春节巨献，2008年01月流行样本汇总 【样本数：1285】

冷冷

病毒库：70238
1288 Files scanned
   (4 Archives with 4 files)
1208 Signatures found
28 Suspect code-parts found
Used time: 1:51.125

多了4个，一个令IK溢出，不算病毒

1285-49

leonfg

原帖由 wangjay1980 于 2008-2-1 20:55 发表
Hello,

ad_1.vir, ad_10.vir, ad_11.vir, ad_2.vir, ad_21.vir, ad_3.vir, ad_4.vir, ad_7.vir, ad_8.vir, ad_9.vir, Bd_25.vir, Trj_1037.vir, Trj_1071.vir, Trj_1075.vir, Trj_1082.vir, Trj_111.vir, Trj_112 ...

卡巴回复很认真

IllusionWing

..说到溢出也是\Drop_7.vir这个东西也让UG溢出了...

清蒸波波面

有小舒舒的测试，我看就用不着我了吧

NobleT

F0PROT的报告
Scanned files:                 1293
Infected objects:         862
Disinfected objects:         163
Quarantined files:         699
-----------------------------

hahacomcn

红色更新后的：

End of the scan: 2008年2月2日  01:14
Used time: 01:21 min

The scan has been done completely.

      1 Scanning directories
   1297 Files were scanned
   1267 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
   1266 files were deleted
      0 files were repaired
      2 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     30 Files not concerned
      3 Archives were scanned
      0 Warnings
      0 Notes

hahacomcn

余下的上报：

We received the following archive files:



File ID  Filename  Size (Byte) Result
3718572  0801.rar 908.81 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename  Size (Byte) Result
266382  ad_9.vir  36 KB  MALWARE
3718573  Trj_1102.vir  443 KB  UNDER ANALYSIS
3652235  Trj_111.vir  50.39 KB  MALWARE
3652253  Trj_1129.vir  61.21 KB  MALWARE
3651976  Trj_1148.vir  40 KB  DAMAGED FILE (MALWARE)
2232331  Trj_62.vir  8.5 KB  MALWARE
3617087  Trj_63.vir  29.3 KB  DAMAGED FILE (UNKNOWN)
3648188  Trj_687.vir  87.5 KB  CLEAN
3611489  Trj_880.vir  509.95 KB  MALWARE


Please find a detailed report concerning each individual sample below:

Filename Result
ad_9.vir  MALWARE

The file 'ad_9.vir' has been determined to be 'MALWARE'. Our analysts named the threat APPL/Yok.L. The term APPL/ denotes an application of dubious origin or which might be hazardous to use.Detection is added to our virus definition file (VDF) starting with version 6.39.00.56.

Filename Result
Trj_1102.vir  UNDER ANALYSIS

The file 'Trj_1102.vir' has been determined to be 'UNDER ANALYSIS'.

Filename Result
Trj_111.vir  MALWARE

The file 'Trj_111.vir' has been determined to be 'MALWARE'. Our analysts named the threat PCK/Expressor. File has been compressed with an unusual runtime compression tool. Please make sure that this file comes from a trustworthy source.This malware is detected by a special detection routine from the engine module.

Filename Result
Trj_1129.vir  MALWARE

The file 'Trj_1129.vir' has been determined to be 'MALWARE'. Our analysts named the threat PCK/NSPack. File has been compressed with an unusual runtime compression tool. Please make sure that this file comes from a trustworthy source.This malware is detected by a special detection routine from the engine module.

Filename Result
Trj_1148.vir  DAMAGED FILE (MALWARE)

The file 'Trj_1148.vir' has been determined to be 'DAMAGED FILE (MALWARE)'. In particular this means that this file is damaged and not working properly. Nevertheless we were able to determine that it contains malicious code fragments.

Filename Result
Trj_62.vir  MALWARE

The file 'Trj_62.vir' has been determined to be 'MALWARE'. Our analysts named the threat SPR/PsKill.N. The term "SPR/" ("Security or Privacy Risk") denotes a program that might possibly be able to affect the security of your system, might trigger activities you might not want or might violate your privacy.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Crypted.

Filename Result
Trj_63.vir  DAMAGED FILE (UNKNOWN)

The file 'Trj_63.vir' has been determined to be 'DAMAGED FILE (UNKNOWN)'. In particular this means that this file is damaged and not working properly. We could not find any malicious content. However the heuristic detection module may still detect this particular file even though it is damaged. In that case we will not adjust and remove detection for this damaged file.

Filename Result
Trj_687.vir  CLEAN

The file 'Trj_687.vir' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

Filename Result
Trj_880.vir  MALWARE

The file 'Trj_880.vir' has been determined to be 'MALWARE'. Our analysts named the threat TR/Drop.VB.boa. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

看来有人已经速度上报鸟

kkgh

瑞星
1285-156=1129 不知是不是这样

llgiggs

Avira Antivir PesonalEdition Classic


37=1285-1246-2


Version information:
BUILD.DAT    : 270           15603 Bytes   2007-9-19 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes   2007-8-23 06:16:30
AVSCAN.DLL   : 7.0.6.0       49192 Bytes   2007-8-16 05:23:52
LUKE.DLL     : 7.0.5.3      147496 Bytes   2007-8-14 08:32:48
LUKERES.DLL  : 7.0.6.1       10280 Bytes   2007-8-21 05:35:22
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes   2007-7-18 07:27:16
ANTIVIR1.VDF : 7.0.1.95    3367424 Bytes  2007-12-14 01:01:54
ANTIVIR2.VDF : 7.0.2.49    1339904 Bytes   2008-1-25 00:47:50
ANTIVIR3.VDF : 7.0.2.82     259072 Bytes    2008-2-1 01:12:14
AVEWIN32.DLL : 7.6.0.62    3240448 Bytes    2008-2-2 01:12:14
AVWINLL.DLL  : 1.0.0.7       14376 Bytes   2007-2-26 03:36:28
AVPREF.DLL   : 7.0.2.2       25640 Bytes   2007-7-18 00:39:18
AVREP.DLL    : 7.0.0.1      155688 Bytes   2007-4-16 06:16:24
AVPACK32.DLL : 7.6.0.3      360488 Bytes   2008-1-16 00:46:26
AVREG.DLL    : 7.0.1.6       30760 Bytes   2007-7-18 00:17:08
AVARKT.DLL   : 1.0.0.20     278568 Bytes   2007-8-28 05:26:34
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes   2007-7-18 00:10:20
NETNT.DLL    : 7.0.0.0        7720 Bytes    2007-3-8 04:09:44
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes    2007-8-7 05:38:14
RCTEXT.DLL   : 7.0.62.0      86056 Bytes   2007-8-21 05:50:38
SQLITE3.DLL  : 3.3.17.1     339968 Bytes   2007-7-23 02:37:22

-------------------------------------------------------------------------------------------------

The scan has been done completely.
      1 Scanning directories
   1297 Files were scanned
   1246 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
   1245 files were deleted
      0 files were repaired
   1247 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     51 Files not concerned
      3 Archives were scanned
      0 Warnings
      0 Notes





[ 本帖最后由 llgiggs 于 2008-2-2 10:55 编辑 ]

baba

我先用瑞星杀再用卡巴杀，最后剩25个文件。光用卡巴杀剩31个文件。