一个，和它的生成物[MD5: AAEA37 6AA185]

woai_jolin

2007/6/23 14:19:09        Scanning Log
2007/6/23 14:19:09        Version of virus signature database: 2346 (20070622)
2007/6/23 14:19:09        Date: 23.6.2007  Time: 14:19:09
2007/6/23 14:19:09        Scanned disks, folders and files: D:\病毒\
2007/6/23 14:19:12        D:\病毒\virus.rar - probably a variant of Win32/PSW.QQShou trojan - deleted - quarantined
2007/6/23 14:19:12        D:\病毒\virus.rar » RAR » 520[1].exe - probably a variant of Win32/PSW.QQShou trojan
2007/6/23 14:19:12        Number of scanned files: 3
2007/6/23 14:19:12        Number of threats found: 1
2007/6/23 14:19:12        Time of completion: 14:19:12  Total scanning time: 3 sec (00:00:03)

samancy

a256886572008

運行520[1].exe，發現下列行為，被EQ-Scure RC2攔截！

2007-06-23 16:56:17    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\AAEA37virus\520[1].exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-23 16:56:18    创建文件      操作:阻止
进程路径:D:\桌面\virus\AAEA37virus\520[1].exe
文件路径:C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysWFGwd2.dll
规则:所有程序规则->保護安全軟體->C:\Program Files\*


2007-06-23 16:56:18    创建文件      操作:阻止
进程路径:D:\桌面\virus\AAEA37virus\520[1].exe
文件路径:D:\桌面\virus\AAEA37virus\_xr.bat
规则:所有程序规则->2.1.5组：限制部份高危格式文件和文件夹的操作->*.bat

1.他會在C:\Program Files\Common Files\Microsoft Shared\MSINFO\產生
   SysWFGwd2.dll
2.他會在他旁邊產生_xr.bat

蓝色牛仔裤

蜘蛛挂了

taihuxian

Virus: Trojan-Spy.Win32.Delf.uh (2x)

Virus found while downloading Web content.

Address: bbs.kafan.cn