30日磁碟机最新变种衍生物~ 看看你的杀软杀几个！

显示全部楼层 · 发表于 2007-12-30 23:16:17

30号的最新变种不再生成ntfsus.exe，但是仍然会释放NetAPI00.sys来重置SSDT
另外会释放shutdown.exe来重启电脑
dnsq.dll还是会挂全局钩钩住WH_GETMESSAGE 向某些杀软的服务不断的发送消息直到该杀软歇菜挂掉~

这里是四个今天最新变种的衍生物看看你的杀软杀几个~

江民KV2008的主防中两张截图：

PS.这个主防截图是内测版主防！普通KV用户勿试…

[ 本帖最后由 yimike 于 2007-12-30 23:45 编辑 ]

显示全部楼层 · 发表于 2007-12-30 23:22:51

红伞留2个dll其他杀了

显示全部楼层 · 发表于 2007-12-30 23:32:45

D:\Download\VirusScan\sample.zip\netcfg.dll infected with Trojan.Rox
D:\Download\VirusScan\sample.zip\LSASS.EXE\data001 infected with Trojan.Rox

[Found possible security risk] <W32/Heuristic-345!Eldorado (damaged, not disinfectable)> D:\Download\VirusScan\sample.zip->SMSS.EXE->(FSG)

D:\Download\VirusScan\sample.zip:\SMSS.EXE - Suspect code-parts found (Level: 80)

>>> Virus 'Mal/Packer' found in file D:\Download\VirusScan\sample.zip\SMSS.EXE
>>> Virus 'Mal/Packer' found in file D:\Download\VirusScan\sample.zip\LSASS.EXE\FILE:0001
>>> File "D:\Download\VirusScan\sample.zip\LSASS.EXE" has been identified as suspicious 'Sus/Malware-A'.

  --> SMSS.EXE
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/FSG). Please verify the origin of the file
  --> LSASS.EXE
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/FSG). Please verify the origin of the file

显示全部楼层 · 发表于 2007-12-30 23:38:00

后面四个都在报壳……相较之下还是antivir最老实……

显示全部楼层 · 发表于 2007-12-30 23:51:59

那个壳好像是UPX的变形壳不是FSG…

显示全部楼层 · 发表于 2007-12-31 00:11:13

卡巴就杀了一个

已删除: 病毒 Virus.Win32.Xorer.dc 文件: F:\病毒样本\sample.zip/SMSS.EXE//FSG

显示全部楼层 · 发表于 2007-12-31 00:18:30

大蜘蛛29号的病毒库杀了

显示全部楼层 · 发表于 2007-12-31 00:21:26

AhnLab-V3 - - -
AntiVir - - TR/Crypt.FKM.Gen
Authentium - - Possibly a new variant of W32/Threat-SysVenFakU-based!Maximus
Avast - - Win32:Agent-EXD
AVG - - -
BitDefender - - DeepScan:Generic.PWS.Games.2.2A0CDB10
CAT-QuickHeal - - (Suspicious) - DNAScan
ClamAV - - PUA.Packed.UPack-2
DrWeb - - Trojan.Popwin.origin
eSafe - - Suspicious File
eTrust-Vet - - -
Ewido - - -
FileAdvisor - - -
Fortinet - - -
F-Prot - - W32/Threat-SysVenFakU-based!Maximus
F-Secure - - -
Ikarus - - Trojan-Downloader.Win32.Zlob.and
Kaspersky - - Backdoor.Win32.Agent.don
McAfee - - New Malware.aj
Microsoft - - Backdoor:Win32/Popwin.gen!D
NOD32v2 - - probably a variant of Win32/TrojanDownloader.Flux
Norman - - -
Panda - - Suspicious file
Prevx1 - - -
Rising - - -
Sophos - - Mal/Heuri-E
Sunbelt - - VIPRE.Suspicious
Symantec - - -
TheHacker - - W32/Behav-Heuristic-060
VBA32 - - suspected of Trojan-PSW.Game.63 (paranoid heuristics)
VirusBuster - - Packed/Upack
Webwasher-Gateway - - Trojan.Crypt.FKM.Gen

显示全部楼层 · 发表于 2007-12-31 00:22:27

少用点，留点给我们报报

显示全部楼层 · 发表于 2007-12-31 00:28:32

R:\sample.zip » ZIP » SMSS.EXE - probably a variant of Win32/Xorer virus
R:\sample.zip » ZIP » LSASS.EXE - a variant of Win32/Xorer virus

[病毒样本] 30日磁碟机最新变种衍生物~ 看看你的杀软杀几个！

本帖子中包含更多资源

回复 4楼 jimmyleo 的帖子

回复 3楼 jimmyleo 的帖子