PCSL 可疑恶意网站每日分析 20081109

jack518

小红伞厉害,23个

尤金卡巴斯基

Hello.

bot1.exe_ - Backdoor.Win32.Agent.uaq

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

MediaCellConverterSetup.exe_

No malicious code was found in this file.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

Regards, Vladislav Pintiysky
Virus Analyst

will

Multi Command-Line Scanner Report
-------------------------------------------------------------------------   
D:\Desk\Samples\Collect\MCLS\001.cab   
Type: DOS Executable Generic / Extension: .EXE   
MD5 Hash: 1DFC596DBC7DC9D6903381154CA8BDF6   

A-squared ----- Win32.SuspectCrc!IK    
Avast ----- Win32:Trojan-gen {Other}    
Avg ----- PSW.OnlineGames.BFJK     
Antivir ----- TR/Spy.Gen    
BitDefender ----- Trojan.PWS.OnlineGames.AADA    
ClamWin ----- Nothing   
Dr.Web ----- Trojan.PWS.Siggen.29    
Eset ----- a variant of Win32/PSW.OnLineGames.NRD trojan    
Ikarus ----- Win32.SuspectCrc    
Jiangmin ----- TrojanSpy.OnLineGames.euu    
Kaspersky ----- Trojan-GameThief.Win32.OnLineGames.tqza    
Kingsoft ----- Win32.Troj.OnlineGamesT.vy.90588    
Vba32 ----- Trojan-GameThief.Win32.OnLineGames.tqza    

*** 12/13 antivirus engines found virus in this file ***   
-------------------------------------------------------------------------   
D:\Desk\Samples\Collect\MCLS\002.cab   
Type: DOS Executable Generic / Extension: .EXE   
MD5 Hash: D691FE477ACA3D8419B5F67DE5875F28   

A-squared ----- Win32.SuspectCrc!IK    
Avast ----- Win32:Trojan-gen {Other}    
Avg ----- Dropper.Agent.KOQ     
Antivir ----- TR/Spy.Gen    
BitDefender ----- Trojan.PWS.OnlineGames.AADA    
ClamWin ----- Nothing   
Dr.Web ----- Trojan.PWS.Siggen.27    
Eset ----- a variant of Win32/PSW.OnLineGames.NRD trojan    
Ikarus ----- Win32.SuspectCrc    
Jiangmin ----- TrojanSpy.OnLineGames.euu    
Kaspersky ----- Trojan-Dropper.Win32.Agent.yux    
Kingsoft ----- Win32.Troj.OnlineGamesT.vy.90588    
Vba32 ----- Trojan-Dropper.Win32.Agent.yux    

*** 12/13 antivirus engines found virus in this file ***   
-------------------------------------------------------------------------   
D:\Desk\Samples\Collect\MCLS\004.cab   
Type: DOS Executable Generic / Extension: .EXE   
MD5 Hash: D0B493008FA9BC46B8DF9CC1BB95B3B6   

A-squared ----- Trojan-PWS.Win32.Agent.hf!IK    
Avast ----- Win32:Spyware-gen [Trj]    
Avg ----- PSW.OnlineGames.BGEE     
Antivir ----- TR/Spy.Gen    
BitDefender ----- Trojan.PWS.Agent.SGC    
ClamWin ----- Trojan.Starter-12    
Dr.Web ----- Nothing   
Eset ----- a variant of Win32/PSW.OnLineGames.NRF trojan    
Ikarus ----- Trojan-PWS.Win32.Agent.hf    
Jiangmin ----- TrojanSpy.OnLineGames.fbd    
Kaspersky ----- Trojan-GameThief.Win32.Magania.gen    
Kingsoft ----- Win32.Troj.OnlineGames.fd.118837    
Vba32 ----- Trojan-GameThief.Win32.Magania.gen    

*** 12/13 antivirus engines found virus in this file ***   
-------------------------------------------------------------------------   
D:\Desk\Samples\Collect\MCLS\bot1.exe   
Type: Win32 Executable Generic / Extension: .EXE   
MD5 Hash: 1E1A266D43D7E011FF28913EF5BC7CBD   

A-squared ----- BehavesLike.Win32.ProcessHijack!IK    
Avast ----- Win32:Trojan-gen {Other}    
Avg ----- BackDoor.Generic10.HYF     
Antivir ----- TR/Dropper.Gen    
BitDefender ----- Trojan.Agent.AKCN    
ClamWin ----- Nothing   
Dr.Web ----- Nothing   
Eset ----- Nothing   
Ikarus ----- BehavesLike.Win32.ProcessHijack    
Jiangmin ----- Backdoor/Agent.bsip    
Kaspersky ----- Backdoor.Win32.Agent.uaq    
Kingsoft ----- Nothing   
Vba32 ----- Nothing   

*** 8/13 antivirus engines found virus in this file ***   
-------------------------------------------------------------------------   
D:\Desk\Samples\Collect\MCLS\lal222.exe   
Type: Win32 EXE Yoda's Crypter / Extension: .EXE   
MD5 Hash: 875A3741EFEBC3279DD05F05353B5EA6   

A-squared ----- Virus.Win32.Virut.n!IK    
Avast ----- Win32:Rootkit-gen [Rtk]    
Avg ----- BackDoor.RBot.KB     
Antivir ----- TR/Crypt.XPACK.Gen    
BitDefender ----- Packer.RLPack.D    
ClamWin ----- Nothing   
Dr.Web ----- Nothing   
Eset ----- Nothing   
Ikarus ----- Virus.Win32.Virut.n    
Jiangmin ----- Backdoor/VanBot.rd    
Kaspersky ----- Backdoor.Win32.VanBot.ax    
Kingsoft ----- Nothing   
Vba32 ----- Net-Worm.Win32.Kolabc.euw    

*** 9/13 antivirus engines found virus in this file ***   
-------------------------------------------------------------------------   
D:\Desk\Samples\Collect\MCLS\xvid.exe   
Type: Generic Win/DOS Executable / Extension: .EXE   
MD5 Hash: 90F2A4071DFCB1191BC824FB2EEE8694   

A-squared ----- Virus.Win32.Zbot.APR!IK    
Avast ----- Win32:Zbot-APR [Trj]    
Avg ----- Win32/Heur     
Antivir ----- TR/Dropper.Gen    
BitDefender ----- Trojan.Spy.Wsnpoem.JY    
ClamWin ----- Nothing   
Dr.Web ----- Nothing   
Eset ----- a variant of Win32/Kryptik.AR trojan    
Ikarus ----- Virus.Win32.Zbot.APR    
Jiangmin ----- Nothing   
Kaspersky ----- Trojan-Spy.Win32.Zbot.fxt    
Kingsoft ----- Nothing   
Vba32 ----- Nothing   

*** 8/13 antivirus engines found virus in this file ***   
-------------------------------------------------------------------------   

Task done @ 2008/11/09 日 14:50:11.13   

allinwonderi

allinwonderi

[发现安全风险： ]        <W32/Agent.L.gen!Eldorado (not disinfectable, 普通)>        C:\Test\xx\001.cab->exefile
[发现安全风险： ]        <W32/Agent.L.gen!Eldorado (not disinfectable, 普通)>        C:\Test\xx\002.cab->exefile
[发现安全风险： ]        <W32/Agent.L.gen!Eldorado (not disinfectable, 普通)>        C:\Test\xx\003.cab->exefile
[发现安全风险： ]        <W32/OnlineGames.D.gen!GSA (not disinfectable, 普通)>        C:\Test\xx\004.cab->(UPack)
[发现安全风险： ]        <W32/Agent.L.gen!Eldorado (not disinfectable, 普通)>        C:\Test\xx\005.cab->exefile
[发现安全风险： ]        <W32/Agent.L.gen!Eldorado (not disinfectable, 普通)>        C:\Test\xx\006.cab->exefile
[发现安全风险： ]        <W32/Agent.L.gen!Eldorado (not disinfectable, 普通)>        C:\Test\xx\007.cab->exefile
[发现安全风险： ]        <W32/Agent.L.gen!Eldorado (not disinfectable, 普通)>        C:\Test\xx\008.cab->exefile
[发现安全风险： ]        <W32/Agent.L.gen!Eldorado (not disinfectable, 普通)>        C:\Test\xx\009.cab->exefile
[发现安全风险： ]        <W32/Agent.L.gen!Eldorado (not disinfectable, 普通)>        C:\Test\xx\010.cab->exefile
[发现可能安全风险：]        <W32/Heuristic-257!Eldorado (not disinfectable)>        C:\Test\xx\bot1.exe
[发现可能安全风险：]        <W32/Heuristic-210!Eldorado (not disinfectable)>        C:\Test\xx\lal222.exe->(EXECryptor)->(RLPack)->(EXECryptor)

---------------------------------------------------------------------
扫描已结束:        2008-11-9, 15:02:11
用时:        0:00:15

扫描结果:

已扫描的文件:                 19
已感染的对象:         12
已清除的对象:         0
已隔离的文件:         0
---------------------------------------------------------------------