8x（1L:exploit trojan 4L:Backdoor QQpass）

幸福的猪猪

RT

kaba miss ，to kill ！(3x.zip压缩包中的p.pdf， kaba已经可以查杀，kaba报：Exploit.Win32.Pidief.avj
TDDOWNLOAD.zip压缩包中的PDF文件，kaba 不能识别）


PDF解密时要用到的xor密匙为：21

Hello,

activex.exe - Trojan.Win32.Inject.aatw
bao.exe_ - Worm.Win32.AutoRun.fxc,
pef.pdf - Exploit.Win32.Pidief.avl

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.



[ 本帖最后由 幸福的猪猪 于 2009-5-22 14:31 编辑 ]

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\Administrator\Desktop\TDDOWNLOAD'
C:\Users\Administrator\Desktop\TDDOWNLOAD\TDDOWNLOAD\activex.exe
    [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      The file was deleted!
C:\Users\Administrator\Desktop\TDDOWNLOAD\TDDOWNLOAD\bao.exe
    [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      The file was deleted!
C:\Users\Administrator\Desktop\TDDOWNLOAD\TDDOWNLOAD\xp.exe
    [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      The file was deleted!


End of the scan: 2009年5月21日  16:39
Used time: 00:03 Minute(s)

The scan has been done completely.

      2 Scanned directories
      5 Files were scanned
      3 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      3 files were deleted
      0 Viruses and unwanted programs were repaired
      0 Files were moved to quarantine
      0 Files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      0 Archives were scanned
      0 Warnings
      3 Notes

jason_jiang

EAV4 killed 3
missed 2 PDFs

幸福的猪猪

在上报2x Backdoor  （kaba heur） 1x QQpass（kaba miss）

to kaba kill ！

kingmuro

2009-05-21 15:03:44        gxf        2132        Sign of "Win32:Perkesh [Rtk]" has been found in "C:\Documents and Settings\gxf\桌面\110\桌面\xx.exe\[UPX]\[Embedded_Ix#7480]" file.  
2009-05-21 18:37:58        SYSTEM        1176        Sign of "Win32:Trojan-gen {Other}" has been found in "http://bbs.kafan.cn/attachment.php?aid=540645&k=647682ebb458f49cf9c0f3e6355fad73&t=1242902263\QQ.exe\[Embedded_R#2478c]" file.  
2009-05-22 9:04:33        SYSTEM        1176        Sign of "Win32:Rootkit-gen [Rtk]" has been found in "http://bbs.kafan.cn/attachment.php?aid=541022&k=3c9fc3db82de58125890f2564ec854f9&t=1242954264\TDDOWNLOAD\bao.exe" file.  
2009-05-22 9:20:00        gxf        1712        Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\Documents and Settings\gxf\桌面\110\3x\TDDOWNLOAD\bao.exe" file.

Sebastian

Starting the file scan:

Begin scan in 'D:\kafan\1.exe'
D:\kafan\1.exe
    [DETECTION] Contains a recognition pattern of the (harmful) BDS/Hupigon.Gen back-door program
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2.exe'
D:\kafan\2.exe
    [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\3.exe'
D:\kafan\3.exe
  [0] Archive type: RSRC
    --> Object
      [DETECTION] Is the TR/PSW.Stealer.24064 Trojan
    [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      The file was deleted!


End of the scan: 2009年5月22日  09:27
Used time: 00:02 Minute(s)

The scan has been done completely.

      0 Scanned directories
      3 Files were scanned
      4 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      3 files were deleted
      0 Viruses and unwanted programs were repaired
      0 Files were moved to quarantine
      0 Files were renamed
      0 Files cannot be scanned
     -1 Files not concerned
      0 Archives were scanned
      0 Warnings
      3 Notes

mikzh

检测到 一个毒...

sunshine2009

大蜘蛛，AVG被过掉

布施大行

伞   检出

             [检测]        Is the TR/Spy.Gen Trojan
                           
                          [检测]        Is the TR/Crypt.XPACK.Gen Trojan

布施大行

伞  检出

         [检测]        Is the TR/Crypt.XPACK.Gen Trojan

                   [检测]        Is the TR/PSW.Stealer.24064 Trojan

                  [检测]        Is the TR/Crypt.XPACK.Gen Trojan

                      [检测]        Contains a recognition pattern of the (harmful) BDS/Hupigon.Gen back-door program