KB908605.exe

显示全部楼层 · 发表于 2008-8-16 17:07:07

TO KL

显示全部楼层 · 发表于 2008-8-16 17:19:17

2008-8-16 17:19:25 文件系统实时防护文件 G:\v\KB908605.exe 可能是 Win32/Nuwar 蠕虫的变种通过删除清除 - 已隔离 NT AUTHORITY\SYSTEM 在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.

显示全部楼层 · 发表于 2008-8-16 17:19:58

读目标程序虚拟内存：
(PID:536)C:\WINDOWS\SYSTEM32\SMSS.EXE

读目标程序虚拟内存：
(PID:596)C:\WINDOWS\SYSTEM32\CSRSS.EXE

访问C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS

初见成效~继续完善RX规则~

显示全部楼层 · 发表于 2008-8-16 17:25:58

The file 'KB908605.exe' has been determined to be 'UNDER ANALYSIS'.

显示全部楼层 · 发表于 2008-8-16 17:50:21

这个卡巴报了

KV2008 MISS

显示全部楼层 · 发表于 2008-8-16 18:00:47

TF & Microsoft. 关系暧昧.

显示全部楼层 · 发表于 2008-8-16 18:06:22

kv2008没报

显示全部楼层 · 发表于 2008-8-16 18:57:47

RS20.57.52未杀！

显示全部楼层 · 发表于 2008-8-16 19:26:09

Hello,

cxikyeuw.exe - Trojan-Downloader.Win32.Agent.aayr,
dwscphpk.exe - Trojan-Downloader.Win32.Small.abew,
KB908605.exe - Trojan-PSW.Win32.LdPinch.zjt

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[病毒样本] KB908605.exe

2/0

浏览过的版块