Obfuscated[第37次更新](uninstall.exe每次下載的竟是一样??)[一楼提供8个美丽的图标]

sam.to

因字数的限制而需要开新帖!!











当打开这些文件后:







第一次至第十八次更新:
http://bbs.kafan.cn/thread-286866-1-1.html

7月27日20:02:
这包的uninstall.exeSP跟下帖很相似
http://bbs.kafan.cn/viewthread.php?tid=292781

aac9d517a76b419c6aecdbecb6b69ea0  uninstall.exe0
6deae97b72cee2d8f6c70f0b090551ad  uninstall.exe1
ca5e1c097573e2c7bc4d249b3811bea5  uninstall.exe10
58d7d11e42697e0a875527c7a68c9ebb  uninstall.exe11
8d3a1058be579866ddc30dfff280213a  uninstall.exe12
1ed5a3f846bf78965cd025917a7d5a3b  uninstall.exe2
6ad33b96665cb827076d78baf51e5214  uninstall.exe3
42aca1fd13b015970de4e6881b20aee2  uninstall.exe4
fd60897adf9391ca0f51fb495ff19dd7  uninstall.exe5
1e7fe826da1e5054cad7875cc153d240  uninstall.exe6
897cd10dc09c8d3bb90737404b82a16e  uninstall.exe7
0e5678294845415ea01dae997d28fdb8  uninstall.exe8
966db36221967e48adfcf74b2871256b  uninstall.exe9
ff322df1c76974e820c132d2fcb61acb  uninstall.exeSP
已上报到卡巴,PCSL
Hello.
These files will be detected as soon as possible.

Please quote all when answering.
-----------------
Regards, Vyacheslav Zakorzhevsky
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com






============================================================
8月1日的:
ce2740d8536d198675b747df23f5a54d  upAYB.int1
71a28278d7d414168049683a5d80b145  upAYB.int0
a66ef59043f55b274507ea583523d2a3  uninstall.exe5
5b3169632e28940e735772db1a429eb9  uninstall.exe4
42b35d62ef5f64efc77823266fc4414b  uninstall.exe3
ff322df1c76974e820c132d2fcb61acb  uninstall.exe2
c29b61dae01a0c9d4392bb77a81afd58  uninstall.exe1
2938e55ab36218f86d151d702c2534d3  uninstall.exe0
092420cec9710bf3003184ecfeabff2e  tp_map16.int1
0282f4e9ba3d12c6fdb45b84fb9d0c7c  tp_map16.int0
75395828cedbe1d91385937a081c6744  sn_pkz.int1
dfc195c58e97e71b41a0a94e7b44b32e  sn_pkz.int0
cc45bfa8b7238a4a5351049ec333907a  np_pkz.int1
08aa02d426c12c538027edd744e97475  np_pkz.int0
03cf6de0f5f2153202c505ac1f3f43cb  kr3.int1
bab0d8c41ee95c121d07922f37b0c46f  kr3.int0
23e5b142438e724d86bfb0df3fe1c785  9kgen_up.int1
1315d0d5d5a4ce9c1d358812b6a99607  9kgen_up.int0

已上报到卡巴,PCSL


Hello.
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.

Sincerely yours,
Andrey Bezborodov,
Virus Analyst.
_____________________
Kaspersky Lab Ltd
Moscow, Russia
Tel/Fax : +7 (095) 797-8700
E-mail  : newvirus@kaspersky.com
Internet: http://www.kaspersky.com, http://www.viruslist.com









============================================================
8月1日第2次:
7dea24a00394a539981f180033a4322d  sn_pkz.int0
a06d8c97087be627ee7752a6a4add000  sn_pkz.int1

已上报到卡巴,PCSL

Hello.
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.

Please quote all when answering. Do not forget to include you registration data.
-----------------
Regards, Tatarinov Ivan
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com


============================================================
8月1日第3次
6292fe0945c34b10ffe67335f41c6974  9kgen_up.int0
ac0b863a2a77cd75916696a1a4774163  np_pkz.int0
1e91604ecb56ab077b9c879bc635cb36  tp_map16.int0
0f7c3c321acb75caa8c20dffe33a2c24  uninstall.exe0

已上报卡巴,pcsl

Hello.
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.

Please quote all when answering. Do not forget to include you registration data.
-----------------
Regards, Tatarinov Ivan
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com




============================================================
8月2日的
2e279a63f089f27bac05344dddd10c74  sn_pkz.int0
已上报卡巴,PCSL
Hello,

sn_pkz.int0 - Trojan.Win32.Obfuscated.utu

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Ostroverkhov Vladimir
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

============================================================
8月3日:
53d4e47852d7d5a019edf0a61c005e41  tp_map16.int0
a0a415a3421a39a17d21396fa266381e  uninstall.exe0
74c34b8b1331d8353a41a51a4a3fc090  np_pkz.int0
aab25590905e3df60d531e622a431391  np_pkz.int1
已上报卡巴,pcsl
Hello.
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.

Sincerely yours,
Andrey Bezborodov,
Virus Analyst.
_____________________
Kaspersky Lab Ltd
Moscow, Russia
Tel/Fax : +7 (095) 797-8700
E-mail  : newvirus@kaspersky.com
Internet: http://www.kaspersky.com, http://www.viruslist.com


============================================================
8月4日:
870ef12e2bcb6068a89aa3bf74deeecb  9kgen_up.int0
e546e64954d01b0dcc298ed848768208  9kgen_up.int1
90bcaf9b58134723c2a4930d78e536bd  9kgen_up.int2
a24c776a95e1adf5766f88603cdd0d04  9kgen_up.int3
e46ff785a1f253a8e0b8d134b20f17e1  np_pkz.int0
26bb09b5166243d9e08d057fc4cdc569  sn_pkz.int0
227dd917f03c58dcd93ff7d2e0988d3b  tp_map16.int0
6193718e311881936fa3250449312a57  uninstall.exe0
579b9207d847bcccf3baad61033f6495  upAYB.int0
f44fb1a2ddb0c991265eb7cc999be412  upAYB.int1
8f4085294eb02de23084a3e5743adab2  upAYB.int2
已上报到卡巴,PCSL
Hello.
These files will be detected as soon as possible.

Please quote all when answering.
-----------------
Regards, Vyacheslav Zakorzhevsky
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com






============================================================
8月5:
0000a6364ac668050002899cd7d0be0f  9kgen_up.int0
cdb78e5499b20770d760978965331b16  tp_map16.int0
938c4a750a08e9b5c79a4b2d91ba4ec7  upAYB.int0
bc1a05d1549ea98f0867bbaa5bd75f53  upAYB.int1

已上报到卡巴和PCSL
Hello.
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.

Please quote all when answering. Do not forget to include you registration data.
-----------------
Regards, Tatarinov Ivan
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com



============================================================
8月7:
191fec4726544f9c58eaf0df28610d0e  9kgen_up.int0
14eadb20b25f34af85bb5424a4145b2c  np_pkz.int0
085ad544961956e6a45bfad1fea9bdb1  sn_pkz.int0
5835e2b8b64399b2adb94e3312e411c8  tp_map16.int0
2361b2fb4e531e71fb8fa5c5099609a3  uninstall.exe0
247f6cdf5e9832a4b30e38768c6e0658  uninstall.exe1

已上报卡巴和pcsl

Hello.
These files will be detected as soon as possible.

Please quote all when answering.
-----------------
Regards, Vyacheslav Zakorzhevsky
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com



============================================================
8月8:
be903a09e749ae2b4f2cbd6f9887f27a  upAYB.int0
已上报到卡巴,PCSL
Hello,

upAYB.int0 - Trojan.Win32.Obfuscated.uvd

This file is in process.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

============================================================
8月9:
52f998905db6371ea0ad47294a885655  9kgen_up.int0
0d8bb03c61dc0993562383dcfef9d289  np_pkz.int0
已上报卡巴和PCSL
Hello,

9kgen_up.int0 - Trojan.Win32.Obfuscated.uvf,
np_pkz.int0 - Trojan.Win32.Obfuscated.uvg

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Kirill Erakhtin
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

============================================================
8月10:
cd4ad12a2c20445ab26108c6acc434c1  kr3.int0
4208f1df79ade1bc5fe838137348fa55  np_pkz.int0
43c4ed5ac32bc8cdcba0e1d6b2706f40  sn_pkz.int0
318ee36a7274e777783f9e69ac6b5787  tp_map16.int0
f341ba5e6255153ec617f945723906f0  uninstall.exe0
7629b2c9be0a39ac7935a71175d78b90  upAYB.int0
b5e11abd2f071adea34b3544cc76e99e  upAYB.int1
已上报到卡巴,PCSL
Hello,

Detection will be added as soon as possible.

-----------------
Regards,  Namestnikov Yury
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com



============================================================
8月12
f563f55b65a20596edb548a0951f0599  np_pkz.int0
e386593fb8e90bc29cb8213484006cda  uninstall.exe0
已上报到卡巴,PCSL
Hello.
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.
-----------------
Regards, Namestnikov Yury
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com

============================================================
8月12的第2次(使用全新基因,避开卡巴的查杀):
0b83ff14b8e420bffb074cc898b61b45  uninstall.exe0
5a68813a9b63955c3c0f051b057a22db  uninstall.exe1
e3e7648b0fc0eb184ebd47e5ea011ece  uninstall.exe10
f3aa2630d72f98bc86af83d5c6d3ccbf  uninstall.exe2
9649d8ad17c818d2b0a8d2ea18c3c2f5  uninstall.exe3
af9b98336f03d5f79cc31712b4fd5e36  uninstall.exe4
7e7ccd929105c07d6655f64f23fd0497  uninstall.exe5
9649d8ad17c818d2b0a8d2ea18c3c2f5  uninstall.exe6
1e172d52fd2726ee88bed652a55ca61f  uninstall.exe7
f809f75f6d3d6f6788563f943e2b0ced  uninstall.exe8
a75e7c24ce94b22b462b96fe85d3bd1c  uninstall.exe9
已上报到卡巴和PCSL
Hello

detection will be added as soon as possible.


-----------------
Regards, Namestnikov Yury
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com

No part of this message can be made available on the public web,
message board or newsgroup without the permission of the sender.





============================================================
8月13的第3次:
7403db83ebd04c7b24c71137b960ca80  uninstall.exe0
a3b730ff5c3303f5eb434e573057a705  uninstall.exe1
1ca9e6e405e5960ec377179bd11d3953  uninstall.exe10
86f7dc28934d8acf76aa2c205eef7279  uninstall.exe11
8950ddc4eef0d82841c95874037ce85e  uninstall.exe12
d834f783a2602c1750c0916ea90cc2f4  uninstall.exe13
9606469dbd432aaac38a9a86360fd8ba  uninstall.exe14
a42a38df94556860d07116fb6a0444bb  uninstall.exe15
59652f9ab6bbb6b826b22abd9bd01922  uninstall.exe16
d161bc51a476b2f44d13ec191c6f4e42  uninstall.exe17
3ee23793ccff680b5140158a2686a463  uninstall.exe18
b91bd2e81f680fcb66a311ce4a202ffa  uninstall.exe19
fcb5239d2faca25492cfae152686423e  uninstall.exe2
ff4b5857391f991901b3fbdd16e3cc2f  uninstall.exe20
b5028b57ddd917744461fa129cf9af13  uninstall.exe3
a03d529b98ddad36fc92f589ec3e980f  uninstall.exe4
19a9a71a12cdac99ef114d2334ec126c  uninstall.exe5
4f041dbd7860e260b7e14488eb5290cd  uninstall.exe6
70db9607d133ef4dfe70e23b016af3e2  uninstall.exe7
de967b4296b5233031b1e9d7ffc26d7c  uninstall.exe8
502ba63f1105613b52ef23230da69e89  uninstall.exe9
已上报到卡巴和PCSL
Hello.
These files will be detected as soon as possible.

Please quote all when answering.
-----------------
Regards, Vyacheslav Zakorzhevsky
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com






============================================================
8月13日:
f9ab29617aba83d5f959f56b13156831  uninstall.exe0
2f7d00eaa7f3d5a645bb05a738401212  uninstall.exe1
58230cce909b7abcb818a75cdbe9cceb  uninstall.exe10
3b9cd68f2d3932957e436c725741bf8a  uninstall.exe11
481206cce28f247b4b63f1bf65f2cd05  uninstall.exe12
fff2265a00d45d7a3c366047ee2713bf  uninstall.exe13
13ae56494d0f1d0733ace5a41b75dfc1  uninstall.exe14
20d9ce67cf01a89605dd2e17dae7cb38  uninstall.exe15
bcf52893b23960748bead820d2e0a592  uninstall.exe16
19d0b5922011574650b8352814f4a7ec  uninstall.exe17
64651e7f68f997688ac3ee2d7d352426  uninstall.exe18
0bb3377477e2dbcd02aaaab584d751ad  uninstall.exe19
9e1563fa70ceb80beb0b3428eafc9a06  uninstall.exe2
a5f4c3769d6228232adbf6bde33522a5  uninstall.exe20
b1937a4895f2d66a0d2785990426e061  uninstall.exe21
48bca6a35ddbb56a0e9ce871cd324eda  uninstall.exe22
3ba51ac4773266657f907e275cfbe5f7  uninstall.exe23
3aa205972899e4268a00932843a16375  uninstall.exe24
f8b1cc445130aa906921929e5d7ead66  uninstall.exe3
ffea80ccd4aedab64366e8945d7959c2  uninstall.exe4
6b99d5eb527e1208e43a0861b5b57572  uninstall.exe5
553ca7e3a102a80855c6911c552c03ab  uninstall.exe6
757a9841bc43ac736c5a6673aff469e9  uninstall.exe7
cb1a4622f8a5a950dd86de1be02a9e52  uninstall.exe8
abb155d48925df9c56a0054da8dbda37  uninstall.exe9
25个,已上报卡巴和PCSL
Hello,

Detection will be added as soon as possible.


-----------------
Regards, Namestnikov Yury
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com




============================================================
8月14:
b6c10f1ec1e0c51394b92a75a7f0de06  uninstall.exe7
91c3fd23f23e2d0bb99dcd3de5a2e9b1  uninstall.exe1
76ae95b9aad2181e36afb18d1579d40a  uninstall.exe2
757a9841bc43ac736c5a6673aff469e9  uninstall.exe8
7146a4a8609902bc42ed872f9613f916  uninstall.exe5
6cef1a7f91c7090b3a52ace35caa6f87  uninstall.exe9
67f2a692d1ff434695943ef0fd9f424f  uninstall.exe4
56078eb900f78f1b3ef3adea9bd5307a  uninstall.exe6
3df8167736dcafd998078dec35c18712  uninstall.exe3
已上报卡巴和PCSL
Hello,

Detection will be added as soon as possible.

-----------------
Regards, Namestnikov Yury
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com

No part of this message can be made available on the public web,
message board or newsgroup without the permission of the sender.


============================================================
8月15:
dab48134af615ea57196c5adad0f5755  uninstall.exe1
caccbcf62a8b1c3c32935590d584da05  uninstall.exe2
6d3f61c34305e4dd90ffc2956d64608c  uninstall.exe3
f8dd93d48dc08456718d0719524952f4  uninstall.exe4
1ecf42e835afdd8e85ef656cbe141803  uninstall.exe5
69f40755e9c0d0c18b9ae742588d6ccf  uninstall.exe6
8cd737346ba3db665f550eb5ed40e9fd  uninstall.exe7
8db33efd5d1c3989440c7de6860bd633  uninstall.exe8
已上报到卡巴和PCSL

Hello.
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.

Please quote all when answering. Do not forget to include you registration data.
-----------------
Regards, Tatarinov Ivan
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com


============================================================
8月16:
76f7ea522d8e2458a7c7bfc8aaa7d461  upAYB.int2
141007c6fbf24fb1b8e032fdf3d4b450  upAYB.int1
0d4192bc904c7255e6c3a3f621eb7feb  uninstall.exe1
2128921a7b7bd776c6be1da2070045fe  tp_map16.int3
a4ec78f95f290b6d83f0efcd5858899d  tp_map16.int2
d5e87ddcdae01df4952992018151ebd2  tp_map16.int1
07419da4f557f9fddd113da481fd8718  sn_pkz.int5
12baa99cc22e8a62e0a53a0904ed0ec0  sn_pkz.int3
3c87aec1ed3b88bb0d9be7faeb72dac5  sn_pkz.int2
daf43424cbd5ce473634037701f56128  sn_pkz.int1
b657371036bda8eb00defb37743b55c4  np_pkz.int1
90cce28538c887f02eb06c6d8012c612  kr3.int3
c7c258a5a8f3d2b504ea17c22dc6b692  kr3.int2
3c482aa993fec5919a0115391c291e79  kr3.int1
3f893996907c7e11930af6e7240cbad5  9kgen_up.int4
c92926c985e7478fea804760af351595  9kgen_up.int3
d3bffcd0d070cf24b7279bd6c2b3065f  9kgen_up.int2
b12efc9a95df0ab67103b0f81c5608d2  9kgen_up.int1
已上报到卡巴和PCSL
Hello.
These files will be detected as soon as possible.

Please quote all when answering.
-----------------
Regards, Vyacheslav Zakorzhevsky




============================================================

[ 本帖最后由 kato9096 于 2008-9-2 00:26 编辑 ]

醉一生爱妍

UGuard 完成了在 C:\Documents and Settings\Administrator\桌面\0727-1949[1] 上的扫描。
================
'SL.Trojan.25997' 在 'uninstall.exe1' 中被检测到。
'SL.Trojan.12266' 在 'uninstall.exe11' 中被检测到。
'SL.Trojan.20883' 在 'uninstall.exe8' 中被检测到。
================
扫描文件数： 14
本次扫描发现了 3 个已知威胁，请及时处理。
实际文件数： 14
扫描时间： 0-00-00 00:00:06:0593
威胁比率： 21.43%

sam.to

究竟这些文件有什么特別,要"These files will be detected as soon as possible."

wangjay1980

最近太流行

sam.to

鵒子都很流行,流行跟"detected as soon as possible"有什么關係??

wangjay1980

根本没得比

sam.to

很久以前上报这个馬都会出現"detected as soon as possible."

sam.to

看似那些int会直接入庫

woai_jolin

2008-7-28 0:43:29        Kernel        File  'G:\v\0727-1949\uninstall.exeSP' was sent to ESET for analysis.       
2008-7-28 0:42:36        Kernel        File  'G:\v\0727-1949\uninstall.exe12' was sent to ESET for analysis.       
2008-7-28 0:41:41        Kernel        File  'G:\v\0727-1949\uninstall.exe11' was sent to ESET for analysis.       
2008-7-28 0:40:46        Kernel        File  'G:\v\0727-1949\uninstall.exe10' was sent to ESET for analysis.       
2008-7-28 0:39:48        Kernel        File  'G:\v\0727-1949\uninstall.exe9' was sent to ESET for analysis.       
2008-7-28 0:38:17        Kernel        File  'G:\v\0727-1949\uninstall.exe8' was sent to ESET for analysis.       
2008-7-28 0:37:11        Kernel        File  'G:\v\0727-1949\uninstall.exe7' was sent to ESET for analysis.       
2008-7-28 0:36:11        Kernel        File  'G:\v\0727-1949\uninstall.exe6' was sent to ESET for analysis.       
2008-7-28 0:34:57        Kernel        File  'G:\v\0727-1949\uninstall.exe5' was sent to ESET for analysis.       
2008-7-28 0:33:54        Kernel        File  'G:\v\0727-1949\uninstall.exe4' was sent to ESET for analysis.       
2008-7-28 0:32:50        Kernel        File  'G:\v\0727-1949\uninstall.exe3' was sent to ESET for analysis.       
2008-7-28 0:31:13        Kernel        File  'G:\v\0727-1949\uninstall.exe2' was sent to ESET for analysis.       
2008-7-28 0:30:14        Kernel        File  'G:\v\0727-1949\uninstall.exe1' was sent to ESET for analysis.       
2008-7-28 0:29:24        Kernel        File  'G:\v\0727-1949\uninstall.exe0' was sent to ESET for analysis.

sam.to

卡巴对此回信:

Dear Customer

that mean will update by modual update.

Thank You

Best Regards
Kaspersky Hong Kong Support Team