤

蜘蛛...

gggh

下不了杀了

jlennon

1

solcroft

一闪便退出
待会才慢慢用沙盘分析

alainhenri

执行生成：
C:\Program Files\Internet Explorer\Connection Wizard\isignup.dl
C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys
修改注册表：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{B8A170A8-7AD3-4678-B2FE-F2D7381CC1B5}开机启动isignup.sys
并将isignup.sys注入所有的应用程序进程（包括系统进程Explorer.EXE）.