【求助】1201AEC1.EXE是什么病毒删除不了 bbs.ikaka.com

yessky - 2007-5-25 17:02:00

d e f盘都有

[AutoRun]
open=1201AEC1.exe
shell\open=打开(&O)
shell\open\Command=1201AEC1.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=1201AEC1.exe

newcenturymoon - 2007-5-25 17:07:00

样本发送到newcenturymoon1986@yahoo.com.cn 打包加密 123
然后扫描sreng日志上来
下载 System Repair Engineer，
http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改

loveperday - 2007-5-25 17:20:00

我也要一份。
zhangqi802@163.com

yessky - 2007-5-25 18:07:00

用不成扫描工具

加我QQ165378308

yessky - 2007-5-25 18:08:00

冰刃也用不了的。显示不了隐藏文件

newcenturymoon - 2007-5-25 18:10:00

加了

yessky - 2007-5-25 20:28:00

顶啊！

小小企鹅 - 2007-5-25 20:31:00

结果怎么样啊
说出来大家看看啊

gwlucker - 2007-5-25 20:36:00

其实应该尝试改名运行...

yessky - 2007-5-25 22:44:00

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\Windows\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><D:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><%SystemRoot%\system32\logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{1AEC1201-1201-AEC1-01AE-201EC201AEC1}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\1201AEC1.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]

==================================
启动文件夹
N/A

==================================
服务
[卡巴斯基互联网安全套装 6.0 / AVP][Stopped/Disabled]
<D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe -r><Kaspersky Lab>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[WinWMServiceNow / WinWMServiceNow][Stopped/Auto Start]
<C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RAVWM.EXE><N/A>
[Remote Debug Service / RemoteDbg][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe RemoteDbg.dll,input><Microsoft Corporation>
[WinXP DHCP Service / WinXPDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe xpdhcp.dll,input><Microsoft Corporation>

==================================
驱动程序
[AliIde / AliIde][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\aliide.sys><N/A>
[CelInDrv / CelInDrv][Running/Disabled]
<\??\C:\WINDOWS\system32\Drivers\CelInDriver.sys><N/A>
[CmdIde / CmdIde][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[C-Media WDM Audio Interface / cmuda][Running/Manual Start]
<system32\drivers\cmuda.sys><C-Media Inc>
[VIA Rhine Family Fast Ethernet Adapter Driver / FETNDIS][Running/Manual Start]
<system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[ialm / ialm][Running/Manual Start]
<system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]
<system32\DRIVERS\ipinip.sys><N/A>
[kl1 / kl1][Running/Boot Start]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[MegaIDE / MegaIDE][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\D:\Program Files\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[ViaIde / ViaIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Running/Manual Start]
<system32\drivers\ialmsbw.sys><Intel Corporation>
[Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Running/Manual Start]
<system32\drivers\ialmkchw.sys><Intel Corporation>

yessky - 2007-5-25 22:44:00

浏览器加载项
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FLASHGET\jccatch.dll, Amaze Soft>
[Web反病毒保护]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll, Kaspersky Lab>
[JUJU猫]
{6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.jujumao.net, N/A>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, N/A>
[使用网际快车下载]
<C:\PROGRA~1\FLASHGET\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\PROGRA~1\FLASHGET\jc_all.htm, N/A>

==================================
正在运行的进程
[PID: 536][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 612][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 636][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 680][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 692][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 924][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 956][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1124][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1140][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1416][C:\WINDOWS\system32\msdtc.exe] [Microsoft Corporation, 2001.12.4720.0 (srv03_rtm.030324-2048)]
[PID: 2044][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[C:\WINDOWS\system32\RemoteDbg.dll] [N/A, ]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\1201AEC1.dll] [N/A, ]
[PID: 424][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 436][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[C:\WINDOWS\system32\RemoteDbg.dll] [N/A, ]
[PID: 764][C:\WINDOWS\system32\Dfssvc.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[C:\WINDOWS\system32\RemoteDbg.dll] [N/A, ]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, ]
[PID: 416][D:\Program Files\多级式实名核查网吧管理系统收银端\BarServer.exe] [N/A, ]
[D:\Program Files\多级式实名核查网吧管理系统收银端\qtintf.dll] [Borland Software Corporation, 6.0.6.240]
[C:\WINDOWS\system32\RemoteDbg.dll] [N/A, ]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, ]
[D:\Program Files\多级式实名核查网吧管理系统收银端\libmysql.dll] [N/A, ]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\1201AEC1.dll] [N/A, ]
[PID: 420][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[C:\WINDOWS\system32\RemoteDbg.dll] [N/A, ]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, ]
[PID: 1232][D:\Program Files\QQ\QQ.exe] [TENCENT, 0, 0, 0, 0]
[D:\Program Files\QQ\QQBaseClassInDll.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ\QQHelperDll.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ\BasicCtrlDll.dll] [Tencent, 7, 0, 101, 80]
[D:\Program Files\QQ\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[D:\Program Files\QQ\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
[D:\Program Files\QQ\PYKer.dll] [飘云 http://www.pyqq.cn, 飘云]
[D:\Program Files\QQ\ipsearcher.dll] [, 1.0.0.3]
[C:\WINDOWS\system32\RemoteDbg.dll] [N/A, ]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, ]
[D:\Program Files\QQ\RICHED32.DLL] [Microsoft Corporation, 5.00.2134.1]
[D:\Program Files\QQ\RICHED20.dll] [Microsoft Corporation, 5.31.23.1218]
[D:\Program Files\QQ\QQAPI.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[D:\Program Files\QQ\LoginCtrl.dll] [N/A, ]
[D:\Program Files\QQ\npkcntc.dll] [INCA Internet Co., Ltd., 2006, 6, 27, 1]
[D:\Program Files\QQ\npkpdb.dll] [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[D:\Program Files\QQ\LoginCtrlRes.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ\QQRes.dll] [tencent, 1, 0, 0, 1]
[D:\Program Files\QQ\QQMainFrame.dll] [N/A, ]
[D:\Program Files\QQ\CQQApplication.dll] [N/A, ]
[D:\Program Files\QQ\NewSkin.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ\HostingMgr.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ\CameraDll.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ\MailSummary.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ\QQKnowledgeSearch.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ\QQAllInOne.dll] [N/A, ]
[D:\Program Files\QQ\GroupLive.dll] [N/A, ]
[D:\Program Files\QQ\SCCore.dll] [TENCENT, 2, 0, 0, 1]
[D:\Program Files\QQ\gdiplus.dll] [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\Program Files\QQ\QQSpace.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ\vbscript.dll] [Microsoft Corporation, 5.6.0.7426]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Program Files\QQ\QQGroupMng.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ\LongConnection.dll] [tencent, 5, 0, 200, 160]
[D:\Program Files\QQ\QQPlugin.dll] [N/A, ]
[D:\Program Files\QQ\UserDefinedHead.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ\QQConfigPlugin.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\macromed\flash\Flash.ocx] [Macromedia, Inc., 7,0,19,0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[D:\Program Files\QQ\QRingMng.dll] [N/A, ]
[D:\Program Files\QQ\QQCustomFace.dll] [N/A, ]
[D:\Program Files\QQ\QQAvatar.dll] [N/A, ]
[D:\Program Files\QQ\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[D:\Program Files\QQ\PhoneAPI.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[D:\Program Files\QQ\QQPet.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\msadp32.acm] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[D:\Program Files\QQ\BQQApplication.dll] [N/A, ]
[D:\Program Files\QQ\CommercesMng.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
[D:\Program Files\QQ\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 280]
[D:\Program Files\QQ\ImageOle.dll] [TODO: <Company name>, 1.0.0.1]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Program Files\QQ\GroupConnection.dll] [Tencent, 0, 3, 3, 5]
[D:\Program Files\QQ\QQSceneMng.dll] [N/A, ]
[D:\Program Files\QQ\QQPhoneHelper.dll] [腾讯科技（深圳）有限公司, 2, 1, 9, 92]
[D:\Program Files\QQ\QQSysMsgMng.dll] [N/A, ]
[D:\Program Files\QQ\QQZip.dll] [tencent, 0, 3, 2, 4]
[D:\Program Files\QQ\QQMagicFace.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ\OEMApplication.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ\DShared.dll] [Tencent, 1, 6, 0, 0]
[D:\Program Files\QQ\QQFileTransfer.dll] [Tencent, 0, 3, 3, 5]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\1201AEC1.dll] [N/A, ]
[PID: 1340][D:\Program Files\QQ\TIMPlatform.exe] [tencent, 0, 3, 1, 8]
[C:\WINDOWS\system32\RemoteDbg.dll] [N/A, ]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, ]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\1201AEC1.dll] [N/A, ]
[D:\Program Files\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[PID: 1624][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
[C:\WINDOWS\system32\RemoteDbg.dll] [N/A, ]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll] [Kaspersky Lab, 6.0.0.299]
[C:\PROGRA~1\FLASHGET\jccatch.dll] [Amaze Soft, 1, 1, 4, 0]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\1201AEC1.dll] [N/A, ]
[C:\1.com] [Smallfrogs Studio, 2.4.12.806]
[C:\WINDOWS\system32\RemoteDbg.dll] [N/A, ]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, ]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\1201AEC1.dll] [N/A, ]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]

yessky - 2007-5-25 22:45:00

文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[D:\]
[AutoRun]
open=1201AEC1.exe
shell\open=打开(&O)
shell\open\Command=1201AEC1.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=1201AEC1.exe
[E:\]
[AutoRun]
open=1201AEC1.exe
shell\open=打开(&O)
shell\open\Command=1201AEC1.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=1201AEC1.exe
[F:\]
[AutoRun]
open=1201AEC1.exe
shell\open=打开(&O)
shell\open\Command=1201AEC1.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=1201AEC1.exe
[G:\]
[AutoRun]
open=1201AEC1.exe
shell\open=打开(&O)
shell\open\Command=1201AEC1.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=1201AEC1.exe

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7B82B25)
RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7B82D67)
RVA 错误： LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7B82F0B)
RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7B82C49)
RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0xF7B82E8F)

==================================
隐藏进程
N/A

==================================

天月来了 - 2007-5-25 22:48:00

发这个干嘛？

阳光加了你，难道还没搞好？

火影忍者 - 2007-5-25 23:07:00

他想看看别人跟阳光的答案相不相同吧...

不会是信不过阳光吧...

newcenturymoon - 2007-5-25 23:08:00

他电信的现在远程太慢了没法弄了

moneycindy - 2007-5-26 4:42:00

似乎是随机8位数那个垃圾毒。。解决方法在这里http://hi.baidu.com/%B9%C2%B6%C0%B8%FC%BF%C9%BF%BF/blog/item/230a82af1f6619cd7cd92a9d.html

solkjaer - 2007-5-26 9:01:00

橙色八月呵呵

loveperday - 2007-5-26 10:23:00

必须把EXPLORER进程结束掉才能删除这个文件。
通过explorer进行病毒操作，映象劫持~

newcenturymoon - 2007-5-26 10:27:00

病毒已经分析完了正在写分析报告一会发上来

天月来了 - 2007-5-26 10:31:00

呵呵！！

等看。

loveperday - 2007-5-26 10:33:00

昨天晚上领教过了。如果不再TINY设置的话，监控程序都能被他结束掉。恐怖。。。不断下载木马。。

V迅哥V - 2007-5-26 10:43:00

1201AEC1.exe不是病毒，病毒在1201AEC1.exe里面，至于是什么病毒，就不知道了

天月来了 - 2007-5-26 10:54:00

引用:

【V迅哥V的贴子】1201AEC1.exe不是病毒，病毒在1201AEC1.exe里面，至于是什么病毒，就不知道了
………………

这是什么意思？

瑞星卡卡安全论坛