加了壳的猛毒

wangjay1980

Hello,

cspkkvbto.dll - Trojan.Win32.Delf.bpp

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Yury Nesmachny
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: cspkkvbto.zip[:1:]

我是小行

ASPack 2.12 -> Alexey Solodovnikov

008F8001 >  60              PUSHAD
008F8002    E8 03000000     CALL cspkkvbt.008F800A
008F8007  - E9 EB045D45     JMP 45EC84F7
008F800C    55              PUSH EBP
008F800D    C3              RETN
008F800E    E8 01000000     CALL cspkkvbt.008F8014
008F8013    EB 5D           JMP SHORT cspkkvbt.008F8072
008F8015    BB EDFFFFFF     MOV EBX,-13
008F801A    03DD            ADD EBX,EBP
008F801C    81EB 00800800   SUB EBX,88000
008F8022    83BD 22040000 0>CMP DWORD PTR SS:[EBP+422],0
008F8029    899D 22040000   MOV DWORD PTR SS:[EBP+422],EBX
008F802F    0F85 65030000   JNZ cspkkvbt.008F839A
008F8035    8D85 2E040000   LEA EAX,DWORD PTR SS:[EBP+42E]
008F803B    50              PUSH EAX
008F803C    FF95 4D0F0000   CALL DWORD PTR SS:[EBP+F4D]
008F8042    8985 26040000   MOV DWORD PTR SS:[EBP+426],EAX
008F8048    8BF8            MOV EDI,EAX
008F804A    8D5D 5E         LEA EBX,DWORD PTR SS:[EBP+5E]
008F804D    53              PUSH EBX
008F804E    50              PUSH EAX
008F804F    FF95 490F0000   CALL DWORD PTR SS:[EBP+F49]
008F8055    8985 4D050000   MOV DWORD PTR SS:[EBP+54D],EAX
008F805B    8D5D 6B         LEA EBX,DWORD PTR SS:[EBP+6B]
008F805E    53              PUSH EBX
008F805F    57              PUSH EDI
008F8060    FF95 490F0000   CALL DWORD PTR SS:[EBP+F49]
008F8066    8985 51050000   MOV DWORD PTR SS:[EBP+551],EAX
008F806C    8D45 77         LEA EAX,DWORD PTR SS:[EBP+77]

[ 本帖最后由 我是小行 于 2008-4-14 00:41 编辑 ]

hahacomcn

Begin scan in 'C:\Documents and Settings\haha\桌面\cspkkvbto.rar'
C:\Documents and Settings\haha\桌面\cspkkvbto.rar
  [0] Archive type: RAR
  --> cspkkvbto.dll
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      A backup was created as '4872c057.qua'  ( QUARANTINE )


End of the scan: 2008年4月14日  10:22
Used time: 00:02 min

The scan has been done completely.

      0 Scanning directories
      3 Files were scanned
      1 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

capsshift

看到有人用红伞试了，搞定。

Nblock

微点发现未知木马 未知后门程序

aribeth199

卡巴已删除：木马程序 Trojan.Win32.Delf.bpp        文件: F:\Download\cspkkvbto.rar/cspkkvbto.dll//ASPack

hellobaby

我用大蜘蛛扫描，终于搞定了。同时，大蜘蛛还搞定了本单位的新“毒王”，对这个只有不到十兆的东东刮目相看。

xiaoxilanyu

检测又是特洛伊木马。。。。

啊弥陀佛

一个DLL文件

28654621

卡巴斯基反病毒 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=239994 is infected with Trojan.Win32.Delf.bpp virus