[病毒样本] 5x

显示全部楼层 · 发表于 2009-7-7 18:14:20

File ID          Filename                      Size (Byte)    Result
25391042    load.exe                      28 KB             MALWARE
25391378    voegol.exe                      498.5 KB             UNDER ANALYSIS
25387789    socksbot_jun30.exe       22.5 KB             MALWARE
25391688    foto.dll                               591 KB             MALWARE
25391072    IEupdate.exe                511.61 KB    MALWARE

显示全部楼层 · 发表于 2009-7-7 18:19:55

金山 0

显示全部楼层 · 发表于 2009-7-7 18:25:59

IKARUS - T3SCAN V1.32.10.0 (WIN32)
      T3 V1.01.64
      Copyright (c) 2006 - 2009 by Ikarus Software.
      All rights reserved.

Signature-database from 7.7.2009 08:01:17 (Build: 72992)

e:\5x.rar:load.exe - Signature 'Spammer' found
e:\5x.rar:voegol.exe - Signature 'Virus.Win32.Banker.BOT' found
e:\5x.rar:socksbot_jun30.exe - Signature 'Gen.Trojan' found
e:\5x.rar:foto.dll - Signature 'Trojan-Spy.Win32.Banker' found
e:\5x.rar - Signature 'Gen.Trojan' found

      6 Files scanned
      (1 Archiv with 5 files)
      5 Signatures found
      0 Suspect code-parts found
      Used time: 0:01.547

显示全部楼层 · 发表于 2009-7-7 18:28:00

Log is generated by AjLL.

< Sophos >
load.exe --- Mal/Behav-321
voegol.exe --- Mal/DelpBanc-A

显示全部楼层 · 发表于 2009-7-7 18:29:38

7/7/2009 18:31:59 Detected: Email-Worm.Win32.Joleee.cjq C:\Documents and Settings\kato\桌面\5x\load.exe
7/7/2009 18:32:00 Detected: Trojan-Banker.Win32.Banker.akkf C:\Documents and Settings\kato\桌面\5x\foto.dll
7/7/2009 18:32:00 Detected: Trojan.Win32.Autoit.zs C:\Documents and Settings\kato\桌面\5x\IEupdate.exe/PE_Patch.UPX/UPX/Mail.au3.tbl.decoded
7/7/2009 18:32:20 Processing error: Trojan.Win32.Autoit.zs C:\Documents and Settings\kato\桌面\5x\IEupdate.exe/PE_Patch.UPX/UPX
7/7/2009 18:32:20 Detected: Backdoor.Win32.Agent.aihk C:\Documents and Settings\kato\桌面\5x\socksbot_jun30.exe
7/7/2009 18:32:20 Detected: Trojan-Banker.Win32.Bancos.eia C:\Documents and Settings\kato\桌面\5x\voegol.exe
卡巴清空

大師missed all,已上报

[ 本帖最后由 sam.to 于 2009-7-7 18:33 编辑 ]

显示全部楼层 · 发表于 2009-7-7 19:19:00

NOD32
MISS 2
RAR > load.exe Win32/Kryptik.WX 特洛伊木马的变种是已删除对象的一部分
RAR > socksbot_jun30.exe Win32/Isnup 特洛伊木马是已删除对象的一部分
RAR > IEupdate.exe Win32/Packed.Autoit.Gen 潜在的不受欢迎应用程序是已删除对象的一部分
RAR > IEupdate.exe > AUTOIT > script.au3 Win32/Packed.Autoit.Gen 潜在的不受欢迎应用程序是已删除对象的一部分

[ 本帖最后由 hansyu 于 2009-7-7 19:20 编辑 ]

显示全部楼层 · 发表于 2009-7-7 19:23:52

MP Miss 2
To MP

显示全部楼层 · 发表于 2009-7-7 22:47:23

McAfee 报了3个。。

显示全部楼层 · 发表于 2009-7-7 22:51:29

瑞星2010全杀。。。。
Trojan.Win32.Generic.11EA0C30
Trojan.Win32.Generic.11EA0C32
Trojan.Win32.Generic.11EA0C31
Trojan.Win32.Generic.11EA0C2F
Trojan.Win32.Generic.11EA075A

几个名字很怪异，难道都是启发？？

[病毒样本] 5x

本帖子中包含更多资源