Obfuscated/Swizzor[第48次更新]

醉一生爱妍

貌似有时候多余的basic virus也会跳出来报的。。

honker_feng

真的不少啊

醉一生爱妍

UGuard 完成了在 C:\Documents and Settings\Administrator\桌面\0818-2012[1] 上的扫描。
================
'Heur.Swizzor.Gen' 在 '9kgen_up.int1' 中被检测到。
'Heur.Swizzor.Gen' 在 '9kgen_up.int2' 中被检测到。
'Heur.Swizzor.Gen' 在 'kr3.int1' 中被检测到。
'Heur.Swizzor.Gen' 在 'kr3.int2' 中被检测到。
'Heur.Swizzor.Gen' 在 'kr3.int3' 中被检测到。
'Heur.Swizzor.Gen' 在 'np_pkz.int1' 中被检测到。
'Heur.Swizzor.Gen' 在 'np_pkz.int2' 中被检测到。
'Heur.Swizzor.Gen' 在 'np_pkz.int3' 中被检测到。
'Heur.Swizzor.Gen' 在 'sn_pkz.int1' 中被检测到。
'Heur.Swizzor.Gen' 在 'sn_pkz.int2' 中被检测到。
'Heur.Swizzor.Gen' 在 'tp_map16.int1' 中被检测到。
'Heur.Swizzor.Gen' 在 'tp_map16.int2' 中被检测到。
'Heur.Swizzor.Gen' 在 'tp_map16.int3' 中被检测到。
'Heur.Swizzor.Gen' 在 'uninstall.exe1' 中被检测到。
'Heur.Swizzor.Gen' 在 'uninstall.exe2' 中被检测到。
'Heur.Swizzor.Gen' 在 'upAYB.int1' 中被检测到。
'Heur.Swizzor.Gen' 在 'upAYB.int2' 中被检测到。
'Heur.Swizzor.Gen' 在 'upAYB.int3' 中被检测到。
'Heur.Swizzor.Gen' 在 'upAYB.int4' 中被检测到。
================
扫描文件数： 19
本次扫描发现了 19 个已知威胁，请及时处理。
实际文件数： 19
扫描时间： 0-00-00 00:00:13:0094
威胁比率： 100%

sam.to

第40次更新

Kitman

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\0819-2355'
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\9kgen_up.int1
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '4911f2e3.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\9kgen_up.int2
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '48692cc4.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\9kgen_up.int3
    [DETECTION] Is the TR/Swizzor.1.3074 Trojan
    [NOTE]      A backup was created as '4911f2e5.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\9kgen_up.int4
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '4911f2e4.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\9kgen_up.int5
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '48692cc5.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\kr3.int1
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '48ddf2eb.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\kr3.int2
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '49a52ccc.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\kr3.int3
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '48ddf2ed.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\np_pkz.int1
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '4909f2e9.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\np_pkz.int2
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '4909f2ea.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\np_pkz.int3
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '48712ccb.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\np_pkz.int4
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '4909f2ec.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\sn_pkz.int1
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '4909f2e8.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\sn_pkz.int2
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '48712cc9.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\sn_pkz.int3
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '48712ccd.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\sn_pkz.int4
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '4909f2ee.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\tp_map16.int1
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '4909f2eb.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\tp_map16.int2
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '48712ccc.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\tp_map16.int3
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '4909f2ed.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\uninstall.exe1
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '4913f2e9.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\uninstall.exe2
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '486b2cca.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\uninstall.exe3
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '4913f2eb.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\upAYB.int1
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '48ebf2eb.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\upAYB.int2
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '49932ccc.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\0819-2355\0819-2355\upAYB.int3
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      A backup was created as '48ebf2ed.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!


End of the scan: 2008年8月20日  00:19
Used time: 00:09 Minute(s)

The scan has been done completely.

      2 Scanning directories
     25 Files were scanned
     25 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     25 files were deleted
      0 files were repaired
     25 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      0 Files not concerned
      0 Archives were scanned
      0 Warnings
     25 Notes

sam.to

就大量的Obfuscated需要上报,本人已向卡巴斯基的香港和俄羅斯公司提出请求,看看有沒有特別方法上报.

sam.to

Hello,
We are writing generic detection, so we already have a lot of samples.

-----------------
Regards, Namestnikov Yury
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com

No part of this message can be made available on the public web,
message board or newsgroup without the permission of the sender.

sbbdms

恭喜恭喜哈！！！
他们又要完善他们的Trojan.Win32.Obfuscated.gen了。
不过，Swizzor的服务器现在似乎已经开始限制下载了，好象同一个IP，在几分钟内连续访问，所得到的文件是一样的。
所以现在，即使是我也很难搞到1000+了……

syfwxmh

卡巴中国最近有可能开通FTP上报方式（说白了就是红伞的网页上报）。

IllusionWing

卡巴要的话，直接把我定的告诉好啦