吸烟的猪头..

显示全部楼层 · 发表于 2007-4-28 20:00:28

刚刚看到的, 图标挺搞笑的..呵呵..解压密码 : XYDZT

显示全部楼层 · 发表于 2007-4-28 20:03:32

Scan performed at: 2007-4-28 20:10:24
Scanning Log
NOD32 version 2225 (20070427) NT
Command line: C:\Documents and Settings\Administrator\桌面\吸烟的猪头
E:\Program Files\Eset\nod32.exe - is OK
Operating memory - is OK

Date: 28.4.2007 Time: 20:10:39
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Administrator\桌面\吸烟的猪头\
C:\Documents and Settings\Administrator\桌面\吸烟的猪头\吸烟的猪头\rising960.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\Administrator\桌面\吸烟的猪头\吸烟的猪头\吸烟的猪头.txt - is OK
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 20:10:40 Total scanning time: 1 sec (00:00:01)

Notes:
[7] File is probably infected with an unknown virus.

显示全部楼层 · 发表于 2007-4-28 20:03:57

下个玩玩
我抽烟

显示全部楼层 · 发表于 2007-4-28 20:07:03

瑞星挂，送上去

显示全部楼层 · 发表于 2007-4-28 20:07:18

kis 7.0启发
quarantined: virus Downloader (modification) File: C:\Documents and Settings\NICE\×ÀÃæ\ÎüÑÌµÄÖíÍ·\ÎüÑÌµÄÖíÍ·\rising960.exe//UPack

显示全部楼层 · 发表于 2007-4-28 20:08:42

1.方向:连出协议:tcp 远程地址:125.91.13.147: 80
2.在system32下创建explorer.exe
3.修改注册表内容
HKEY_CURRENT_USER\machine\software\microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
注册表名称:CheckedValue
4.进一步修改硬盘中exe文件

[ 本帖最后由 sxingbai 于 2007-4-28 20:21 编辑 ]

显示全部楼层 · 发表于 2007-4-28 20:52:18

金山不杀 ^_^

显示全部楼层 · 发表于 2007-4-28 21:25:55

其实附件里面有说明, 看一下就知道它干了些什么了,呵呵~~

显示全部楼层 · 发表于 2007-4-28 21:28:37

看看总是不如试试

显示全部楼层 · 发表于 2007-4-28 22:29:59

McAfee 已自動封鎖並隔離特洛伊病毒。

詳細資料
偵測: New Malware.n (特洛伊病毒)
檔案路徑: C:\Documents and Settings\all.HOME-.\桌面\吸烟的猪头\rising960.exe

[病毒样本] 吸烟的猪头..

本帖子中包含更多资源