carinho.scr [md5:8c9a89]

显示全部楼层 · 发表于 2008-4-18 13:49:30

File:	carinho.scr
Status:	INFECTED/MALWARE
MD5:	8c9a8991d25157dc2c9ca39b23b5277d
Packers detected:	PKLITE32
Bit9 reports:	File not found

Scanner results
Scan taken on 18 Apr 2008 05:45:22 (GMT)
A-Squared	Found nothing
AntiVir	Found TR/Spy.Banker.Gen
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found PSW.Banker4.ZWM
BitDefender	Found nothing
ClamAV	Found nothing
CPsecure	Found Troj.Spy.W32.Banker.gyj
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Ikarus	Found Trojan-Proxy.Win32.Delf.av
Kaspersky Anti-Virus	Found nothing
NOD32	Found nothing
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Sophos Antivirus	Found Mal/Generic-A
VirusBuster	Found nothing
VBA32	Found Trojan-Spy.xBank.52 (probable variant)

显示全部楼层 · 发表于 2008-4-18 13:58:29

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
C:\Arquivos de programas\csrss.exe
C:\Windows\System32\svchosts.exe
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\csrss.exe
C:\Arquivos de programas\csrss.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\svchosts.exe
carinho.scr访问网络www.showflamenco.com.ar
HKLM\SYSTEM\CURRENTCONTROLSET\Control\Session Manager\PendingFileRenameOperations
绝对是病毒啊

显示全部楼层 · 发表于 2008-4-18 14:04:27

显示全部楼层 · 发表于 2008-4-18 20:59:10

Hello.
Trojan-Spy.Win32.Banker.lpr
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.
-----------------
Regards, Yury Nesmachny
Virus Analyst, Kaspersky Lab.

Ph.: +7(495) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

> Attachment: carinho.zip
[:1:]

显示全部楼层 · 发表于 2008-4-18 21:09:10

[Found possible virus] <W32/Trojan-juke-based!Maximus> C:\Test\carinho.scr->(PKLite32)

显示全部楼层 · 发表于 2008-4-18 21:13:49

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.KAFAN\桌面\CARINHO.SCR
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\SVCHOSTS.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2008-4-18 21:15:02

McAfee PWS-Banker.gen.i

显示全部楼层 · 发表于 2008-4-18 22:46:59

rising20.40.42未杀！

[病毒样本] carinho.scr [md5:8c9a89]

本帖子中包含更多资源

实在太大了，不想下，不过现在没毒扫，还是忍不住下了

2/0