[MD5: 28C5E4]Trojan-Clicker.Win32.VB.uc

平淡

原帖由 <i>kk12</i> 于 2007-10-20 18:46 发表 <a href="http://bbs.kafan.cn/redirect.php?goto=findpost&pid=1922939&ptid=146033" target="_blank"><img src="http://bbs.kafan.cn/images/common/back.gif" border="0"   alt="" /></a><br />
费尔 kv2008 都没反应，等待高手吧。

<br />


我的费尔报壳

promised

这段后来应该就是访问物理内存感染exe了
0040141C   DD hfldr131.00405C2C                      UNICODE "SYSTEM\CurrentControlSet\Services"
00401420   DD hfldr131.00405C18                      UNICODE "Nothing"
00401424   DD hfldr131.00405C00                      UNICODE "ImagePath"
00401500   DD hfldr131.00405C74                      UNICODE "CURRENT_USER"
00401508   DD hfldr131.00402928                      UNICODE "( "
00401518   DD hfldr131.00405C9C                      UNICODE "\Device\PhysicalMemory"
004015F8   ASCII "XO$",0
00401674   DD hfldr131.004056F4                      ASCII "Form"
0040177D   ASCII "[email=.@].@",0[/email]
004018CC   DD hfldr131.00405BBC                      UNICODE "00"
004018EC   DD hfldr131.00405BEC                      UNICODE "\\"
004019E5   ASCII "x\",0
004019E8   UNICODE "GdiSvc\g"
004019F8   UNICODE "disvc.vB"
00401A08   UNICODE "p",0
00401C3C   DD hfldr131.00402C60                      UNICODE ".exe"

caocao

谢谢大家，已经上报卡巴了，正在等待结果。

caocao

Hello,

hfldr131b.exe - Trojan-Clicker.Win32.VB.uc

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.VB.ynj      

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.14.52

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 647
Paranoia Database - 48016
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\hfldr131b.exe

C:\Documents and Settings\uhthn\Desktop\hfldr131b.exe - Suspected MalwareDetector:Generic.PSW.1

1 Files scanned
0 Infected files found
1 Suspected files found
0 Files cured
0 Files deleted

微点卫士

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\HFLDR131B.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\COMMON FILES\SYSTEM\GDISERVER.EXE
2) C:\WINDOWS\SYSTEM32\GDISVC.EXE
是否删除木马程序及其衍生物?