病毒样本 在上报5x DLL

FLogo

TDDOWNLOAD.rar文件解压后，把那个rar后缀名改成EXE！（谢谢2楼的提醒）

Hello.

New malicious software was found in the attached file. Its detection will be included in the next update.
Thank you for your help.

Trojan-GameThief.Win32.Magania.auka

再次上报的5x dll文件，kaba all 启发！

lujorosu.dll, sadeyoli.dll - Trojan-Downloader.Win32.BHO.ggf,
pagifali.dll - Trojan-Spy.Win32.Agent.xbl,
tagusoka.dll - Trojan-Spy.Win32.Agent.xbm

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

pihqlr.dll - not-a-virus:AdWare.Win32.SuperJuan.gzt

This file is an Advertizing Tool, It's detection will be included in the next
update of extended databases set. See more info about
extended databases here: http://www.kaspersky.com/extraavupdates

Please quote all when answering.
The answer is relevant to the latest bases from update sources.



[ 本帖最后由 FLogo 于 2009-2-1 15:27 编辑 ]

xyao

把里面的RAR改成EXE就行了

微点

[ 本帖最后由 xyao 于 2009-2-1 09:29 编辑 ]

Tynox

第一包红伞报壳TR/Crypt.XPACK.Gen Trojan
第二包红伞报TR/Spy.Agent.wlf Trojan
WebGuard

su-tt

C:\Documents and Settings\Administrator\桌面\bingdu.rar > RAR > lujorosu.dll - Win32/Adware.Virtumonde 应用程序
C:\Documents and Settings\Administrator\桌面\bingdu.rar > RAR > sadeyoli.dll - Win32/Adware.Virtumonde 应用程序
C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar > RAR > TDDOWNLOAD\NB_Server-VM.rar - 可能是 Win32/Agent.DKR 特洛伊木马 的变种

simple

Begin scan in 'C:\Users\LeiLei\Desktop\TDDOWNLOAD.rar'
C:\Users\LeiLei\Desktop\TDDOWNLOAD.rar
    [0] Archive type: RAR
    --> TDDOWNLOAD\NB_Server-VM.rar
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      The file was deleted!

Begin scan in 'C:\Users\LeiLei\Desktop\bingdu.rar'
C:\Users\LeiLei\Desktop\bingdu.rar
    [0] Archive type: RAR
    --> pagifali.dll
      [DETECTION] Is the TR/Spy.Agent.wlf Trojan
    --> pihqlr.dll
      [DETECTION] Contains recognition pattern of the ADSPY/SuperJuan.gox adware or spyware
    [NOTE]      The file was deleted!

jijiasd

咖啡全miss
File(s)
        Total files: ...........       6
        Clean: .................       6
        Not scanned: ...........       0
        Possibly Infected: .....       0

q534880003

微点kill

yeandwo

第二个 avast  Win32:Trojan-gen {Other}

woai_jolin

2009/2/1 11:14:16        Document protection        file        http://bbs.kafan.cn/attachment.p ... e5&t=1233458036        probably a variant of Win32/Agent.DKR trojan        deleted (after the next restart) - quarantined        Jason-PC\Jason

woai_jolin

http://bbs.kafan.cn/attachment.p ... 84&t=1233458082        Win32/Adware.Virtumonde application        deleted (after the next restart) - quarantined       
http://bbs.kafan.cn/attachment.p ... 84&t=1233458082 » RAR » tagusoka.dll        is OK               
http://bbs.kafan.cn/attachment.p ... 84&t=1233458082 » RAR » lujorosu.dll        Win32/Adware.Virtumonde application        was a part of the deleted object       
http://bbs.kafan.cn/attachment.p ... 84&t=1233458082 » RAR » pagifali.dll        is OK               
http://bbs.kafan.cn/attachment.p ... 84&t=1233458082 » RAR » pihqlr.dll        is OK               
http://bbs.kafan.cn/attachment.p ... 84&t=1233458082 » RAR » sadeyoli.dll        Win32/Adware.Virtumonde application        was a part of the deleted object