2*DL witn other virus（第340-341次更新6X）国内范围最大

显示全部楼层 · 发表于 2009-4-22 14:09:53

本帖最后由 Sherry.ai 于 2010-4-6 18:37 编辑

ha_free_setup.exe-DownLoader
测试时在沙盘中请小心运行ha_free_setup.exe...
运行后会下载一大堆bin，开始疯狂安装恶意插件直至死机

相当XE的说~
时间因素,省去MD5

244-245：http://www.brsbox.com/filebox/down/fc/8796002266e47deb43b8bd47f0b765f8
300-301：http://www.dbank.com/download.action?t=40&k=MTI3ODAxMjY=&pcode=LCwzNjU2NiwzNjU2Ng==&rnd=5948
302-303：http://www.vdisk.cn/down/index/4124035A9907
304-305：http://www.vdisk.cn/down/index/4131298A9377
306-307：http://www.vdisk.cn/down/index/4134631A1704
312-313：http://www.dbank.com/download.action?t=40&k=MTM0MzUwODg=&pcode=LCwzNjU2NiwzNjU2Ng==&rnd=1322
320-321：http://www.dbank.com/download.action?t=40&k=MTM3NzU1MTg=&pcode=LCwzNjU2NiwzNjU2Ng==&rnd=1861
338-339：http://www.brsbox.com/filebox/down/fc/f0081d66a7f727e09dd69943980d5dc8
340-341：http://www.brsbox.com/filebox/down/fc/ec2382799754169b941bc0719760534f

显示全部楼层 · 发表于 2009-4-22 14:10:47

样本呢?

显示全部楼层 · 发表于 2009-4-22 14:12:17

有点卡...上传完毕

[ 本帖最后由 935623508 于 2009-4-22 14:15 编辑 ]

显示全部楼层 · 发表于 2009-4-22 14:24:03

有一个...作者为一个人

显示全部楼层 · 发表于 2009-4-22 15:23:38

Starting the file scan:

Begin scan in 'D:\kafan\game032.exe'
D:\kafan\game032.exe
[DETECTION] This file has been compressed using unusual runtime compression (PCK/NSPack). Please verify the origin of this file.
[NOTE]    A backup was created as '4a5bc6b6.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\ha_free_setup.exe'
D:\kafan\ha_free_setup.exe
  [0] Archive type: RSRC
--> Object
   [DETECTION] Is the TR/Dldr.Agent.xsd Trojan
[DETECTION] Is the TR/Hijacker.Gen Trojan
[NOTE]    A backup was created as '4a4dc6b7.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\newID7ver0420.exe'
D:\kafan\newID7ver0420.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE]    A backup was created as '4a65c6bb.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\player.exe'
D:\kafan\player.exe
[DETECTION] Is the TR/Dldr.Agent.xsd Trojan
[NOTE]    A backup was created as '4a4fc6c6.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\Setup.exe'
Begin scan in 'D:\kafan\svcho.exe'
D:\kafan\svcho.exe
[DETECTION] Is the TR/Hijacker.Gen Trojan
[NOTE]    A backup was created as '4a51c6d1.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\51dd_free_setup.exe'
D:\kafan\51dd_free_setup.exe
  [0] Archive type: RSRC
--> Object
   [DETECTION] Is the TR/Dldr.Agent.xsd Trojan
[DETECTION] Is the TR/Hijacker.Gen Trojan
[NOTE]    A backup was created as '4a52c68d.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\smss.exe'
D:\kafan\smss.exe
[DETECTION] Is the TR/Crypt.CFI.Gen Trojan
[NOTE]    A backup was created as '4a61c6c9.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2009年4月22日  15:25
Used time: 00:08 Minute(s)

The scan has been done completely.

   0 Scanned directories
   8 Files were scanned
   9 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   7 files were deleted
   0 Viruses and unwanted programs were repaired
   7 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   -1 Files not concerned
   0 Archives were scanned
   0 Warnings
   7 Notes

显示全部楼层 · 发表于 2009-4-22 15:28:47

ALL TO DW

显示全部楼层 · 发表于 2009-4-22 17:15:28

To KL

显示全部楼层 · 发表于 2009-4-23 15:04:35

华丽的更新...KA8继续Miss All

显示全部楼层 · 发表于 2009-4-23 15:12:01

继续》。。。

显示全部楼层 · 发表于 2009-4-23 16:04:14

avira kill 4

[病毒样本] 2*DL witn other virus（第340-341次更新6X）国内范围最大

本帖子中包含更多资源

评分

回复 2楼 328397663 的帖子