又一个用VB写的新病毒

The EQs

VT全过


Thank you for your submission.
The detection for this threat will be included in our next signature update.

Regards,


Virus Researcher
ESET spol. s r.o.

Palkia

rs 0

saga3721

程序：
C:\DOCUMENTS AND SETTINGS\\桌面\SETUP\SETUP.EXE
木马程序生成以下文件：
1) C:\WINDOWS\SYSTEM32\URQRLMMG.DLL
是否删除木马程序及其衍生物?

schumi小粉

to kill

luxiao200888

ＴＯＫＬ

zfqangel

额~~~~，卡巴没反应，手动扫也没反应~~~

250662772

1. 2008-12-26 18:55:32 文件保护(创建文件) 操作:阻止
   
2. 进程路径:D:\setup.exe
   
3. 文件路径:C:\uwsnff.exe
   
4. 2008-12-26 18:55:29 应用程序保护(修改其它进程内存) 操作:阻止
   
5. 进程路径:C:\egaast.exe
   
6. 目标进程:C:\WINDOWS\explorer.exe
   
7. 2008-12-26 18:55:28 注册表保护(创建注册表值) 操作:阻止
   
8. 进程路径:C:\egaast.exe
   
9. 注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt
   
10. 注册表名称:[Key]
    
11. 2008-12-26 18:55:28 文件保护(创建文件) 操作:阻止
    
12. 进程路径:C:\egaast.exe
    
13. 文件路径:C:\WINDOWS\system32\crypts.dll
    
14. 2008-12-26 18:55:23 文件保护(创建文件) 操作:允许
    
15. 进程路径:D:\setup.exe
    
16. 文件路径:C:\egaast.exe
    
17. 2008-12-26 18:55:07 文件保护(创建文件) 操作:阻止
    
18. 进程路径:D:\setup.exe
    
19. 文件路径:F:\temp\S-1-5-21-789336058-839522115-725345543-500\temp\tuvTjGXn.bat
    
20. 2008-12-26 18:55:07 文件保护(创建文件) 操作:阻止
    
21. 进程路径:D:\setup.exe
    
22. 文件路径:C:\WINDOWS\system32\rqRjGxVm.dll
    

复制代码

JusticeH

BitDefender AntiVIrus 2009
上報

schumi小粉

Hello,

setup.exe_ - Trojan-Dropper.Win32.Agent.acjh

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.


>
>
-----------------
Regards, Vitaly Butuzov
Virus Analyst, Kaspersky Lab.

su-tt

C:\Documents and Settings\Administrator\桌面\setup.zip > ZIP > setup/setup.exe - Win32/TrojanDownloader.Agent.OPL 特洛伊木马