1.exe

显示全部楼层 · 发表于 2011-4-17 10:25:43

本帖最后由 fatezero 于 2011-4-17 10:25 编辑

7/ 42 (16.7%)

显示全部楼层 · 发表于 2011-4-17 10:29:59

2011-04-17 10:26:23 修改注册表内容操作:阻止
进程路径:C:\WINDOWS\system32\spoolsv.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Providers
注册表名称:Order
更改后:LanMan Print Services
触发规则:应用程序规则->系统程序->%windir%\system32\spoolsv.exe->HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Providers

2011-04-17 10:26:42 修改注册表内容操作:阻止
进程路径:C:\WINDOWS\system32\spoolsv.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Providers
注册表名称:Order
更改后:LanMan Print Services
触发规则:应用程序规则->系统程序->%windir%\system32\spoolsv.exe->HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Providers

显示全部楼层 · 发表于 2011-4-17 10:31:09

ess kill

D:\下载文件夹\1.rar > RAR > 1.exe - Win32/Kryptik.MRW 特洛伊木马的变种

显示全部楼层 · 发表于 2011-4-17 10:32:08

BitDefender
1.exe Trojan.Generic.KD.192239

显示全部楼层 · 发表于 2011-4-17 10:33:09

to avg

显示全部楼层 · 发表于 2011-4-17 10:40:29

2011-04-17 10:38:01 修改文件阻止并结束进程
进程: h:\program files\avp\1.exe
目标: H:\Program Files\AVP\1.exe
规则: [应用程序组]●【通用】PF组(禁放程序) -> [文件组][FD_03]防自杀(秒杀)

显示全部楼层 · 发表于 2011-4-17 11:06:00

360wd kill
to mse

显示全部楼层 · 发表于 2011-4-17 11:07:52

金山网盾正在云游中

小红伞
Start of the scan: 2011年4月17日  11:04

Starting the file scan:

Begin scan in 'C:\Users\\Desktop\1.rar'
C:\Users\\Desktop\1.rar
[0] Archive type: RAR
  [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
  --> 1.exe
  [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

Beginning disinfection:
C:\Users\\Desktop\1.rar
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE]    The file was deleted!

End of the scan: 2011年4月17日  11:04
Used time: 00:00 Minute(s)

The scan has been done completely.

   0 Scanned directories
   3 Files were scanned
   1 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   1 files were deleted
   0 Viruses and unwanted programs were repaired
   0 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2011-4-17 11:08:04

大蜘蛛clean，文件已加壳：
1.exe packed by FLY-CODE
已上报！

显示全部楼层 · 发表于 2011-4-17 11:08:30

金山网盾云游回来说安全，真快啊，呵呵

[病毒样本] 1.exe

本帖子中包含更多资源