Dropped 1x

FLogo

hxxp://xz2.177bt.com/QvodSetup3.exe
hxxp://xz1.177bt.com/QvodSetup3.exe

to kaba kill,waiting for reply。。。

Здравствуйте,
Hello,

QvodSetup3.exe_ - Trojan.Win32.Zapchast.se

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

这个病毒又开始更新样本了！（关闭沙盘的网络外链，运行这个程序，或许你会知道答案的）

文件 QvodSetup3.zip 接收于 2009.02.19 00:47:53 (CET)
当前状态: 正在读取 ... 队列中 等待中 扫描中 完成 未发现 停止

结果: 9/39 (23.08%)

Email:

反病毒引擎	版本	最后更新	扫描结果
a-squared	4.0.0.93	2009.02.18	-
AhnLab-V3	2009.2.19.0	2009.02.18	-
AntiVir	7.9.0.83	2009.02.18	-
Authentium	5.1.0.4	2009.02.18	-
Avast	4.8.1335.0	2009.02.18	Win32:Trojan-gen {Other}
AVG	8.0.0.237	2009.02.19	SHeur2.OYI
BitDefender	7.2	2009.02.19	Dropped:Generic.Malware.P!Tk.485664E7
CAT-QuickHeal	10.00	2009.02.18	-
ClamAV	0.94.1	2009.02.18	-
Comodo	983	2009.02.18	-
DrWeb	4.44.0.09170	2009.02.19	-
eSafe	7.0.17.0	2009.02.18	-
eTrust-Vet	31.6.6364	2009.02.19	-
F-Prot	4.4.4.56	2009.02.18	-
F-Secure	8.0.14470.0	2009.02.18	-
Fortinet	3.117.0.0	2009.02.18	-
GData	19	2009.02.19	Dropped:Generic.Malware.P!Tk.485664E7
Ikarus	T3.1.1.45.0	2009.02.18	-
K7AntiVirus	7.10.630	2009.02.18	-
Kaspersky	7.0.0.125	2009.02.19	-
McAfee	5529	2009.02.17	-
McAfee+Artemis	5529	2009.02.17	-
Microsoft	1.4306	2009.02.18	-
NOD32	3866	2009.02.18	Win32/TrojanDownloader.Agent.OUG
Norman	6.00.06	2009.02.18	W32/Zapchast.CMR
nProtect	2009.1.8.0	2009.02.18	Dropped:Generic.Malware.P!Tk.485664E7
Panda	9.4.3.20	2009.02.18	-
PCTools	4.4.2.0	2009.02.18	-
Prevx1	V2	2009.02.19	-
Rising	21.17.22.00	2009.02.18	-
SecureWeb-Gateway	6.7.6	2009.02.18	-
Sophos	4.38.0	2009.02.18	-
Sunbelt	3.2.1855.2	2009.02.17	VIPRE.Suspicious
Symantec	10	2009.02.19	-
TheHacker	6.3.2.2.259	2009.02.18	Trojan/Zapchast.rj
TrendMicro	8.700.0.1004	2009.02.18	-
VBA32	3.12.10.0	2009.02.18	-
ViRobot	2009.2.18.1613	2009.02.18	-
VirusBuster	4.5.11.0	2009.02.18	-

附加信息

File size: 2504370 bytes

MD5...: 5d19dd20d46e28d09c80fcad7fa546c4

SHA1..: 84ac918de268a70154010668728136f52c634b5c

SHA256: 16cd058f674604d56d44e1671d3db44cdb7da5c9a599c3c5a748e343f376279a

SHA512: 3fa1008ae5d8df7e5f1267bc8a528c0ef04bb001e88dd37c520f92e5e7cb0def 967f8b7840a08fdb1062da8688dc63e54572028fd38f8af9b233e3fba6c8db11

ssdeep: 49152:qUHX0EBVI9cx8FTk9uOtXZ/5peIKP2G2ar4PioEJMpw5j8pdmah:qc0wCG VuiGNicepdmah

PEiD..: -

TrID..: File type identification ZIP compressed archive (100.0%)

PEInfo: -

packers (F-Prot): Aspack

packers (Kaspersky): PE_Patch

[ 本帖最后由 FLogo 于 2009-2-19 07:55 编辑 ]

FLogo

效果图：

FLogo

在上报一个cdur 病毒样本吧！
to kaba kill,waiting for reply。。。

Hello,


1.exe_ - Trojan.Win32.CDur.bgc

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

[ 本帖最后由 FLogo 于 2009-2-19 09:25 编辑 ]

日游泳池

NOD32 MISS…………

zhanyuchenbobo

FSCS8

Hello,

Thank you for your e-mail.

The file you sent was found to be malicious. An appropriate detection will be added in one of the next database updates.

Our latest database updates are available here:

http://www.f-secure.com/download-purchase/updates.shtml

Have a nice day!

--
F-Secure Security Labs              http://www.f-secure.com/weblog/
F-Secure Corporation                http://www.f-secure.com/
BE SURE.

[ 本帖最后由 zhanyuchenbobo 于 2009-2-19 09:54 编辑 ]

ledled

VirusBuster found nothing

Sebastian

Starting the file scan:

Begin scan in 'D:\1.rar'
D:\1.rar
    [0] Archive type: RAR
    --> 1.exe
      [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      The file was deleted!

江湖的fans

貌似过微点

kkgh

费尔  Trojan.CDur.bgc.nwxm