经常更新的木马(第36次更新)[已开新帖]

显示全部楼层 · 发表于 2008-9-15 01:22:02

原帖由 kato9096 于 2008-9-15 00:58 发表
这是9月15的生成物:

真的很差,运行后便出错退出

已上报卡巴

补回一个

TO KL

Antivirus Version Last Update Result
AhnLab-V3 2008.9.13.0 2008.09.12 -
AntiVir 7.8.1.28 2008.09.12 TR/BHO.Gen
Authentium 5.1.0.4 2008.09.14 -
Avast 4.8.1195.0 2008.09.13 -
AVG 8.0.0.161 2008.09.14 -
BitDefender 7.2 2008.09.14 -
CAT-QuickHeal 9.50 2008.09.13 -
ClamAV 0.93.1 2008.09.14 -
DrWeb 4.44.0.09170 2008.09.14 -
eSafe 7.0.17.0 2008.09.14 Suspicious File
eTrust-Vet 31.6.6087 2008.09.12 -
Ewido 4.0 2008.09.14 -
F-Prot 4.4.4.56 2008.09.14 -
F-Secure 8.0.14332.0 2008.09.14 -
Fortinet 3.113.0.0 2008.09.14 -
GData 19 2008.09.14 -
Ikarus T3.1.1.34.0 2008.09.14 -
K7AntiVirus 7.10.454 2008.09.13 -
Kaspersky 7.0.0.125 2008.09.14 -
McAfee 5383 2008.09.12 -
Microsoft 1.3903 2008.09.14 -
NOD32v2 3440 2008.09.13 probably a variant of Win32/Adware.IeDefender.NGU
Norman 5.80.02 2008.09.12 -
Panda 9.0.0.4 2008.09.14 Suspicious file
PCTools 4.4.2.0 2008.09.14 -
Prevx1 V2 2008.09.14 -
Rising 20.61.42.00 2008.09.12 -
Sophos 4.33.0 2008.09.14 Mal/Emogen-G
Sunbelt 3.1.1633.1 2008.09.13 -
Symantec 10 2008.09.14 -
TheHacker 6.3.0.9.082 2008.09.14 -
TrendMicro 8.700.0.1004 2008.09.12 PAK_Generic.001
VBA32 3.12.8.5 2008.09.14 -
ViRobot 2008.9.12.1375 2008.09.12 -
VirusBuster 4.5.11.0 2008.09.14 -
Webwasher-Gateway 6.6.2 2008.09.14 Trojan.BHO.Gen

[ 本帖最后由 kato9096 于 2008-9-15 01:23 编辑 ]

显示全部楼层 · 发表于 2008-9-15 15:13:56

回48楼:

Hello,

2.exe_ - Trojan.Win32.Agent.adph,

tt.exe_ - Trojan.Win32.Agent.adpi

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vitaly Butuzov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

回51楼:
Hello,

gcait.dll - Trojan-Downloader.Win32.FraudLoad.vccl

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

显示全部楼层 · 发表于 2008-9-15 15:17:04

第10次更新

显示全部楼层 · 发表于 2008-9-15 15:22:38

晚上有空的会把第10次更新的生成放上來.

显示全部楼层 · 发表于 2008-9-15 19:39:12

9月15第2次的生成:
TO KL

显示全部楼层 · 发表于 2008-9-15 23:19:15

第11次更新

显示全部楼层 · 发表于 2008-9-15 23:23:44

Sent to Avira

显示全部楼层 · 发表于 2008-9-15 23:25:16

9月15第3次更新的生成:

[ 本帖最后由 kato9096 于 2008-9-15 23:28 编辑 ]

显示全部楼层 · 发表于 2008-9-16 00:22:50

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\下載\0915-2319cre'
C:\Documents and Settings\Administrator\My Documents\下載\0915-2319cre\新資料夾\a.exe3
[DETECTION] Contains HEUR/Crypted suspicious code
[NOTE]    The detection was classified as suspicious.
[NOTE]    A backup was created as '49338bad.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\My Documents\下載\0915-2319cre\新資料夾\avp.ex_
[DETECTION] Contains HEUR/Malware suspicious code
[NOTE]    The detection was classified as suspicious.
[NOTE]    A backup was created as '493e8bf5.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\My Documents\下載\0915-2319cre\新資料夾\gjavn.dll
[DETECTION] Contains HEUR/Malware suspicious code
[NOTE]    The detection was classified as suspicious.
[NOTE]    A backup was created as '492f8be9.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\My Documents\下載\0915-2319cre\新資料夾\hkcmd.exe3
[DETECTION] Contains HEUR/Malware suspicious code
[NOTE]    The detection was classified as suspicious.
[NOTE]    A backup was created as '49318bea.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\My Documents\下載\0915-2319cre\新資料夾\imjpmig.exe3
[DETECTION] Contains HEUR/Malware suspicious code
[NOTE]    The detection was classified as suspicious.
[NOTE]    A backup was created as '49388bec.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\My Documents\下載\0915-2319cre\新資料夾\ipoint.ex_
[DETECTION] Contains HEUR/Malware suspicious code
[NOTE]    The detection was classified as suspicious.
[NOTE]    A backup was created as '493d8bf0.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\My Documents\下載\0915-2319cre\新資料夾\jusched.ex_
[DETECTION] Contains HEUR/Malware suspicious code
[NOTE]    The detection was classified as suspicious.
[NOTE]    A backup was created as '49418bf5.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\My Documents\下載\0915-2319cre\新資料夾\users64.dat
[DETECTION] Is the TR/Spy.Gen Trojan
[NOTE]    A backup was created as '49338bf3.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2008年9月16日  00:21
Used time: 00:03 Minute(s)

The scan has been done completely.

   2 Scanning directories
   9 Files were scanned
   1 viruses and/or unwanted programs were found
   7 Files were classified as suspicious:
   8 files were deleted
   0 files were repaired
   8 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   0 Archives were scanned
   0 Warnings
   8 Notes

显示全部楼层 · 发表于 2008-9-16 15:19:44

第12次更新

9月16的生成:

TO KL

2.exe33__0 - Trojan-GameThief.Win32.Magania.admo,
a.exe33__1 - Trojan.Win32.Pakes.kmo,
cc.exe3__8 - Trojan-Downloader.Win32.Agent.agym,
ff.exe3__9 - Trojan-GameThief.Win32.OnLineGames.thsk,
tt.exe3__2 - Trojan-GameThief.Win32.Magania.admp

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

[ 本帖最后由 kato9096 于 2008-9-18 19:24 编辑 ]

[病毒样本] 经常更新的木马(第36次更新)[已开新帖]

本帖子中包含更多资源

本帖子中包含更多资源

回复 54楼 kato9096 的帖子

本帖子中包含更多资源

回复 58楼 kato9096 的帖子

本帖子中包含更多资源