CuteK 发表于 2009-8-2 11:13

专杀4 dnf盗号木马



运行 1005.exe后推出 大约一分钟后开始下载执行病毒

认领: 无

CuteK 发表于 2009-8-2 11:18

1# CuteK

http://xiqiji2***.cn/cj/lc.exe 病毒名:Trojan/Win32.Agent.cjxa
病毒描述:Nullsoft PiMP Stub * 自解压格式包裹文件
衍生文件:
c:\WINDOWS\system32\mtlrd.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\Media Player\wmp\mtlrd.sys
c:\Documents and Settings\All Users\Application Data\Microsoft\Outlook Express\2301.exe
c:\Documents and Settings\a\Local Settings\Temp\nsf4.tmp
c:\Documents and Settings\a\Local Settings\Temp\nsf5.tmp\System.dll
c:\Documents and Settings\a\Local Settings\Temp\nsf5.tmp\SimpleSC.dll
c:\Documents and Settings\a\Local Settings\History\History.IE5\index.dat
c:\Program Files\Microsoft Office\SYSTEM\sysbar.exe
页: [1]
查看完整版本: 专杀4 dnf盗号木马