1

sam.to

上报卡巴

Hello,

driver.exe_ - Worm.Win32.AutoRun.dhk

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Kirill Erakhtin
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-4-10 12:51 编辑 ]

solcroft

挪威的冬天

信息        2008-04-09  12:24:00        您此次查毒清除了1个病毒                       
信息        2008-04-09  12:24:00        您此次查毒共查出1个病毒以及危险代码                       
信息        2008-04-09  12:24:00        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件2个                       
信息        2008-04-09  12:24:00        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-04-09  12:24:00        D:\Desktop\driver.rar\driver\driver.exe2        Win32.Troj.Agent.ra.36864        清除成功

mofunzone

antivir pass

gaojun7206

C:\Documents and Settings\Jean\桌面\HERO\Test\driver.rar>>driver\driver.exe2        W32.SillyDC.fpdm        病毒        还未处理

Palkia

C:\Documents and Settings\Administrator\桌面\driver.rar>>driver\driver.exe2        W32.SillyDC.fpdm        病毒        还未处理

无尽藏海

ESET PASS

yjwfn502

上报江民

The file 'driver.exe2' has been determined to be 'MALWARE'. Our analysts named the threat TR/Agent.36864.T. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

ranguangning

【1】父级进程：
   路径： F:\Users\123\Desktop\driver\driver.exe
   PID: 1456
子级进程：
   路径： F:\Windows\explorer.exe
   信息： Windows Explorer (Microsoft Corporation)
   命令行：Explorer F:


【2】在我的C盘和D盘下生成大小为36KB的同名文件,名字为DRIVE.EXE


【3】运行生成物动作一样。