002.jpg [md5:256de1]

mofunzone

拿什么拯救你，我的very bullshit

File:	002.jpg
Status:	INFECTED/MALWARE
MD5:	256de1f3da2147284b345fc039d2e19e
Packers detected:	-
Scanner results
Scan taken on 25 May 2008 01:01:58 (GMT)
A-Squared	Found  nothing
AntiVir	Found TR/Spy.Banker.Gen
ArcaVir	Found  nothing
Avast	Found  nothing
AVG Antivirus	Found PSW.Banker4.AFKW
BitDefender	Found  nothing
ClamAV	Found  nothing
CPsecure	Found  nothing
Dr.Web	Found  nothing
F-Prot Antivirus	Found  nothing
F-Secure Anti-Virus	Found  nothing
Fortinet	Found Banker.CG!tr.pws
Ikarus	Found Trojan-Spy.Win32.Banker.FO
Kaspersky Anti-Virus	Found  nothing
NOD32	Found  nothing
Norman Virus Control	Found  nothing
Panda Antivirus	Found  nothing
Sophos Antivirus	Found Mal/EncPk-DM
VirusBuster	Found  nothing
VBA32	Found Trojan-Spy.xBank.52 (probable variant)

电影结束了

Banker.....

TF过..........

• Submission details:
  • Submission received: 25 May 2008, 11:33:12
  • Processing time: 4 min 1 sec
  • Submitted sample:
    • File MD5: 0x256DE1F3DA2147284B345FC039D2E19E
    • Filesize: 3,472,534 bytes
    • Alias: Infostealer.Bancos [Symantec], PWS-Banker.gen.cg [McAfee], Mal_Banker [Trend Micro]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File MD5	Alias
1	[file and pathname of the sample #1]	3,472,534 bytes	0x256DE1F3DA2147284B345FC039D2E19E	Infostealer.Bancos [Symantec] PWS-Banker.gen.cg [McAfee] Mal_Banker [Trend Micro]

Memory Modifications

• There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	19,664,896 bytes

刚刚知道TF开始重视banker.....
http://www.threatexpert.com/threats/pws-banker-gen-cg.html

[ 本帖最后由 电影结束了 于 2008-5-25 10:00 编辑 ]

Joker

危险进程(PID:2940): C:\Documents and Settings\Administrator\桌面\002.exe

产品名称: 无
文件版本: 无
公司名称: 无
文件描述: 无
数字签名: 没有发现签名

危险级别: 高
级别评分: 61.18980
状态: 进程已被结束，但还没有清除，等待进一步处理。

建议: 如果能确认这个文件是安全的可以信任它，如果能确认是不安全的可以删除它，如果是正常的程序被意外的终止，可以暂时信任然后再重新运行一次。

如果无法确认它是否安全，建议使用在线扫描得到进一步的建议。

挪威的冬天

金山毒霸 0

sbbdms

Kaspersky miss
TO KL

卡巴：Trojan-Spy.Win32.Banker.nko

[ 本帖最后由 sbbdms 于 2008-5-30 23:15 编辑 ]

Palkia

rs 0

qigang

RS20.45.62未杀！