好久不见的SW更新（只免卡巴不免别的囧）

sbbdms

等了好久……新的SW卡巴不杀了，正无比兴奋当中，到VT上一检查……十几二十几个杀软都能杀
看来美国和俄罗斯的矛盾还挺深哪……囧…………我要开始我的库存工作了……8~~

[ 本帖最后由 sbbdms 于 2009-6-8 09:25 编辑 ]

kingmuro

5.exe;C:\Documents and Settings\gxf\桌面\110\new[1];Trojan.Swizzor.based;;
6.exe;C:\Documents and Settings\gxf\桌面\110\new[1];Trojan.Swizzor.based;;
7.exe;C:\Documents and Settings\gxf\桌面\110\new[1];Trojan.Swizzor.based;;
1.exe;C:\Documents and Settings\gxf\桌面\110\new[1];Trojan.Swizzor.based;;
2.exe;C:\Documents and Settings\gxf\桌面\110\new[1];Trojan.Swizzor.based;;
3.exe;C:\Documents and Settings\gxf\桌面\110\new[1];Trojan.Swizzor.based;;
4.exe;C:\Documents and Settings\gxf\桌面\110\new[1];Trojan.Swizzor.based;;

kingmuro

2009-06-08 9:25:56        SYSTEM        1432        Sign of "Win32:Swizzor [Trj]" has been found in "http://bbs.kafan.cn/attachment.php?aid=555099&k=cfc7c29e9ceca65b312e61488f5bec4c&t=1244424298\7.exe" file.  
2009-06-08 9:29:33        gxf        3240        Sign of "Win32:Swizzor [Trj]" has been found in "C:\Documents and Settings\gxf\桌面\110\new[1]\7.exe" file.  
2009-06-08 9:29:36        gxf        3240        Sign of "Win32:Swizzor [Trj]" has been found in "C:\Documents and Settings\gxf\桌面\110\new[1]\2.exe" file.

HC303

G:\virus\new\1.exe
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      The file was deleted!
G:\virus\new\2.exe
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      The file was deleted!
G:\virus\new\3.exe
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      The file was deleted!
G:\virus\new\4.exe
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      The file was deleted!
G:\virus\new\5.exe
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      The file was deleted!
G:\virus\new\6.exe
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      The file was deleted!
G:\virus\new\7.exe
    [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
    [NOTE]      The file was deleted!

aerbeisi

08:06:2009 09:40:06 SEARCHTASK "USER_DEFINED" started...
scan item: E:\5.exe
scan item: E:\6.exe
scan item: E:\7.exe
scan item: E:\1.exe
scan item: E:\2.exe
scan item: E:\3.exe
scan item: E:\4.exe
File scanned: E:\5.exe - SIGNATURE FOUND "Trojan.Win32.Obfuscated"
File scanned: E:\6.exe - SIGNATURE FOUND "Trojan.Win32.Obfuscated"
File scanned: E:\7.exe - SIGNATURE FOUND "Virus.Win32.Swizzor"
File scanned: E:\1.exe - SIGNATURE FOUND "Trojan.Win32.Obfuscated"
File scanned: E:\2.exe - SIGNATURE FOUND "Virus.Win32.Swizzor"
File scanned: E:\3.exe - SIGNATURE FOUND "Trojan-Downloader.Win32.Swizzor"
File scanned: E:\4.exe - SIGNATURE FOUND "Trojan.Swizzor.1"
08:06:2009 09:40:07 SEARCHTASK "USER_DEFINED" FINISHED...
----------------------------------------------------
Directories scanned: 0
Files scanned: 7
Virus found: 7
----------------------------------------------------

tun

CA
File C:\Scan\new\1.exe is infected by virus: Win32/Swizzor!generic
File C:\Scan\new\2.exe is infected by virus: Win32/Swizzor!generic
File C:\Scan\new\3.exe is infected by virus: Win32/Swizzor!generic
File C:\Scan\new\4.exe is infected by virus: Win32/Swizzor!generic
File C:\Scan\new\5.exe is infected by virus: Win32/Swizzor!generic
File C:\Scan\new\6.exe is infected by virus: Win32/Swizzor!generic
File C:\Scan\new\7.exe is infected by virus: Win32/Swizzor!generic

TREND[:27:]
Found [TROJ_GENERIC.APC](    1) in C:\Scan\new\5.exe

sharkkong

Status: Detected   (events: 3)       
2009-6-8 9:43:37        Detected        virus HEUR:Trojan.Win32.Generic        h11p://bbs.kafan.cn/attachment.php?aid=555100&k=b242f50fc6e494cf5e36fa446838e069&t=1244425279//3.exe               
2009-6-8 9:43:40        Detected        virus HEUR:Trojan.Win32.Generic        h11p://bbs.kafan.cn/attachment.php?aid=555099&k=e1da1ad18fefd07a1eb570beb6f03781&t=1244425279//6.exe               
2009-6-8 9:44:33        Detected        virus HEUR:Trojan.Win32.Generic        h11p://bbs.kafan.cn/attachment.php?aid=555099&k=e1da1ad18fefd07a1eb570beb6f03781&t=1244425279//1.exe

2009-6-8 10:09:22        http://bbs.kafan.cn/attachment.p ... t=1244426586//6.exe        Firefox        已拒绝: HEUR:Trojan.Win32.Generic        启发式计算的高威胁级别值       
kis8.0解压扫描miss'

sharkkong

原帖由 冰比冰水冰 于 2009-6-8 10:09 发表
2009-6-8 10:09:22        http://bbs.kafan.cn/attachment.php?aid=555099&k=50b88a7bacff958b44ba8c3ece1e03b8&t=1244426586//6.exe        Firefox        已拒绝: HEUR:Trojan.Win32.Generic        启发式计算的高威胁级别值        
kis8.0解压扫 ...

2010 有3个启发，我上面给出了

KL said:
1.exe_ - Trojan-Downloader.Win32.Obfuscated.srk,
2.exe_ - Trojan.Win32.Obfuscated.ager,
3.exe_ - Trojan-Downloader.Win32.Obfuscated.srl,
4.exe_ - Trojan-Downloader.Win32.Injecter.cyc,
5.exe_ - Trojan-Downloader.Win32.Injecter.cya,
6.exe_ - Trojan-Downloader.Win32.Obfuscated.srm,
7.exe_ - Trojan-Downloader.Win32.Injecter.cyb

linkak

NOD
D:\virus\new\1.exe - Win32/TrojanDownloader.Swizzor.NBT 特洛伊木马 的变种 - 通过删除清除 - 已隔离
D:\virus\new\2.exe - Win32/TrojanDownloader.Swizzor.NBO 特洛伊木马 的变种 - 通过删除清除 - 已隔离
D:\virus\new\3.exe - Win32/TrojanDownloader.Swizzor.NBQ 特洛伊木马 的变种 - 通过删除清除 - 已隔离
D:\virus\new\4.exe - Win32/TrojanDownloader.Swizzor.NBL 特洛伊木马 的变种 - 通过删除清除 - 已隔离
D:\virus\new\5.exe - Win32/TrojanDownloader.Swizzor.NBU 特洛伊木马 的变种 - 通过删除清除 - 已隔离
D:\virus\new\6.exe - Win32/TrojanDownloader.Swizzor.NBK 特洛伊木马 的变种 - 通过删除清除 - 已隔离
D:\virus\new\7.exe - Win32/TrojanDownloader.Swizzor.NBQ 特洛伊木马 的变种 - 通过删除清除 - 已隔离