[MD5: 28C5E4]Trojan-Clicker.Win32.VB.uc

显示全部楼层 · 发表于 2007-10-20 18:42:09

卡巴新报的病毒Trojan-Clicker.Win32.VB.uc

[ 本帖最后由 caocao 于 2007-10-20 19:24 编辑 ]

显示全部楼层 · 发表于 2007-10-20 18:46:03

RS08报 Trojan.Win32.VB.ynj

显示全部楼层 · 发表于 2007-10-20 18:46:16

费尔 kv2008 都没反应，等待高手吧。

显示全部楼层 · 发表于 2007-10-20 18:49:25

原帖由 dolphin 于 2007-10-20 18:46 发表
RS08报 Trojan.Win32.VB.ynj

江民的病毒库实在太小了

显示全部楼层 · 发表于 2007-10-20 18:52:07

嗯,是病毒,

VB写的,UPX壳

显示全部楼层 · 发表于 2007-10-20 18:53:08

记得是感染性的

显示全部楼层 · 发表于 2007-10-20 18:53:14

新建文件：c:\program files\common files\system\gdiserver.exe
c:\windows\system32\gdisvc.exe

删除文件：c:\file.exe

修改注册表： "isotherad" = -1
\ "hasinstalled" = 0
\ "count" = 0
\ "isotherad" = 0
\ "isdown" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\gdisvc "update" = 10/19/2007 6:51:05 AM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\gdisvc "newver" = no
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\gdisvc "monver" = 1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\gdisvc "bakver" = 1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\gdisvc "plugins" =
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\gdisvc "hosts" =
\ "Description" = Provider Support for Windows Graphics Device
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\gdisvc "isotherad" = -1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\gdisvc "hasinstalled" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\gdisvc "count" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\gdisvc "isdown" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\gdisvc "plugins" =
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\gdisvc "hosts" =
\ "Description" = Provider Support for Windows Graphics Device
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "gdisvc" = c:\program files\common files\system\gdiServer.exe

显示全部楼层 · 发表于 2007-10-20 18:55:15

system32目录创建gdisvc 添加服务gdi server

显示全部楼层 · 发表于 2007-10-20 18:55:25

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Deepin\桌面\样本.rar'
C:\Documents and Settings\Deepin\桌面\样本.rar
  [0] Archive type: RAR
  --> hfldr131b.exe
   [DETECTION] Contains suspicious code HEUR/Crypted
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-10-20 18:56:06

原帖由 <i>kk12</i> 于 2007-10-20 18:46 发表 <a href="http://bbs.kafan.cn/redirect.php?goto=findpost&pid=1922939&ptid=146033" target="_blank"><img src="http://bbs.kafan.cn/images/common/back.gif" border="0" onclick="zoom(this)" onload="attachimg(this, 'load')" alt="" /></a><br />
费尔 kv2008 都没反应，等待高手吧。

<br />

[病毒样本] [MD5: 28C5E4]Trojan-Clicker.Win32.VB.uc

本帖子中包含更多资源

NOD32 MISS

浏览过的版块