Obfuscated/Swizzor[第48次更新]

显示全部楼层 · 发表于 2008-8-22 20:22:23

你直接去俄罗斯论坛PM那里的KL RUSSIA TEAM就可以了,我已经和KL CHINA TEAM说了,他已经发送到KL RUSSIA了,等待回复ing

显示全部楼层 · 发表于 2008-8-23 23:51:03

第42次更新

显示全部楼层 · 发表于 2008-8-24 00:00:59

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\0823-2337'
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\9kgen_up.int1
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '49173487.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\9kgen_up.int2
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '486be1a0.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\9kgen_up.int3
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '49173489.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\9kgen_up.int4
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '486be1a2.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\kr3.int1
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '48e3348e.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\kr3.int2
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '499fe1a7.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\kr3.int3
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '48e33480.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\np_pkz.int1
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '490f348c.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\np_pkz.int2
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '4873e1a5.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\np_pkz.int3
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '490f348e.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\sn_pkz.int1
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '490f348a.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\sn_pkz.int2
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '4873e1a3.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\sn_pkz.int3
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '490f348b.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\tp_map16.int1
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '490f348d.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\tp_map16.int2
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '4873e1a6.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\tp_map16.int3
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '490f348f.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\uninstall.exe1
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '4919348b.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\uninstall.exe2
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '4865e1a4.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\uninstall.exe3
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '4919348d.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\upAYB.int1
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '48f1348d.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\upAYB.int2
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE]    A backup was created as '498de1a6.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\0823-2337\0823-2337\upAYB.int3
[DETECTION] Is the TR/Swizzor.1.3048 Trojan
[NOTE]    A backup was created as '48f1348f.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2008年8月24日  00:00
Used time: 00:03 Minute(s)

The scan has been done completely.

   2 Scanning directories
   22 Files were scanned
   22 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   22 files were deleted
   0 files were repaired
   22 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   0 Files not concerned
   0 Archives were scanned
   0 Warnings
   22 Notes

显示全部楼层 · 发表于 2008-8-27 18:30:04

第43次更新

显示全部楼层 · 发表于 2008-8-27 18:32:31

原帖由 sbbdms 于 2008-8-22 19:28 发表
虽然是一个令人兴奋的消息
但是
Swizzors那边已经开始限制下载了......
同一IP在短时间内下载所得的文件几乎是一样的......
晕~
这样子就很难搞出大量样本了......
太可恶了......~

qianwenxiang的原理加了IP的较验。。。~

显示全部楼层 · 发表于 2008-8-30 15:43:03

第44次更新

显示全部楼层 · 发表于 2008-8-30 15:46:11

....all killed

显示全部楼层 · 发表于 2008-9-1 23:18:42

[第45次更新

显示全部楼层 · 发表于 2008-9-2 13:26:05

现在可以了

显示全部楼层 · 发表于 2008-9-3 17:26:19

第46次更新

[病毒样本] Obfuscated/Swizzor[第48次更新]

回复 29楼 spicalhook 的帖子

回复 37楼 kato9096 的帖子