21个，MD5就不扫了，太多了

woai_jolin

2007/6/22 18:16:55        Scanning Log
2007/6/22 18:16:55        Version of virus signature database: 2343 (20070621)
2007/6/22 18:16:55        Date: 22.6.2007  Time: 18:16:55
2007/6/22 18:16:55        Scanned disks, folders and files: D:\病毒\
2007/6/22 18:19:28        Number of scanned files: 31
2007/6/22 18:19:28        Number of threats found: 21
2007/6/22 18:19:28        Time of completion: 18:19:28  Total scanning time: 153 sec (00:02:33)

蓝色牛仔裤

蜘蛛漏两个。。4，6不报。。不过4是死的，所以只漏一个。而且不是报壳～

[Scan path] C:\Documents and Settings\Administrator\桌面\1
>>>C:\Documents and Settings\Administrator\桌面\1\01.exe infected with Trojan.PWS.Qqpass.851
>>>C:\Documents and Settings\Administrator\桌面\1\02.exe infected with Trojan.PWS.Gamania.origin
>>C:\Documents and Settings\Administrator\桌面\1\03.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\Administrator\桌面\1\05.exe\data003 infected with Trojan.Sniff
C:\Documents and Settings\Administrator\桌面\1\05.exe - archive contains infected objects
>>C:\Documents and Settings\Administrator\桌面\1\07.EXE infected with Trojan.Cleaner
>C:\Documents and Settings\Administrator\桌面\1\08.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\Administrator\桌面\1\09.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\Administrator\桌面\1\10.exe infected with Trojan.Sniff
>C:\Documents and Settings\Administrator\桌面\1\11.exe infected with Trojan.Havedo
>>C:\Documents and Settings\Administrator\桌面\1\12.exe probably infected with MULDROP.Trojan
>>>C:\Documents and Settings\Administrator\桌面\1\13.exe infected with Trojan.PWS.Gamania.origin
>C:\Documents and Settings\Administrator\桌面\1\14.exe infected with Trojan.MulDrop.6973
>C:\Documents and Settings\Administrator\桌面\1\15.exe infected with Trojan.Havedo
>C:\Documents and Settings\Administrator\桌面\1\16.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\Administrator\桌面\1\17.exe infected with Trojan.PWS.Wsgame
>>C:\Documents and Settings\Administrator\桌面\1\18.exe probably infected with MULDROP.Trojan
>C:\Documents and Settings\Administrator\桌面\1\19.exe infected with Trojan.PWS.Wsgame
C:\Documents and Settings\Administrator\桌面\1\20.exe infected with BackDoor.Pigeon.36
>>C:\Documents and Settings\Administrator\桌面\1\21.exe infected with Trojan.Addurl
>C:\Documents and Settings\Administrator\桌面\1\22.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\Administrator\桌面\1\23.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\Administrator\桌面\1\24.exe infected with Trojan.PWS.Wsgame
>>C:\Documents and Settings\Administrator\桌面\1\25.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\Administrator\桌面\1\26.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\Administrator\桌面\1\27.exe infected with Trojan.PWS.Wsgame


AVK06。

Giggs

汗..这个东西怎么有这么多报壳的

弄月

26个。。。。

貌似没那么多




[ 本帖最后由 弄月 于 2007-6-22 19:13 编辑 ]

hj5abc

小N拖的好累..  187sec

a256886572008

運行02.exe，發現下列行為，被EQ-Secure RC2攔截！

2007-06-22 20:39:10    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\1绅博周幸\02.exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-22 20:39:10    创建文件      操作:阻止
进程路径:D:\桌面\virus\1绅博周幸\02.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.2dt
规则:所有程序规则->保護安全軟體->C:\Program Files\*


2007-06-22 20:39:10    创建文件      操作:阻止
进程路径:D:\桌面\virus\1绅博周幸\02.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.2dt
规则:所有程序规则->保護安全軟體->C:\Program Files\*


2007-06-22 20:39:10    创建文件      操作:阻止
进程路径:D:\桌面\virus\1绅博周幸\02.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.2dt
规则:所有程序规则->保護安全軟體->C:\Program Files\*


2007-06-22 20:39:10    创建文件      操作:阻止
进程路径:D:\桌面\virus\1绅博周幸\02.exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmt
规则:所有程序规则->保護安全軟體->C:\Program Files\*


2007-06-22 20:39:10    创建注册表值      操作:阻止
进程路径:D:\桌面\virus\1绅博周幸\02.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
注册表名称:{A6011F8F-A7F8-49AA-9ADA-49127D43138F}
规则:所有程序规则->資源管理器->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks*

1.他會在C:\Program Files\Common Files\Microsoft Shared\MSINFO\產生
   system.2dt
   NewInfo.bmt
2.他會创建注册表值
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
   {A6011F8F-A7F8-49AA-9ADA-49127D43138F}

a256886572008

03.exe好像死掉了！

a256886572008

運行05.exe，發現下列行為，被EQ-Secure RC2攔截！

2007-06-22 20:49:40    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\1绅博周幸\05.exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-22 20:49:40    创建文件      操作:阻止
进程路径:D:\桌面\virus\1绅博周幸\05.exe
文件路径:C:\windows\system32\wuclmi.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-22 20:49:40    创建文件      操作:阻止
进程路径:D:\桌面\virus\1绅博周幸\05.exe
文件路径:C:\windows\system32\wincfg.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-22 20:49:40    创建文件      操作:阻止
进程路径:D:\桌面\virus\1绅博周幸\05.exe
文件路径:C:\windows\system32\mvdbc.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe

1.他會在C:\windows\system32\產生
   wuclmi.exe
   wincfg.exe
   mvdbc.exe

a256886572008

06.exe這個檔案破損了！

a256886572008

運行07.EXE，發現下列行為，被EQ-Secure RC2攔截！

2007-06-22 20:55:56    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\1绅博周幸\07.EXE
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-22 20:55:57    删除注册表      操作:阻止
进程路径:D:\桌面\virus\1绅博周幸\07.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
注册表名称:KernelFaultCheck
规则:所有程序规则->系统自动运行->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*


2007-06-22 20:55:57    删除注册表      操作:阻止
进程路径:D:\桌面\virus\1绅博周幸\07.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
注册表名称:SunJavaUpdateSched
规则:所有程序规则->系统自动运行->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*


2007-06-22 20:56:00    结束/挂起进程      操作:阻止
进程路径:D:\桌面\virus\1绅博周幸\07.EXE
目标进程:C:\windows\system32\conime.exe
规则:所有程序规则->*


2007-06-22 20:56:02    结束/挂起进程      操作:阻止
进程路径:D:\桌面\virus\1绅博周幸\07.EXE
目标进程:C:\Program Files\Opera\Opera.exe
规则:所有程序规则->*

1.他會删除注册表
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   KernelFaultCheck
2.他會删除注册表
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   SunJavaUpdateSched
3.他會结束/挂起进程
   C:\windows\system32\conime.exe
4.他會结束/挂起进程
   C:\Program Files\Opera\Opera.exe