http://zyejanag.cn/rf/index.php

shadowmin

关于:解密的日志(全体输出 -  7):
Level  1>http://zyejanag.cn/rf/update.php?id=4
Level  1>http://zyejanag.cn/rf/update.php?id=6
Level  1>http://zyejanag.cn/rf/fromfactlooks.swf  ●
Level  1>http://zyejanag.cn/rf/repeatWas.pdf
Level  2>http://zyejanag.cn/rf/update.php?id=2
Level  2>http://zyejanag.cn/rf/update.php?id=1
Level  2>http://zyejanag.cn/rf/update.php?id=0
shadowmin's analysis

幸福的猪猪

to kaspersky，avira kill。


A listing of files contained inside archives alongside their results can be found below:

File ID	?Filename	Size (Byte)	Result
25404298	load.exe	21 KB	MALWARE
25404297	repeatWas.pdf	81.06 KB	MALWARE

Please find a detailed report concerning each individual sample below:

?Filename	Result
load.exe	MALWARE

The file 'load.exe' has been determined to be 'MALWARE'.
Our analysts named the threat Worm/Joleee.csx. The term "WORM/" denotes a worm that is able to spread itself for instance over the Internet (using eMail, peer-to-peer networks, IRC networks etc.).Detection will be added to our virus definition file (VDF) with one of the next updates.

?Filename	Result
repeatWas.pdf	MALWARE

The file 'repeatWas.pdf' has been determined to be 'MALWARE'.
Our analysts named the threat EXP/Pidief.PY. The term "EXP/" denotes malware that is able to detect and use certain security vulnerabilities whereby the attacker can get control of the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

[ 本帖最后由 幸福的猪猪 于 2009-7-22 06:19 编辑 ]

尤金卡巴斯基

原帖由 幸福的猪猪 于 2009-7-21 11:16 发表
to kaspersky，avira kill。

2009/7/22 1:11:09 已删除: Email-Worm.Win32.Joleee.csx G:\Temp\Virus\2.rar/load.exe