一个不知名文件,8家报毒(10楼有衍生物)

显示全部楼层 · 发表于 2008-2-4 14:08:11

http://virscan.org/report/1e6772b57c2809aec1af3571d6c2cdf4.html

上报給卡巴

有可疑的行为

Hello,

Finish10.exe_ - Trojan-Proxy.Win32.VB.ac

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Lebedev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-2-5 23:33 编辑 ]

显示全部楼层 · 发表于 2008-2-4 14:11:34

有没有知道这个软件会有什么破坏??

显示全部楼层 · 发表于 2008-2-4 14:11:42

Begin scan in 'C:\Documents and Settings\Administrator\桌面\Finish10.rar'
C:\Documents and Settings\Administrator\桌面\Finish10.rar
  [0] Archive type: RAR
  --> Finish10.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [WARNING] The file was ignored!

End of the scan: 2008年2月4日  14:11
Used time: 00:07 min

The scan has been done completely.

   0 Scanning directories
   2 Files were scanned
   1 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-4 14:12:21

大蜘蛛不报

显示全部楼层 · 发表于 2008-2-4 14:15:35

已经不用看了，标准的远程控制程序

显示全部楼层 · 发表于 2008-2-4 14:18:01

如何看到？？

显示全部楼层 · 发表于 2008-2-4 14:21:21

费尔扫描木马一个

显示全部楼层 · 发表于 2008-2-4 14:22:51

大概是添加启动项再出站吧，微点也杀了。
程序:
C:\DOCUMENTS AND SETTINGS\X\桌面\FINISH10.EXE
木马程序生成以下文件:
1) C:\FINAL.EXE
2) C:\WINDOWS\SYSTEM32\NVSWC32.EXE
3) C:\PROGRAM FILES\HIJACKTHIS.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2008-2-4 14:25:05

真的有衍生物

要去刪除

显示全部楼层 · 发表于 2008-2-4 14:33:17

上报衍生物

衍生物:

[病毒样本] 一个不知名文件,8家报毒(10楼有衍生物)

本帖子中包含更多资源

回复 5楼 mofunzone 的帖子

回复 8楼 saga3721 的帖子

本帖子中包含更多资源

浏览过的版块