False alarm?

显示全部楼层 · 发表于 2008-6-6 18:56:03

檔案 IlvMoney.dll 接收於 2008.06.06 12:52:55 (CET)
當前狀態: 正在讀取 ... 隊列中等待中掃瞄中完成未發現停止
結果: 16/32 (50%)

反病毒引擎版本最後更新掃瞄結果
AhnLab-V3 2008.5.30.1 2008.06.05 -
AntiVir 7.8.0.26 2008.06.06 TR/Dldr.Dadobra.aef
Authentium 5.1.0.4 2008.06.06 -
Avast 4.8.1195.0 2008.06.06 -
AVG 7.5.0.516 2008.06.06 Downloader.Generic7.KQP
BitDefender 7.2 2008.06.06 Trojan.Generic.263016
CAT-QuickHeal 9.50 2008.06.05 TrojanDownloader.Dadobra.aef
ClamAV 0.92.1 2008.06.06 Trojan.Dadobra-7
DrWeb 4.44.0.09170 2008.06.06 -
eSafe 7.0.15.0 2008.06.05 Win32.Dadobra.aef
eTrust-Vet 31.6.5853 2008.06.06 -
Ewido 4.0 2008.06.06 Downloader.Dadobra.aef
F-Prot 4.4.4.56 2008.06.05 -
F-Secure 6.70.13260.0 2008.06.06 Trojan-Downloader.Win32.Dadobra.aef
Fortinet 3.14.0.0 2008.06.06 -
GData 2.0.7306.1023 2008.06.06 Trojan-Downloader.Win32.Dadobra.aef
Ikarus T3.1.1.26.0 2008.06.06 Trojan-Downloader.Dadobra.aef
Kaspersky 7.0.0.125 2008.06.06 Trojan-Downloader.Win32.Dadobra.aef
McAfee 5311 2008.06.05 -
Microsoft 1.3604 2008.06.06 -
NOD32v2 3163 2008.06.06 -
Norman 5.80.02 2008.06.06 W32/Dadobra.BZU
Panda 9.0.0.4 2008.06.05 -
Prevx1 V2 2008.06.06 Malware Downloader
Rising 20.47.40.00 2008.06.06 -
Sophos 4.30.0 2008.06.06 Mal/Generic-A
Sunbelt 3.0.1145.1 2008.06.05 -
Symantec 10 2008.06.06 -
TheHacker 6.2.92.337 2008.06.06 -
VBA32 3.12.6.7 2008.06.05 Trojan-Downloader.Win32.Dadobra.aef
VirusBuster 4.3.26:9 2008.06.05 -
Webwasher-Gateway 6.6.2 2008.06.06 Trojan.Dldr.Dadobra.aef

to kl檢查下

Hello.

Sorry, it was a false detection. It will be fixed in the next updates.
Thank you for your help.

Please quote all when answering.

-----------------
Regards, Evgeny Aseev
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

[ 本帖最后由 kato9096 于 2008-6-7 18:39 编辑 ]

显示全部楼层 · 发表于 2008-6-6 19:10:54

我认为应该为误报

我认为原程序应该 IlvMoney.exe

那边在线扫描也50%报

国内仅kv报报的名字都一样

[ 本帖最后由 aaad2008 于 2008-6-6 19:16 编辑 ]

显示全部楼层 · 发表于 2008-6-6 19:11:19

对象: IlvMoney/IlvMoney.dll2
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\IlvMoney.zip
Status: 已发现病毒
病毒: Trojan.Generic.263016 (BD 引擎)

显示全部楼层 · 发表于 2008-6-6 20:13:26

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\IlvMoney.zip<ZIP>:IlvMoney.dll2 <- Downloader.Dadobra.Aef : No action

Scanned objects : 2

Infected objects : 1

显示全部楼层 · 发表于 2008-6-6 20:14:45

不需要杀，嘿嘿。

显示全部楼层 · 发表于 2008-6-7 18:39:02

Hello.

Sorry, it was a false detection. It will be fixed in the next updates.
Thank you for your help.

Please quote all when answering.

-----------------
Regards, Evgeny Aseev
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

显示全部楼层 · 发表于 2008-6-7 18:39:29

to antivir

The file 'IlvMoney.dll2' has been determined to be 'UNDER ANALYSIS'.

http://www.threatexpert.com/repo ... e09ce85bb8c539e342a
根本沒有連网行為,所以一定不是downloader

[ 本帖最后由 kato9096 于 2008-6-7 18:41 编辑 ]

显示全部楼层 · 发表于 2008-6-7 18:46:48

反病毒引擎版本最後更新掃瞄結果
AhnLab-V3 2008.5.30.1 2008.06.05 -
AntiVir 7.8.0.55 2008.06.06 TR/Dldr.Dadobra.aef
Authentium 5.1.0.4 2008.06.06 -
Avast 4.8.1195.0 2008.06.07 -
AVG 7.5.0.516 2008.06.06 Downloader.Generic7.KQP
BitDefender 7.2 2008.06.07 Trojan.Generic.263016
CAT-QuickHeal 9.50 2008.06.07 TrojanDownloader.Dadobra.aef
ClamAV 0.92.1 2008.06.07 Trojan.Dadobra-7
DrWeb 4.44.0.09170 2008.06.07 -
eSafe 7.0.15.0 2008.06.05 Win32.Dadobra.aef
eTrust-Vet 31.6.5855 2008.06.06 -
Ewido 4.0 2008.06.06 Downloader.Dadobra.aef
F-Prot 4.4.4.56 2008.06.06 -
F-Secure 6.70.13260.0 2008.06.06 Trojan-Downloader.Win32.Dadobra.aef
Fortinet 3.14.0.0 2008.06.07 -
GData 2.0.7306.1023 2008.06.07 -
Ikarus T3.1.1.26.0 2008.06.07 Trojan-Downloader.Dadobra.aef
Kaspersky 7.0.0.125 2008.06.07 -
McAfee 5312 2008.06.06 -
Microsoft 1.3604 2008.06.07 -
NOD32v2 3165 2008.06.06 -
Norman 5.80.02 2008.06.06 W32/Dadobra.BZU
Panda 9.0.0.4 2008.06.07 -
Prevx1 V2 2008.06.07 Malware Downloader
Rising 20.47.42.00 2008.06.06 -
Sophos 4.30.0 2008.06.07 Mal/Generic-A
Sunbelt 3.0.1145.1 2008.06.05 -
Symantec 10 2008.06.07 -
TheHacker 6.2.92.339 2008.06.07 Trojan/Downloader.Dadobra.aef
VirusBuster 4.3.26:9 2008.06.06 -
Webwasher-Gateway 6.6.2 2008.06.06 Trojan.Dldr.Dadobra.aef

14/31

有2家出庫

在出庫前有一共五家跟卡巴报相同名稱,但在出庫后,这五家中只有卡巴出庫

[ 本帖最后由 kato9096 于 2008-6-7 18:48 编辑 ]

显示全部楼层 · 发表于 2008-6-9 19:49:30

The file 'IlvMoney.dll2' has been determined to be 'DAMAGED FILE (MALWARE)'. In particular this means that this file is damaged and not working properly. Nevertheless we were able to determine that it contains malicious code fragments. Our analysts named the threat TR/Dldr.Dadobra.aef. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.

[病毒样本] False alarm?

本帖子中包含更多资源

本帖子中包含更多资源

ArcaVir2008

浏览过的版块