BANKER X3

sbbdms

http://www.cartaoespeciais.kit.net/jumper.ini
http://www.cartaoespeciais.kit.net/dllhostc.ini
http://www.cartaoespeciais.kit.net/msn.ini

卡巴杀1漏2

已删除：木马程序 Trojan-Banker.Win32.Banker.aajp 文件　: D:\TDDownload\其它\新建文件夹\dllhostc.ini//PE_Patch.PECompact//PecBundle//PECompact

TO KL

Hello,

jumper.ini - Trojan-Banker.Win32.Banker.aays,

msn.ini - Backdoor.Win32.Agent.uur

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.



>
>
-----------------
Regards, Vitaly Butuzov
Virus Analyst, Kaspersky Lab.

[ 本帖最后由 sbbdms 于 2008-11-28 22:51 编辑 ]

The EQs

Dear Don Johnson,

Thank you for your submission.
The detection for this threat will be included in our next signature update.

Regards,

Virus Researcher
ESET spol. s r.o.

qigang

系统自动回信而已。

qigang

我剑盟比你早先发了！

sbbdms

……晕

The EQs

原帖由 qigang 于 2008-11-28 22:32 发表
系统自动回信而已。

不是自动回信。。。。。都是人工分析后回信的

欠妳緈諨

D:\virus\test\dllhostc.ini - 特征码 'Trojan-Banker.Win32.Banker' 被发现
D:\virus\test\jumper.ini - 特征码 'Generic.Banker.Delf' 被发现
D:\virus\test\msn.ini - 特征码 'Trojan-Spy.Win32.Banker.etk' 被发现

        3 文件被扫描
          (0 压缩档 0 文件)
        3 特征码被侦测
        0 可疑代码段被发现
        耗时: 0:00.410

sbbdms

Hello,

jumper.ini - Trojan-Banker.Win32.Banker.aays,

msn.ini - Backdoor.Win32.Agent.uur

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.



>
>
-----------------
Regards, Vitaly Butuzov
Virus Analyst, Kaspersky Lab.

change_018

Starting the file scan:

Begin scan in 'E:\Sandbox\Administrator\DefaultBox\user\current\桌面\banker'
E:\Sandbox\Administrator\DefaultBox\user\current\桌面\banker\dllhostc.ini
    [DETECTION] Is the TR/Downloader.Gen Trojan
    [NOTE]      The file was deleted!
E:\Sandbox\Administrator\DefaultBox\user\current\桌面\banker\jumper.ini
      [DETECTION] Is the TR/ATRAPS.Gen Trojan
    [NOTE]      The file was deleted!
E:\Sandbox\Administrator\DefaultBox\user\current\桌面\banker\msn.ini
    [DETECTION] Is the TR/Spy.Banker.Gen Trojan
    [NOTE]      The file was deleted!

aerbeisi

jumper运行的不是很成功，试图搞卡巴进程，但卡巴自我防护住了，就没后续动作了。msn的