又是盗QQ的[MD5: 10C7BB]

promised

woai_jolin

2007/6/23 14:48:46        Scanning Log
2007/6/23 14:48:46        Version of virus signature database: 2346 (20070622)
2007/6/23 14:48:46        Date: 23.6.2007  Time: 14:48:46
2007/6/23 14:48:46        Scanned disks, folders and files: D:\病毒\
2007/6/23 14:48:46        D:\病毒\样本.rar - probably a variant of Win32/Genetik trojan - deleted - quarantined
2007/6/23 14:48:46        D:\病毒\样本.rar » RAR » QQ98.exe - probably a variant of Win32/Genetik trojan
2007/6/23 14:48:47        Number of scanned files: 2
2007/6/23 14:48:47        Number of threats found: 1
2007/6/23 14:48:47        Time of completion: 14:48:47  Total scanning time: 1 sec (00:00:01)

The EQs

Scan performed at: 2007-6-23 15:00:03
Scanning Log
NOD32 version 2346 (20070622) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本.rar
Operating memory - is OK

Date: 23.6.2007  Time: 15:00:07
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本.rar
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?QQ98.exe - probably a variant of Win32/Genetik trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 15:00:07 Total scanning time: 0 sec (00:00:00)

aerbeisi

一点即报，俗称点报。
The requested URL http://bbs.kafan.cn/attachment.php?aid=91795 is infected with Trojan-PSW.Win32.QQPass.fc virus

欠妳緈諨

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\样本.rar'
C:\Documents and Settings\Administrator\My Documents\
  样本.rar
    [0] Archive type: RAR
    --> QQ98.exe
        [DETECTION] Is the Trojan horse TR/PSW.QQPass.FC
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

yzt1004

我这个是下载完毕，解压，打开文件夹才报~

aerbeisi

打了几个字，慢了。在55分时，同时4个人发帖！

a256886572008

運行QQ98.exe，發現下列行為，被EQ-Secure RC2攔截！

2007-06-23 15:43:14    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\10C7BB\QQ98.exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-23 15:43:14    创建文件      操作:阻止
进程路径:D:\桌面\virus\10C7BB\QQ98.exe
文件路径:C:\windows\system32\svchoxt.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-23 15:43:14    创建文件      操作:阻止
进程路径:D:\桌面\virus\10C7BB\QQ98.exe
文件路径:C:\windows\system32\svchoxt.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-23 15:43:14    创建文件      操作:阻止
进程路径:D:\桌面\virus\10C7BB\QQ98.exe
文件路径:C:\windows\system32\svchoxt.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-23 15:43:14    运行应用程序      操作:阻止
进程路径:D:\桌面\virus\10C7BB\QQ98.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Local Settings\Temp\exe160.tmp
命令行:160 D:\桌面\virus\10C7BB\QQ98.exe
规则:黑名单->2.1组：禁止从Temp文件夹运行程序->*\*temp*\*

1.他會在C:\windows\system32\產生
   svchoxt.exe
2.他會运行exe160.tmp
   160 D:\桌面\virus\10C7BB\QQ98.exe

samancy

不多说了!