一记事本..

Whkroran

Hello.
New malicious software was found in the attached file.
Trojan-Downloader.Win32.Small.evq
It's detection will be included in the next update. Thank you for your help.
-----------------
Regards, Vladimir Krylov
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com


> Attachment: readme.rar

>   hello, new virus !

a256886572008

運行readme.exe，發現下列行為，被EQ-Secure RC3攔截！

2007-06-28 22:52:37    運行應用程序      操作:允許
進程路徑:C:\windows\Explorer.EXE
文件路徑:D:\桌面\virus\readme\readme.exe
規則:應用程序規則->系統程序->%windir%\Explorer.EXE


2007-06-28 22:52:37    修改文件      操作:阻止
進程路徑:D:\桌面\virus\readme\readme.exe
文件路徑:C:\Documents and Settings
規則:所有程序規則->2.1.3组：保護部分重要的文件和文件夾->%SystemDrive%\*


2007-06-28 22:52:37    修改文件      操作:阻止
進程路徑:D:\桌面\virus\readme\readme.exe
文件路徑:C:\Documents and Settings\Hung  Jui Hung
規則:所有程序規則->2.1.3组：保護部分重要的文件和文件夾->%SystemDrive%\*


2007-06-28 22:52:37    修改文件      操作:阻止
進程路徑:D:\桌面\virus\readme\readme.exe
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Local Settings
規則:所有程序規則->2.1.3组：保護部分重要的文件和文件夾->%SystemDrive%\*


2007-06-28 22:52:37    修改文件      操作:阻止
進程路徑:D:\桌面\virus\readme\readme.exe
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Local Settings\Temp
規則:所有程序規則->2.1.3组：保護部分重要的文件和文件夾->%SystemDrive%\*


2007-06-28 22:52:37    創建文件      操作:阻止
進程路徑:D:\桌面\virus\readme\readme.exe
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Local Settings\Temp\bind_50061.exe
規則:所有程序規則->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-28 22:52:37    創建文件      操作:阻止
進程路徑:D:\桌面\virus\readme\readme.exe
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Local Settings\Temp\my_70026.exe
規則:所有程序規則->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe

1.他會在C:\Documents and Settings\Hung  Jui Hung\Local Settings\Temp\生成
   bind_50061.exe
   my_70026.exe

mofunzone

antivir不支持nsis真无奈
运行后全部斩杀
上报了

wangjay1980

detected: Trojan program Trojan-Downloader.Win32.Small.evq        URL: http://bbs.kafan.cn/attachment.p ... e//stream//data0001

kumagaya

红伞不理.

tracydk

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00055236.




We received the following archive files:


File ID  Filename  Size (Byte) Result
1005767  readme.rar 26.99 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename  Size (Byte) Result
1005768  readme.exe  44.75 KB  MALWARE


Please find a detailed report concerning each individual sample below:

Filename Result  readme.exe  MALWARE

The file 'readme.exe' has been determined to be 'MALWARE'. Virus name is DROPPER (en) Detection will be added to our virus definition file (VDF) with one of the next updates.

tracydk

红伞的入库速度还是没卡巴快啊,卡巴那个叫BT

sjducker

哈哈
FS7.0发飙了

[ 本帖最后由 sjducker 于 2007-6-29 18:47 编辑 ]