[病毒样本] 1

显示全部楼层 · 发表于 2008-2-29 10:18:50

Begin scan in 'D:\BOOK\sta.rar'
D:\BOOK\sta.rar
  [0] Archive type: RAR
  --> sta.exe
   [DETECTION] Contains detection pattern of the rootkit RKIT/HideProcess.B
   [WARNING] The file was ignored!

显示全部楼层 · 发表于 2008-2-29 10:33:17

发现未知木马，是否删除？
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.641\STA.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ALL USERS\「开始」菜单\程序\启动\ATISRV.EXE
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\USBCAMS3.SYS
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2008-2-29 11:10:57

v8 beta5
Begin scan in 'C:\Documents and Settings\haha\桌面\sta.rar'
C:\Documents and Settings\haha\桌面\sta.rar
  [0] Archive type: RAR
--> sta.exe
      [DETECTION] Contains detection pattern of the rootkit RKIT/HideProcess.B
   [INFO]    A backup was created as '48287842.qua'  ( QUARANTINE )

显示全部楼层 · 发表于 2008-2-29 11:34:20

EAV过

显示全部楼层 · 发表于 2008-2-29 11:42:12

显示全部楼层 · 发表于 2008-2-29 12:47:52

上报卡巴

显示全部楼层 · 发表于 2008-2-29 13:15:26

Hello,

adv579.exed - Trojan-Downloader.Win32.Small.itf,
dodolook446.exed - Trojan-Downloader.Win32.Small.itg,
my_70229.exed - Trojan-Downloader.Win32.QQHelper.aoe,
sta.exed - Trojan-PSW.Win32.OnLineGames.sgz

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Feb2008.exed, Feb2008.ini

No malicious code were found in these files.

Please quote all when answering.

--
Best regards, Denis Maslennikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

显示全部楼层 · 发表于 2008-2-29 16:25:50

Roboon：已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.sgz 文件: D:\Documents\桌面\sta.rar/sta.exe//PE_Patch//UPack

显示全部楼层 · 发表于 2008-2-29 17:59:03

D:\download\sta.rar>>sta.exe Heuri.Suspicious.ERNM 启发式扫描还未处理

[病毒样本] 1

本帖子中包含更多资源

本帖子中包含更多资源