新年快乐附赠样本及衍生物

显示全部楼层 · 发表于 2008-2-8 12:03:09

Hello,

######V1.1.exe_ - Trojan-Dropper.Win32.Joiner.bq,
SVCHOST.RA - Backdoor.Win32.Hupigon.ausq

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Ermilov Maxim
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: SVCHOST.rar
> Attachment: ??????V1.1.rar

显示全部楼层 · 发表于 2008-2-8 12:11:16

IK
I:\virus\test\SVCHOST.rar:\SVCHOST.RA - Suspect code-parts found (Level: 95)
I:\virus\test\SVCHOST.rar
I:\virus\test\身份证生成器V1[1].1.rar:\身份证生成器V1.1.exe - Signature 'Backdoor.Pcclient.SYX' found
I:\virus\test\身份证生成器V1[1].1.rar
4 Files scanned
(2 Archives with 2 files)
1 Signature found
1 Suspect code-part found
Used time: 0:00.250

---------------------------------

后台启动IE，修改其内存，访问网络

[/quote]

文件释放如图

[quote]

[ 本帖最后由冷_冷于 2008-2-8 12:21 编辑 ]

显示全部楼层 · 发表于 2008-2-8 15:22:08

两个全报AVAST!

显示全部楼层 · 发表于 2008-2-8 17:12:00

卡巴也报......

显示全部楼层 · 发表于 2008-2-8 17:16:28

kaspersky 8.0pass

显示全部楼层 · 发表于 2008-2-8 17:51:42

The file '############V1.1.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Drop.Joiner.BQ. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Crypted.

显示全部楼层 · 发表于 2008-2-8 18:51:03

C:\Documents and Settings\gho\桌面\SVCHOST.RA New Malware.fi (Trojan)

显示全部楼层 · 发表于 2008-2-8 19:35:29

F-secure

身份证生成器V1.1.rar: Trojan-Dropper.Win32.Joiner.bq
SVCHOST.rar: Backdoor.Win32.Hupigon.ausq

显示全部楼层 · 发表于 2008-2-8 20:05:55

已检测到: 木马程序 Trojan-Dropper.Win32.Joiner.bq URL: http://bbs.kafan.cn/attachment.php?aid=197818//身份证生成器V1.1.exe
已检测到: 木马程序 Backdoor.Win32.Hupigon.ausq URL: http://bbs.kafan.cn/attachment.php?aid=197819//SVCHOST.RA

显示全部楼层 · 发表于 2008-2-8 20:06:36

rising20.30.40未认得！

[病毒样本] 新年快乐附赠样本及衍生物

本帖子中包含更多资源

回复 2楼 Graybird 的帖子

[病毒样本] 新年快乐 附赠样本及衍生物

本帖子中包含更多资源

回复 2楼 Graybird 的帖子

[病毒样本] 新年快乐附赠样本及衍生物