U盘伪装文件夹,NOD,小a没反应

zszzd

看看是什么东西

FLogo

??.exe - Trojan-Dropper.Win32.Flystud.kw

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

>From:
>Sent: Dec 19 2008  5:10AM
>To: "New Virus" <newvirus@kaspersky.com>
>Subject: newvirus

Regards, Vladislav Pintiysky
Virus Analyst

[ 本帖最后由 FLogo 于 2008-12-19 12:09 编辑 ]

su-tt

上报ESET

saga3721

微点这次又厉害了！上报红伞

程序：
C:\DOCUMENTS AND SETTINGS\\桌面\文件.EXE
木马程序生成以下文件：
1) C:\DOCUMENTS AND SETTINGS\XXX\LOCAL SETTINGS\TEMP\E_N4\HTMLVIEW.FNE
2) C:\DOCUMENTS AND SETTINGS\XXX\LOCAL SETTINGS\TEMP\E_N4\INTERNET.FNE
3) C:\DOCUMENTS AND SETTINGS\XXX\LOCAL SETTINGS\TEMP\E_N4\EAPI.FNE
4) C:\DOCUMENTS AND SETTINGS\XXX\LOCAL SETTINGS\TEMP\E_N4\SHELL.FNE
5) C:\DOCUMENTS AND SETTINGS\XXX\LOCAL SETTINGS\TEMP\E_N4\DP1.FNE
6) C:\DOCUMENTS AND SETTINGS\XXX\LOCAL SETTINGS\TEMP\E_N4\CNVPE.FNE
7) C:\DOCUMENTS AND SETTINGS\XXX\LOCAL SETTINGS\TEMP\E_N4\SPEC.FNE
8) C:\WINDOWS\SYSTEM32\372109\C00285.EXE
9) C:\WINDOWS\SYSTEM32\499E86\CNVPE.FNE
10) C:\WINDOWS\SYSTEM32\499E86\DP1.FNE
11) C:\WINDOWS\SYSTEM32\499E86\EAPI.FNE
12) C:\WINDOWS\SYSTEM32\499E86\HTMLVIEW.FNE
13) C:\WINDOWS\SYSTEM32\499E86\INTERNET.FNE
14) C:\WINDOWS\SYSTEM32\499E86\SHELL.FNE
15) C:\WINDOWS\SYSTEM32\499E86\SPEC.FNE
16) C:\WINDOWS\SYSTEM32\499E86\REGEX.FNR
是否删除木马程序及其衍生物?

啊弥陀佛

微点拦截

kkgh

瑞星   Worm.Win32.Agent.aaq

ashe_vaan

又是这个病毒。升级了？我的小a也不报

The EQs

Thank you for your submission.
The detection for this threat will be included in our next signature update.

Regards,

Virus Researcher
ESET spol. s r.o.

DistanceLove

直接运行了……弹出个运行错误提示……没事……

saga3721

这应该是假象，因为微点之后报了生成那么多东西，微点根据行为判断要是真的运行不起来而又生成这些东西就矛盾了