8(13楼有新)

显示全部楼层 · 发表于 2009-4-13 00:32:54

0cc1f2f0d57ee7e55030f8363bc4165a  file.exe2
a7319c754d1982c2d066dc2a88eb15ea  Dynamic.dl2l
00e28564fccd7fb41224f0a2ccb7daa0  stinger.exe2
bedf8b9e0e6720491a1f56acf385ddd7  INScript.dll2
6a87f2db6041db9aedfcf2e51e07fb27  wtaqlu.exe2
dc0e6fad5fd566399169461d97f882b1  videos.exe1
e0355443b2b51f83c8178fb96f9dd2b0  winav.exe2
1d285efc91bdc80476cd482b4e2eeaa1  bbot.exe1
5e246d53b36c7f361b7a2de10daf635d  install.exe2
to kl
videos.exe1 - Trojan-Banker.Win32.Banker.agmv
bbot.exe1 - Trojan.Win32.Agent2.hqm,
Dynamic.dl2l - Trojan-Banker.Win32.Agent.kx,
install.exe2 - Trojan.Win32.Inject.sng
winav.exe2 - not-a-virus:FraudTool.Win32.Agent.mh

INScript.dll2, stinger.exe2, wtaqlu.exe2
No malicious code were found in these files.

4月15日再跟进wtaqlu.ex_e:
wtaqlu.ex_e - Trojan-Spy.Win32.Zbot.rzp

[ 本帖最后由 sam.to 于 2009-4-22 12:28 编辑 ]

显示全部楼层 · 发表于 2009-4-13 00:38:46

DW
Dynamic.dl2l - infected with Trojan.DownLoad.33374
winav.exe2 - infected with Trojan.Fakealert.4161
install.exe2 - infected with Trojan.Siggen.2144
bbot.exe1 - infected with Trojan.MulDrop.13277

显示全部楼层 · 发表于 2009-4-13 09:22:09

显示全部楼层 · 发表于 2009-4-15 08:09:31

名称: Packed/Pohernah
类型: Packer

描述:

文件:
c:\users\administrator\desktop\000008\bbot.exe1

名称: Packed/XPack
类型: Packer

描述:

文件:
c:\users\administrator\desktop\000008\dynamic.dl2l

显示全部楼层 · 发表于 2009-4-15 16:59:42

a6b023922e3f37ab8a71401d1f127930 winav.exe_
9181f6115bb963395c60f4a1a4826e53 install.exe_
to kl

Hello,

install.exe_ - Trojan-Downloader.Win32.FraudLoad.vppa

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

winav.exe_ - not-a-virus:FraudTool.Win32.WinPCDefender.j

New potentially risk software was found in this file. It's detection will be included in the next update. Thank you for your help.

[ 本帖最后由 sam.to 于 2009-4-15 20:06 编辑 ]

显示全部楼层 · 发表于 2009-4-15 17:04:22

to VB

显示全部楼层 · 发表于 2009-4-16 16:39:15

谢谢楼主上传样本，下来学习下

显示全部楼层 · 发表于 2009-4-16 16:44:44

Starting the file scan:

Begin scan in 'D:\kafan\bbot.exe1'
D:\kafan\bbot.exe1
[DETECTION] Is the TR/Dldr.Agent.oys Trojan
[NOTE]    A backup was created as '4a55f0a3.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\Dynamic.dl2l'
D:\kafan\Dynamic.dl2l
[DETECTION] Is the TR/Crypt.NSPM.Gen Trojan
[NOTE]    A backup was created as '4a54f0bb.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\INScript.dll2'
Begin scan in 'D:\kafan\install.exe2'
D:\kafan\install.exe2
[DETECTION] Is the TR/ATRAPS.Gen Trojan
[NOTE]    A backup was created as '4a59f0b0.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\stinger.exe2'
Begin scan in 'D:\kafan\videos.exe1'
D:\kafan\videos.exe1
[DETECTION] Is the TR/Banker.Banker.agmv Trojan
[NOTE]    A backup was created as '4a4af0ac.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\winav.exe2'
D:\kafan\winav.exe2
[DETECTION] Contains recognition pattern of the PHISH/Fraud.Agent.MH phishing file/email
[NOTE]    A backup was created as '4a54f0ad.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\wtaqlu.exe2'
D:\kafan\wtaqlu.exe2
[DETECTION] Is the TR/Spy.ZBot.JF Trojan
[NOTE]    A backup was created as '4a47f0b8.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\install.exe_'
D:\kafan\install.exe_
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[NOTE]    A backup was created as '4a59f0b2.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\winav.exe_'
D:\kafan\winav.exe_
[DETECTION] Is the TR/FakeRean.A.14 Trojan
[NOTE]    A backup was created as '4b2bc176.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2009年4月16日  16:45
Used time: 00:03 Minute(s)

The scan has been done completely.

   0 Scanned directories
   10 Files were scanned
   8 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   8 files were deleted
   0 Viruses and unwanted programs were repaired
   8 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   0 Archives were scanned
   0 Warnings
   8 Notes

显示全部楼层 · 发表于 2009-4-16 22:45:29

61e9f0322c54d09dcecee7e39bb88489 winav.exe_
f45b26831202fac3484daa6dbce7739f nstall.exe_
to kl

nstall.exe_ - Trojan-Downloader.Win32.FraudLoad.efy
winav.exe_ - not-a-virus:FraudTool.Win32.WinPCDefender.o

[ 本帖最后由 sam.to 于 2009-4-22 22:21 编辑 ]

显示全部楼层 · 发表于 2009-4-16 23:06:24

DW
winav.exe_ - infected with Trojan.Fakealert.4161
TO 1

[病毒样本] 8(13楼有新)

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

回复 5楼 sam.to 的帖子

本帖子中包含更多资源

回复 9楼 sam.to 的帖子