Win32/Waledac(第16-28次更新-过大量）

黑衣~魂

第一個drweb 已入庫
Trojan.Spambot.4331

其餘上報

Sherry.ai

好方法

Palkia

Unknown Win32 Virus all

Palkia

RS20090828141825578142

gothic_69

sophos一个都不杀 上报

hj5abc

2~5...

2 - probably infected with Trojan.Packed.676
3 - infected with Trojan.Spambot.4331
4 - infected with Trojan.Spambot.4331
5 - infected with Trojan.Spambot.4331

ps.其实不入库也可以直接启发加壳木马....

黑衣~魂

請問那個2加什麼殼？！
----------------
我第一次掃沒有報，估計不是報殼。

Trojan.Packed這個定義不是針對加殼，沒猜錯用於TROJAN類似worm/Spam行為，啟發probably 可能是其他已知代碼發揮功效或報殼。

DRWEB報殼從沒有命名在THREAT定義上，因此看定義查不出來是不是報殼。
--------
估計等下全部已知

[ 本帖最后由 黑衣~魂 于 2009-8-28 16:12 编辑 ]

hj5abc

waledac有auto resolver，很快就会入库.
以前的zhelatin，drweb也喜欢用packed。
像卡巴会为zhelatin加packed.tibs，对waledac加packed.krap通用检测。
nod会用kryptik，应该都不是简单的报壳吧。
其实我也不清楚.

sam.to

Filename         Result          1AA34D416CBAFC11C...1F.exe          MALWARE

The file '1AA34D416CBAFC11CD1D9B5CCE1A071F.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/PCK.Krap.X. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.01.05.176.
Filename         Result          92CA2EEF1D6EAB42E...51.exe          MALWARE

The file '92CA2EEF1D6EAB42EB3F9AE5A1ED1051.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/PCK.Krap.X.1. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.01.05.176.
Filename         Result          4F7C62BBD9E109E89...50.exe          MALWARE

The file '4F7C62BBD9E109E892597A284731D350.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/PCK.Krap.W.196. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.01.05.176.
Filename         Result          B0FEEA2B4E6787E3B...E8.exe          MALWARE

The file 'B0FEEA2B4E6787E3BB38395A8D62A8E8.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/PCK.Krap.X.2. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.01.05.176.

第一至四次

Palkia

查询编号：RS20090828141825578142
文件名称：DL.rar
文件MD5：15D494C400E938109D836F4B167596DE
文件状态：压缩文件，包含3个文件
文件名 MD5 状态 病毒名称 解决版本号
0565ED84689D12... 0565ED846... 病毒文件 Trojan.Win32.Generic.1... 22.10.04.04
1AA34D416CBAFC... 1AA34D416... 病毒文件 Trojan.Win32.Generic.1... 22.10.04.04
B0FEEA2B4E6787... B0FEEA2B4... 病毒文件 Trojan.Win32.Generic.1... 22.10.04.04