1(卡巴报变种)

sam.to

Hello.
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.
-----------------
Regards, Namestnikov Yury
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com



卡巴报变种,上报

[ 本帖最后由 kato9096 于 2008-1-7 22:47 编辑 ]

qigang

Rising20.26.02未杀一个。

Palkia

C:\Documents and Settings\Administrator\桌面\1.rar>>1.exe>>knlps.exe        Virtool.Knlps.a        黑客工具        还未处理
C:\Documents and Settings\Administrator\桌面\1.rar>>1.exe>>knlps.sys        Virtool.Knlps.b        黑客工具        还未处理

哈哈~

Graybird

Starting the file scan:

Begin scan in 'E:\1.rar'
E:\1.rar
  [0] Archive type: RAR
    --> 1.exe
      [1] Archive type: RAR SFX (self extracting)
      --> knlps.exe
          [DETECTION] Contains detection pattern of the SPR/Tool.ProcKill.KernelPS.0.4 program
      --> knlps.sys
          [DETECTION] Contains detection pattern of the application APPL/Killapp
      --> 2008.exe
          [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [WARNING]   The file was ignored!

Nblock

Backdoor.Win32.GreyPigeon.fff
2008.exe

无尽藏海

D:\Downloads\样本\1(9).rar=>1.exe=>(RAR Sfx o)=>knlps.exe        发现: Application.Prockill.Knlkillp.D
D:\Downloads\样本\1(9).rar=>1.exe=>(RAR Sfx o)=>knlps.sys        发现: Application.Prockill.Knlkillp.B
D:\Downloads\样本\1(9).rar=>1.exe=>(RAR Sfx o)=>rxkb.bat        感染: BAT.Ebles.A
D:\Downloads\样本\1(9).rar=>1.exe=>(RAR Sfx o)=>2008.exe        感染: GenPack:Generic.Graybird.021ACDFE

鱼是一只我

江民报huigezi

红心王子

里面的东西真是不少

2008-1-7        20:17:02        1199708222        Administrator        1760        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\Administrator\桌面\1.rar\1.exe\knlps.exe" file.  
2008-1-7        20:17:05        1199708225        Administrator        1760        Sign of "BV:KillAV-U [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\1.rar\1.exe\rxkb.bat" file.  
2008-1-7        20:17:09        1199708229        Administrator        1760        Sign of "Win32:RPoly [Cryp]" has been found in "C:\Documents and Settings\Administrator\桌面\1.rar\1.exe\2008.exe" file.

BING126

McAfee 个人版启发报了  New Malware.bx

1688388728

D:\1\1.rar\1.exe\knlps.exe - is a HackTool program Tool.KnlKillp
D:\1\1.rar\1.exe\knlps.sys - is a HackTool program Tool.KnlKillp

Archive contains 2 infected items