6c78c8 一个

virus007

~~

The EQs

Scan performed at: 2007-6-18 16:39:49
Scanning Log
NOD32 version 2335 (20070616) NT
Command line: C:\Documents and Settings\EQ2\桌面\alexa[1].rar
Operating memory - is OK

Date: 18.6.2007  Time: 16:39:54
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\alexa[1].rar
C:\Documents and Settings\EQ2\桌面\alexa[1].rar ?RAR ?alexa[1].exe - a variant of Win32/PSW.Delf.NHI trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 16:39:54 Total scanning time: 0 sec (00:00:00)

dyw1021

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\alexa[1].rar'
C:\Documents and Settings\Administrator\My Documents\
  alexa[1].rar
    [0] Archive type: RAR
    --> alexa[1].exe
        [DETECTION] Contains signature of the dropper DR/Delphi.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

eubyo

进程试图注入模块C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmt 到所有进程。

eubyo

进程试图更改 创建 这个在注册表中属于组 System Startup.这些键值是用来管理系统启动时执行哪些程序的。

建议您仔细确认这些键值，确保只有经过您允许的程序才能在系统启动时被执行，而其它程序不能在系统启动时被执行。

键值: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

值: {A6011F8F-A7F8-49AA-9ADA-49127D43138F}

看来不是什么好东东

[ 本帖最后由 eubyo 于 2007-6-18 16:46 编辑 ]

yashoo

咖啡杀

taihuxian

2007-6-18,17:52:16 [WARNING] Contains signature of the dropper DR/Delphi.Gen!
  C:\WINDOWS\Temp\_avast4_\unp148137018.tmp
      [INFO] No action will be taken on the file.

promised

?           Copyright (c) 1993-2007 by VBA Ltd.            ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯?
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /af+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Ctrl-C will terminate program execution

*:
C:\
C:\ABC\alexa[1].rar:<RAR>\alexa[1].exe : infected MalwareScope.Trojan-PSW.Game.7
Program execution terminated by user


Directories       : 3       Files in archives:      Files on disks:
Archives:                   - total       : 1       - total       : 21
- scanned         : 1       -  scanned    : 1       - scanned     : 21
- contain viruses : 1       -  infected   : 1       - infected    : 1
- deleted         : 0       -  suspicious : 0       - suspicious  : 0

Startup    : 18:16:33 18-06-2007
End        : 18:16:36 18-06-2007
Total time : 00:00:03
终止批处理操作吗(Y/N)?

Whkroran

卡7 启发报下载者
The requested URL http://bbs.kafan.cn/attachment.php?aid=88899 is infected with Downloader virus