2

ck893210

....

qigang

有问题吗？

saga3721

svchost.exe
      [DETECTION] Is the Trojan horse TR/Agent.5632.109
      [INFO]      The file was moved to '47e11c75.qua'!

systime.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '47f11ca2.qua'!

Joker

C:\Documents and Settings\Administrator\桌面\systime.rar » RAR » systime.exe - a variant of Win32/Small.NBE worm

无尽藏海

蜘蛛

zwl2828

svchost.rar未报

svchost.rar分析
00003000   00403000      0   c:\Program1\Get\svchost.exe
00003104   00403104      0   c:\program1
00003208   00403208      0   c:\program1\Get
0000330C   0040330C      0   c:\dell.bat
00003318   00403318      0    del %0
00003320   00403320      0   " goto try
00003330   00403330      0   if exist "
0000335C   0040335C      0   c:\del.bat
00003368   00403368      0   del %0
00003374   00403374      0   start
0000337C   0040337C      0    if exist "
00003388   00403388      0   \drivers\klif.sys
0000339C   0040339C      0   Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run
000033E0   004033E0      0   c:\Program1\Get\svchost
000033F8   004033F8      0   starhook
00003404   00403404      0   c:\program1\Get\hook.dll

[ 本帖最后由 zwl2828 于 2008-1-4 21:22 编辑 ]

wangjay1980

Hello,

svchost.exe_ - Trojan-Spy.Win32.Tiny.d,
systime.exe_ - Worm.Win32.AutoRun.blv

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Goncharov Ilya
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: svchost.rar
> Attachment: systime.rar

傻猪猪米走鸡

Scan Log
Version of virus signature database: 2765 (20080104)
Date: 2008-1-4  Time: 21:37:11
Scanned disks, folders and files: D:\firefox download\svchost.rar;D:\firefox download\systime.rar
D:\firefox download\svchost.rar » RAR » svchost.exe » UPX v12_m2 - is OK
D:\firefox download\systime.rar » RAR » systime.exe - a variant of Win32/Small.NBE worm
Number of scanned objects: 2
Number of threats found: 1
Time of completion: 21:37:15  Total scanning time: 4 sec (00:00:04)

promised

C:\ABC\svchost.rar:\svchost.exe - 特征码 'Win32.SuspectCrc' 被发现
C:\ABC\svchost.rar
C:\ABC\systime.rar:\systime.exe - 特征码 'Win32.SuspectCrc' 被发现
C:\ABC\systime.rar

promised

C:\ABC\svchost.rar
        C:\ABC\svchost.rar\svchost.exe
        C:\ABC\svchost.rar\svchost.exe\FILE:0000
>>> Virus 'Mal/Heuri-E' found in file C:\ABC\svchost.rar\svchost.exe\FILE:0000
>>> File "C:\ABC\svchost.rar\svchost.exe" has been identified as suspicious 'Sus/Malware-B'.
        C:\ABC\systime.rar
        C:\ABC\systime.rar\systime.exe
>>> Virus 'Mal/Packer' found in file C:\ABC\systime.rar\systime.exe