[病毒样本] 2

显示全部楼层 · 发表于 2008-3-24 19:44:57

Hello,

gdisvc.jpg_ - Trojan-Clicker.Win32.VB.ajo,
top.jpg_ - Trojan.Win32.Agent.gjz

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Yury Nesmachny
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

显示全部楼层 · 发表于 2008-3-24 19:50:00

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\2.rar'
C:\Documents and Settings\Administrator\桌面\2.rar
  [0] Archive type: RAR
  --> 2\gdisvc.jpg
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 2\top.jpg
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-3-24 20:23:04

detected: Trojan program Trojan-Clicker.Win32.VB.ajo _Patch.UPX//UPX

显示全部楼层 · 发表于 2008-3-24 20:24:23

-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.4.2
Virus signature file from: 2008-3-24, 3:30

Scan name: Virus Tester
Path to scan: C:\Documents and Settings\All Users\Documents\Test\|

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2008-3-24, 20:23:50
---------------------------------------------------------------------
[Found possible virus] <W32/VB-Wird-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\2.rar->2\gdisvc.jpg->(UPX)
---------------------------------------------------------------------
Scan ended: 2008-3-24, 20:23:53
Duration: 0:00:02

Scan result:

Scanned files:    6
Infected objects:    1
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-3-24 20:24:41

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.VB.zqa

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.37.02

显示全部楼层 · 发表于 2008-3-24 20:42:13

发现网络蠕虫:Worm.Win32.Small.um
程序:
C:\DOCUMENTS AND SETTINGS\NEW\桌面\2\TOP.JPG

GDISVC.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\COMMON FILES\SYSTEM\NTSERV.EXE
2) C:\WINDOWS\SYSTEM32\COM\CSRSS.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2008-3-24 21:42:19

D:\firefox download\2.rar > RAR > 2\gdisvc.jpg - Win32/TrojanClicker.VB.YS 特洛伊木马的变种
D:\firefox download\2.rar > RAR > 2\top.jpg - Win32/TrojanClicker.Agent.NCS 特洛伊木马的变种
D:\firefox download\2.rar:Zone.Identifier - 正常

显示全部楼层 · 发表于 2008-3-25 09:04:21

Virus: Trojan-Clicker.Win32.VB.ajo, Trojan.Win32.Agent.gjz

显示全部楼层 · 发表于 2008-3-25 09:23:13

BD 飘

显示全部楼层 · 发表于 2008-3-25 11:39:50

ess扫描日志
病毒库版本: 2969 (20080324)
日期: 2008-3-25 时间: 11:43:55
已扫描的磁盘、文件夹和文件: D:\Documents and Settings\xx\桌面\2.rar
D:\Documents and Settings\xx\桌面\2.rar > RAR > 2\gdisvc.jpg - Win32/TrojanClicker.VB.YS 特洛伊木马的变种
D:\Documents and Settings\xx\桌面\2.rar > RAR > 2\top.jpg - Win32/TrojanClicker.Agent.NCS 特洛伊木马的变种
已扫描的对象数: 2
发现的威胁数: 2
完成时间: 11:43:56 总扫描时间: 1 秒 (00:00:01)

[病毒样本] 2

本帖子中包含更多资源

4/1