三一一一一

显示全部楼层 · 发表于 2010-11-16 12:10:54

大蜘蛛：3111\3111.exe - infected with Trojan.DownLoader.origin

非特征风险运算法则作出的判断。

显示全部楼层 · 发表于 2010-11-16 13:36:06

miss,to xandora(panda)

显示全部楼层 · 发表于 2010-11-16 14:55:33

BDAV2011
Found Nothing
已上报

显示全部楼层 · 发表于 2010-11-17 18:00:38

瑞星2011KILL

显示全部楼层 · 发表于 2010-11-17 18:04:21

小红伞杀了

显示全部楼层 · 发表于 2010-11-17 18:36:17

C:\WINDOWS\system32\fswf.ico
C:\WINDOWS\system32\tbao.ico
C:\program files\winzip32\180707480.jse
C:\WINDOWS\winnode32.dll
C:\WINDOWS\smssrun.jse
C:\WINDOWS\smssrun.lnk
C:\WINDOWS\1603681010.jse
C:\WINDOWS\system32\1603681010.jse
C:\WINDOWS\system\SVCHOST.EXE

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
{871C5380-42A0-1069-A2EA-08002B30309D}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
PendingFileRenameOperations
\??\C:\WINDOWS\smssrun.lnk

HKEY_CLASSES_ROOT\.yie
HKEY_CLASSES_ROOT\.ytb
HKEY_CLASSES_ROOT\.ysw
HKEY_CLASSES_ROOT\.yei
HKEY_CLASSES_ROOT\.IEX

C:\Documents and Settings\All Users\桌面\Internet Explorer.yie
C:\Documents and Settings\All Users\桌面\淘宝热卖.ytb
C:\Documents and Settings\All Users\桌面\小游戏.ysw
C:\Documents and Settings\All Users\「开始」菜单\Internet Explorer.yie
C:\Documents and Settings\All Users\「开始」菜单\淘宝热卖.ytb
C:\Documents and Settings\All Users\「开始」菜单\小游戏.ysw
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.yie
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\淘宝热卖.ytb
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\小游戏.ysw
C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\Internet Explorer.yei

C:\Documents and Settings\Administrator\Templates\==网址导航==.bak
C:\Documents and Settings\Administrator\Favorites\==网址导航==.url
C:\Documents and Settings\Administrator\Templates\==淘宝购物==.bak

等等...........

[病毒样本] 三一一一一