[病毒样本] 4

显示全部楼层 · 发表于 2008-8-23 20:53:25

下载地址：

http://www.under321.kit.net/baladas.jpg
http://www.under321.kit.net/niht.jpg
http://www.under321.kit.net/na_balada.jpg
http://www.under321.kit.net/na_niht.jpg

自行下载！

显示全部楼层 · 发表于 2008-8-23 21:04:42

2008/8/23 21:03:35 已删除木马程序 Trojan-Downloader.Win32.Banload.nck G:\Temp\Temp\na_niht.jpg//XComp
其余上报

显示全部楼层 · 发表于 2008-8-23 21:38:24

McAfee miss

显示全部楼层 · 发表于 2008-8-23 21:38:44

Avira

D:\22222222222222\1111111111111111\111111111111111\Temp\baladas.jpg
[DETECTION] Is the TR/Crypt.NSPM.Gen Trojan
[NOTE]    The file was deleted!
D:\22222222222222\1111111111111111\111111111111111\Temp\na_balada.jpg
[DETECTION] Is the TR/Crypt.NSPM.Gen Trojan
[NOTE]    The file was deleted!
D:\22222222222222\1111111111111111\111111111111111\Temp\na_niht.jpg
[DETECTION] Is the TR/Spy.Banker.Gen Trojan
[NOTE]    The file was deleted!
D:\22222222222222\1111111111111111\111111111111111\Temp\niht.jpg
[DETECTION] Is the TR/Crypt.NSPM.Gen Trojan
[NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-8-23 22:24:45

智能实验室-杀马(Defendio) 扫描威胁日志记录
版本 4.33.0.1030
数据更新版本:66000
数据更新日期:2008-8-4 15:50:30
开始时间: 下午 10:24:00
启发式: 最高
压缩文件: 是
内存区域: 否
注册表: 否
系统区域: 否

扫描所选择的目录和文件...

对象: 启发识别：Heur/Susp.PackedPE.PEPatch.0.0004F871-->>D:\Documents and Settings\Administrator.WWW-461FC2525A6\桌面\Temp[1]\na_balada.jpg
威胁: Heur/Susp.PackedPE.PEPatch.0.0004F871
状态: 已经忽略

对象: 启发识别：Heur/Susp.PackedPE.PEPatch.0.00027FAA-->>D:\Documents and Settings\Administrator.WWW-461FC2525A6\桌面\Temp[1]\na_niht.jpg
威胁: Heur/Susp.PackedPE.PEPatch.0.00027FAA
状态: 已经忽略

显示全部楼层 · 发表于 2008-8-23 23:13:35

baladas.jpg       1411.83/1411.83KB 100.00% 在线扫描    它是一个“木马” 2008-8-23 23:12:16 2008-8-23 23:12:17
na_balada.jpg    307.88/307.88KB    100.00% 在线扫描    它是一个“木马” 2008-8-23 23:12:21 2008-8-23 23:12:22
na_niht.jpg       149.56/149.56KB    100.00% 在线扫描    它是一个“木马” 2008-8-23 23:12:25 2008-8-23 23:12:26
niht.jpg          406.10/406.10KB    100.00% 在线扫描    它是一个“木马” 2008-8-23 23:12:29 2008-8-23 23:12:29

显示全部楼层 · 发表于 2008-8-23 23:18:43

驱逐舰无视

显示全部楼层 · 发表于 2008-8-23 23:54:32

Hello,

baladas.jpg_ - Trojan-Banker.Win32.Banker.vmu,
na_balada.jpg_ - Worm.Win32.Rokut.az,
niht.jpg_ - Trojan-Banker.Win32.Banker.vmv

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Evgeny Aseev
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: Temp.rar

[病毒样本] 4

浏览过的版块