【MD5: 2C1B1A】

promised

蓝色牛仔裤

[Scan path] C:\Documents and Settings\Administrator\桌面\1.rar
>>>C:\Documents and Settings\Administrator\桌面\1.rar\1\Www.CN-Yock.neT.exe\data001 infected with Trojan.MulDrop.origin
>>C:\Documents and Settings\Administrator\桌面\1.rar\1\Www.CN-Yock.neT.exe\data002 - Ok
>C:\Documents and Settings\Administrator\桌面\1.rar\1\Www.CN-Yock.neT.exe - archive contains infected objects
C:\Documents and Settings\Administrator\桌面\1.rar - archive contains infected objects

seamonkey

detected: Trojan program Trojan-Dropper.Win32.Small.auz        URL: http://bbs.kafan.cn/attachment.p ... Www.CN-Yock.neT.exe

zxy900906

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\1.rar'
C:\Documents and Settings\Administrator\桌面\1.rar
  [0] Archive type: RAR
  --> 1\Www.CN-Yock.neT.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
      [INFO]      A backup was created as '46e08d11.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

hj5abc

Time Module Object Name Threat Action User Information
2007-6-12 20:19:38 AMON file F:\1\Www.CN-Yock.neT.exe a variant of Win32/Spy.Delf.NEH trojan quarantined - deleted  Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe. The file was moved to quarantine. You may close this window.

1688388728

发表回复

taihuxian

Virus: Trojan-Dropper.Win32.Small.auz

Virus found while downloading Web content.

Address: bbs.kafan.cn

鼻耳盖子

创建者
\WINNT\SYSTEM32\SYSTEN.DLL C:\DOCUMENTS AND SETTINGS\MASTER.MASTE\LOCAL SETTINGS\TEMP\KAV.EXE
\WINNT\403875.DLL C:\DOCUMENTS AND SETTINGS\MASTER.MASTE\LOCAL SETTINGS\TEMP\KAV.EXE
\DOCUMENTS AND SETTINGS\MASTER.MASTE\LOCAL SETTINGS\TEMP\QQWAIGUA.EXE I:\TEST\070612\25\1\1\WWW.CN-YOCK.NET.EXE
\DOCUMENTS AND SETTINGS\MASTER.MASTE\LOCAL SETTINGS\TEMP\KAV.EXE I:\TEST\070612\25\1\1\WWW.CN-YOCK.NET.EXE

yashoo

咖啡无视，上报。。

solcroft