某人U盘点两个利用文件夹图标伪装的病毒

nomyself

两个利用文件夹图标伪装的exe。


应该很老的吧。

Palkia

病毒        2008-09-18  19:32:24        C:\Documents and Settings\Administrator\桌面\System Volume Information .rar\RECBCLER.exe        Win32.Troj.IAgent.fd.106496        清除成功       
病毒        2008-09-18  19:32:24        C:\Documents and Settings\Administrator\桌面\System Volume Information .rar\System Volume Information      .exe        Win32.Troj.IAgent.fd.106496        清除成功

尤金卡巴斯基

To Kl

维生素B2

感觉这类病毒在“XX门”的时候在驴子上很流行

wangjay1980

Hello,

Notepad.exe_ - Trojan-Downloader.Win32.VB.hud,

RECBCLER.exe_,
System Volume Information .exe_ - Worm.Win32.VB.yi

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Sergey Temnikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.


















2008-9-18 JAY19:41:09 WinRAR 压缩文件管理器  Create C:\Documents and Settings\Owner\桌面\System Volume Information      .exe
2008-9-18 JAY19:41:09 System  Modification C:\Documents and Settings\Owner\桌面\System Volume Information      .exe
2008-9-18 JAY19:41:09 WinRAR 压缩文件管理器  Modification C:\Documents and Settings\Owner\桌面\System Volume Information      .exe
2008-9-18 JAY19:42:19 System Volume Information      .exe  Placed in group Low Restricted
2008-9-18 JAY19:42:19 System Volume Information      .exe  Process start C:\Documents and Settings\Owner\桌面\System Volume Information      .exe
2008-9-18 JAY19:42:19 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\DOCUME~1\Owner\LOCALS~1\Temp\~DFB2D2.tmp
2008-9-18 JAY19:42:20 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:20 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\Documents and Settings\Owner\Cookies\index.dat
2008-9-18 JAY19:42:20 System Volume Information      .exe Denied: KLPrivateData/KLPrivateUserFiles/Cookies2 Create C:\Documents and Settings\Owner\Cookies\index.dat
2008-9-18 JAY19:42:20 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:20 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\O496E2ET\desktop.ini
2008-9-18 JAY19:42:20 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\A4L9ZIKZ\desktop.ini
2008-9-18 JAY19:42:20 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\XWY0ZJ1U\desktop.ini
2008-9-18 JAY19:42:20 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\5NIRAG07\desktop.ini
2008-9-18 JAY19:42:20 System Volume Information      .exe Denied: KLSystemData/FD-C/ Delete C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\VM2U5ZO5
2008-9-18 JAY19:42:21 System Volume Information      .exe Denied: KLSystemData/FD-C/ Delete C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\TBOJ2MXT
2008-9-18 JAY19:42:21 System Volume Information      .exe Denied: KLSystemData/FD-C/ Delete C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\QFVY5XAV
2008-9-18 JAY19:42:21 System Volume Information      .exe Denied: KLSystemData/FD-C/ Delete C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\JTUYG57K
2008-9-18 JAY19:42:21 System Volume Information      .exe Denied: KLSystemData/FD-C/ Delete C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\WR2THCYQ
2008-9-18 JAY19:42:21 System Volume Information      .exe Denied: KLSystemData/FD-C/ Delete C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\98P83Z4X
2008-9-18 JAY19:42:21 System Volume Information      .exe Denied: KLSystemData/FD-C/ Delete C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\2D2QKPCT
2008-9-18 JAY19:42:21 System Volume Information      .exe Denied: KLSystemData/FD-C/ Delete C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\ZK0HQZ74
2008-9-18 JAY19:42:21 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\DOCUME~1\Owner\LOCALS~1\Temp\Cookies\index.dat
2008-9-18 JAY19:42:21 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\DOCUME~1\Owner\LOCALS~1\Temp\History\History.IE5\index.dat
2008-9-18 JAY19:42:21 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:21 System Volume Information      .exe Denied: KLSystemData/FD-C/ Modification C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:21 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:21 System Volume Information      .exe Denied: KLSystemData/FD-C/ Modification C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:21 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:21 System Volume Information      .exe Denied: KLSystemData/FD-C/ Modification C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:21 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:21 System Volume Information      .exe Denied: KLSystemData/FD-C/ Modification C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:21 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:21 System Volume Information      .exe Denied: KLSystemData/FD-C/ Modification C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:21 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:21 System Volume Information      .exe Denied: KLSystemData/FD-C/ Modification C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:22 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:22 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\Documents and Settings\Owner\Cookies\index.dat
2008-9-18 JAY19:42:22 System Volume Information      .exe Denied: KLPrivateData/KLPrivateUserFiles/Cookies2 Create C:\Documents and Settings\Owner\Cookies\index.dat
2008-9-18 JAY19:42:22 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:22 System Volume Information      .exe Denied: KLSystemData/FD-C/ Modification C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat
2008-9-18 JAY19:42:23 System Volume Information      .exe Denied: KLPrivileges/KLPermissionAppAccess/KLPermissionProcManage/KLStartProc Process start c:\windows\system32\cmd.exe
2008-9-18 JAY19:42:23 System Volume Information      .exe Denied: KLPrivileges/KLPermissionAppAccess/KLPermissionProcManage/KLStartProc Process start c:\windows\system32\cmd.exe
2008-9-18 JAY19:42:23 System Volume Information      .exe Denied: KLPrivileges/KLPermissionAppAccess/KLPermissionProcManage/KLStartProc Process start c:\windows\system32\cmd.exe
2008-9-18 JAY19:42:23 System Volume Information      .exe Denied: KLPrivileges/KLPermissionAppAccess/KLPermissionProcManage/KLStartProc Process start c:\windows\system32\cmd.exe
2008-9-18 JAY19:42:23 System Volume Information      .exe Denied: KLPrivileges/KLPermissionAppAccess/KLPermissionProcManage/KLStartProc Process start c:\windows\system32\cmd.exe
2008-9-18 JAY19:42:24 System Volume Information      .exe Denied: KLPrivileges/KLPermissionAppAccess/KLPermissionProcManage/KLStartProc Process start c:\windows\system32\cmd.exe
2008-9-18 JAY19:42:24 System Volume Information      .exe Denied: KLPrivileges/KLPermissionAppAccess/KLPermissionProcManage/KLStartProc Process start c:\windows\system32\cmd.exe
2008-9-18 JAY19:42:24 System Volume Information      .exe Denied: KLPrivileges/KLPermissionAppAccess/KLPermissionProcManage/KLStartProc Process start c:\windows\system32\cmd.exe
2008-9-18 JAY19:42:24 System Volume Information      .exe  Create C:\RECJCLER.exe
2008-9-18 JAY19:42:24 System Volume Information      .exe : KLSystemData/FD-C/ Create C:\RECJCLER.exe
2008-9-18 JAY19:42:24 System Volume Information      .exe Denied: KLSystemData/FD-C/ Modification C:\RECJCLER.exe
2008-9-18 JAY19:42:51 System Volume Information      .exe Denied: KLPrivateData/FD-D,E/ Create D:\RECUCLER.exe
2008-9-18 JAY19:42:51 System Volume Information      .exe  Process exit C:\Documents and Settings\Owner\桌面\System Volume Information      .exe

















2008-9-18 JAY19:41:09 WinRAR 压缩文件管理器  Create C:\Documents and Settings\Owner\桌面\RECBCLER.exe
2008-9-18 JAY19:41:09 System  Modification C:\Documents and Settings\Owner\桌面\RECBCLER.exe
2008-9-18 JAY19:41:09 WinRAR 压缩文件管理器  Modification C:\Documents and Settings\Owner\桌面\RECBCLER.exe
2008-9-18 JAY19:42:13 RECBCLER.exe  Placed in group High Restricted
2008-9-18 JAY19:42:13 RECBCLER.exe  Process start C:\Documents and Settings\Owner\桌面\RECBCLER.exe
2008-9-18 JAY19:42:14 RECBCLER.exe Denied: KLSystemData/FD-C/ Create C:\DOCUME~1\Owner\LOCALS~1\Temp\~DF8BC9.tmp
2008-9-18 JAY19:42:16 RECBCLER.exe  Process exit C:\Documents and Settings\Owner\桌面\RECBCLER.exe


[ 本帖最后由 wangjay1980 于 2008-9-18 21:48 编辑 ]

无尽藏海

Begin scan in 'D:\Virus\System Volume Information .rar'
D:\Virus\System Volume Information .rar
    [0] Archive type: RAR
    --> System Volume Information      .exe
      [DETECTION] Is the TR/Crypt.CFI.Gen Trojan
    --> RECBCLER.exe
      [DETECTION] Is the TR/Crypt.CFI.Gen Trojan

kingmuro

kv0

hu3167343

费尔没报

BING126

McAfee  miss

wangjay1980

Hello,

Notepad.exe_ - Trojan-Downloader.Win32.VB.hud,

RECBCLER.exe_,
System Volume Information .exe_ - Worm.Win32.VB.yi

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Sergey Temnikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[:1:]