毒：a.exe

显示全部楼层 · 发表于 2011-3-15 16:30:06

毒：a.exe

显示全部楼层 · 发表于 2011-3-15 16:31:50

ess kill

D:\下载文件夹\a.rar > RAR > a.exe - Win32/Kryptik.LOG 特洛伊木马的变种

显示全部楼层 · 发表于 2011-3-15 16:32:38

红伞启发干掉

显示全部楼层 · 发表于 2011-3-15 16:54:49

suspicious file

显示全部楼层 · 发表于 2011-3-15 16:55:18

金山Kill

显示全部楼层 · 发表于 2011-3-15 17:27:09

Starting the file scan:

Begin scan in 'C:\Users\Desktop\a.rar'
C:\Users\\Desktop\a.rar
[0] Archive type: RAR
  [DETECTION] Contains HEUR/Crypted suspicious code
  --> a.exe
[DETECTION] Contains HEUR/Crypted suspicious code

Beginning disinfection:
C:\Users\\Desktop\a.rar
[DETECTION] Contains HEUR/Crypted suspicious code
[NOTE]    The file was deleted!

End of the scan: 2011年3月15日  17:24
Used time: 00:00 Minute(s)

The scan has been done completely.

   0 Scanned directories
   2 Files were scanned
   0 Viruses and/or unwanted programs were found
   1 Files were classified as suspicious
   1 files were deleted
   0 Viruses and unwanted programs were repaired
   0 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2011-3-15 18:38:11

咖啡月神报

显示全部楼层 · 发表于 2011-3-15 18:53:20

BitDefender a.exe Trojan.Generic.5593291

显示全部楼层 · 发表于 2011-3-15 18:55:44

小A没有反应

显示全部楼层 · 发表于 2011-3-15 19:02:15

本帖最后由 liulangzhecgr 于 2011-3-15 19:07 编辑

explorer.exe进程注入hfetlukt10.dll, 好象应用程序里都要注入...

ie插件留下hfetlukt20.dll的痕迹:

启动项里留下hfetlukt.exe的痕迹:

[病毒样本] 毒：a.exe

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块