样本几个

taoyuan237

http://www.brsbox.com/filebox/down/fc/0dcc52e244a34a6c2ed309faa136c69c

花间酒

25304330         readme.pdf         50.47 KB         UNDER ANALYSIS
25304767         197.exe         104.5 KB         UNDER ANALYSIS
25304768         file.exe         96 KB         UNDER ANALYSIS
25304769         winpc.exe         997.5 KB         UNDER ANALYSIS
25304771         login.srf         4.74 KB         UNDER ANALYSIS

328397663

Hello,

197.exe_ - Trojan-Downloader.Win32.FraudLoad.dzf,
file.exe_ - Trojan.Win32.Tdss.vot,
g.exe_ - Trojan.Win32.AntiAV.asv,
g1.exe_ - Trojan.Win32.AntiAV.asw

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

winpc(1).exe_ - not-a-virus:FraudTool.Win32.WinPCDefender.c

New potentially risk software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

schumi小粉

10 to avast

shuidsf

分享，谢谢

aerbeisi

ledled

VB Kill 6

Sebastian

Starting the file scan:

Begin scan in 'D:\new\new'
D:\new\new\setup.exe
    [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      A backup was created as '4a44144a.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\new\winpc.exe
    [DETECTION] Is the TR/FakeRean.A.6 Trojan
    [NOTE]      A backup was created as '4a3e144e.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\new\winpc(1).exe
    [DETECTION] Is the TR/FakeRean.A.6 Trojan
    [NOTE]      A backup was created as '4a3e144f.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\new\197.exe
    [DETECTION] Is the TR/Drop.Insebro.A Trojan
    [NOTE]      A backup was created as '4a07141f.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\new\a1.css
    --> Object
      [1] Archive type: RSRC
      --> Object
        [DETECTION] Contains recognition pattern of the RKIT/Agent.AIWN.20 root kit
    [DETECTION] Is the TR/Hijacker.Gen Trojan
    [NOTE]      A backup was created as '49fe1417.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\new\exses.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a43145e.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\new\file.exe
    [DETECTION] Contains recognition pattern of the SPR/Tool.Obfuscator.DQ.11 program
    [NOTE]      A backup was created as '4a3c144f.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\new\g.exe
    [DETECTION] Is the TR/Crypt.UPKM.Gen Trojan
    [NOTE]      A backup was created as '4a351414.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\new\g1.exe
    [DETECTION] Is the TR/Crypt.UPKM.Gen Trojan
    [NOTE]      A backup was created as '4888e238.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\new\MDSetup.exe
    [DETECTION] Contains recognition pattern of the DR/Fraud.MalwareDoctor.A.2 dropper
    [NOTE]      A backup was created as '4a23142b.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\new\news.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a47144d.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!


End of the scan: 2009年3月30日  08:35
Used time: 00:03 Minute(s)

The scan has been done completely.

      1 Scanned directories
     14 Files were scanned
     12 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
     11 files were deleted
      0 Viruses and unwanted programs were repaired
     11 Files were moved to quarantine
      0 Files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      0 Archives were scanned
      0 Warnings
     11 Notes