近日出现山寨版IS网站

sam.to

原帖由 sam.to 于 2009-3-16 19:48 发表
to kl

Hello, detection of this file will surely be included soon.

For now, I can tell that this is a Trojan-dropper, and it's not too dangerous, as I can see.
It drops a downloader, which tries to download some executables, and our antivirus detects them already.

KL分析员说的

[ 本帖最后由 sam.to 于 2009-3-16 21:30 编辑 ]

sam.to

原帖由 za1012 于 2009-3-16 18:19 发表
病毒 (这是什么?)
已发现威胁: 1
这是完整列表:

威胁名称:  W32.HLLP.Yero.Worm.dr  
位置:  http://www.is999.net/utgame43_setup03.exe  
486569

to kl


Detection will be added soon

[ 本帖最后由 sam.to 于 2009-3-16 21:52 编辑 ]

Sebastian

TR/ATRAPS.Gen

zhuwg

开始没注意，在下载后QQ突然掉线，凭多年看A片的经验，中毒了！


经典...

tanlimo

仅仅下载就中毒了，确实经典...

zhuwg

捆绑了一个E语言的下载者

下载列表:http://yx250.com/mm/syxh/mm.txt


[config]
xz1=http://www.yx250.com/mm/syxh/ok1.exe
xz2=http://www.yx250.com/mm/syxh/ok2.exe
xz3=http://www.yx250.com/mm/syxh/ok3.exe
xz4=http://www.yx250.com/mm/syxh/ok4.exe
xz5=http://www.yx250.com/mm/syxh/ok5.exe
xz6=http://www.yx250.com/mm/syxh/ok6.exe
xz7=http://www.yx250.com/mm/syxh/ok7.exe
xz8=http://www.yx250.com/mm/syxh/ok8.exe

[ 本帖最后由 zhuwg 于 2009-3-17 11:49 编辑 ]

Sebastian

原帖由 zhuwg 于 2009-3-17 11:47 发表
捆绑了一个E语言的下载者

下载列表:http://yx250.com/mm/syxh/mm.txt


[config]
xz1=http://www.yx250.com/mm/syxh/ok1.exe
xz2=http://www.yx250.com/mm/syxh/ok2.exe
xz3=http://www.yx250.com/mm/syxh/ ...

8 Files were scanned
8 viruses and/or unwanted programs were found

程序.exe
TR/Dropper.Gen

[ 本帖最后由 Sebastian 于 2009-3-17 11:53 编辑 ]

328397663

原帖由 zhuwg 于 2009-3-17 11:47 发表
捆绑了一个E语言的下载者

下载列表:http://yx250.com/mm/syxh/mm.txt


[config]
xz1=http://www.yx250.com/mm/syxh/ok1.exe
xz2=http://www.yx250.com/mm/syxh/ok2.exe
xz3=http://www.yx250.com/mm/syxh/ ...

1-8卡巴全杀...程序..上报卡巴

sam.to

ab872f59bd0488b56b7378a80953bdbd  is.exe2
to kl

Kitman

Begin scan in 'C:\Users\Kitman\Desktop\is'
C:\Users\Kitman\Desktop\is\is.exe2
    [DETECTION] Is the TR/ATRAPS.Gen Trojan
    [NOTE]      A backup was created as '49eec5e0.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!