qd.exe及db1.exe (此帖已完,1394楼有新帖子的地址)

显示全部楼层 · 发表于 2010-8-11 19:53:20

本帖最后由 sam.to 于 2010.8.11 22:59 编辑

11a5108751da52331ed098fbf2b8a32e db1.exe
8836cdaa8e2b9e1930f79a076dc95d0e qd.exe

to kl,ll,mcafee,comodo,avira

A listing of files contained inside archives alongside their results can be found below:

File ID	Filename	Size (Byte)	Result
25844455	db1.e3xe	412 KB	UNDER ANALYSIS
25844456	qd.ex2e	452 KB	UNDER ANALYSIS

Filename

Result

db1.e3xe

MALWARE

The file 'db1.e3xe' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Drop.Agent.adg.The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

Filename

Result

qd.ex2e

MALWARE

The file 'qd.ex2e' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Drop.Agent.adf.The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

Hello,

78809916_269738677_db1.e3xe - Trojan-Dropper.Win32.Agent.creu,

78809916_269738678_qd.ex2e - Trojan-Dropper.Win32.Agent.crev

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

-------------------------------------------
Best wishes, Pavel Firsov.
Virus analyst , Kaspersky Lab.
_____________________________

显示全部楼层 · 发表于 2010-8-11 19:54:45

171
1x Trj/CI.A
1x 启发，to xandora(panda)

显示全部楼层 · 发表于 2010-8-11 20:07:27

171

ESET NOD32 emptied.

db1.e3xe - Win32/Adware.WSearch.AJ 应用程序的变种
qd.ex2e - Win32/Adware.WSearch.AJ 应用程序的变种

显示全部楼层 · 发表于 2010-8-11 20:07:39

#171
FS
Trojan.Generic.KD.26045清空.

显示全部楼层 · 发表于 2010-8-12 11:56:46

本帖最后由 sam.to 于 2010.8.12 16:48 编辑

c965ce8644360ad6e14c576d06fdda32qd.e3xe
9b9a94e599c6523a98f7ef0d8c63310edb1.exe3

to kl,ll,mcafee,comodo,avira

A listing of files contained inside archives alongside their results can be found below:

File ID	Filename	Size (Byte)	Result
25845066	qd.e3xe	452 KB	UNDER ANALYSIS
25845067	db1.exe3	412 KB	UNDER ANALYSIS

您好，

此邮件由邮件自动处理系统生成。

db1.exe3 - Trojan-Dropper.Win32.Agent.crka
qd.e3xe - Trojan-Dropper.Win32.Agent.crkb

以上文件包含恶意代码，下次更新后即可查杀。感谢您的上报。

Best regards, Unuchek Roman

Filename

Result

qd.e3xe

MALWARE

The file 'qd.e3xe' has been determined to be 'MALWARE'.
Our analysts named the threat ADSPY/WSearch.A.The term "ADSPY/" denotes adware or spyware. This type of malware is able to change browser settings for example by manipulating registry settings or byusing of NTFS-streams. Very often IEexploits are used to manipulate the browserhelp.dll.Detection will be added to our virus definition file (VDF) with one of the next updates.

Filename

Result

db1.exe3

MALWARE

The file 'db1.exe3' has been determined to be 'MALWARE'.
Our analysts named the threat ADSPY/WSearch.AA.The term "ADSPY/" denotes adware or spyware. This type of malware is able to change browser settings for example by manipulating registry settings or byusing of NTFS-streams. Very often IEexploits are used to manipulate the browserhelp.dll.Detection will be added to our virus definition file (VDF) with one of the next updates.

显示全部楼层 · 发表于 2010-8-12 13:36:27

175

ESET NOD32 emptied.
db1.exe3 - Win32/Adware.WSearch.AJ 应用程序的变种
qd.e3xe - Win32/Adware.WSearch.AJ 应用程序的变种

显示全部楼层 · 发表于 2010-8-12 13:42:49

#175
FS
Trojan.Generic.KD.26045依然清空.

显示全部楼层 · 发表于 2010-8-12 17:17:03

本帖最后由 sam.to 于 2010.8.12 19:19 编辑

27139b782c2b292fea8ab93fe4d124e5 qd.exe
6efefff6fc8ccdd59fbbfce1bf0543a1 db1.exe

to kl,ll,mcafee,comodo,avira

A listing of files contained inside archives alongside their results can be found below:

File ID	Filename	Size (Byte)	Result
25845346	db1.ex2e	412 KB	UNDER ANALYSIS
25845347	qd.ex3e	452 KB	UNDER ANALYSIS

Please find a detailed report concerning each individual sample below:

Filename

Result

db1.ex2e

MALWARE

The file 'db1.ex2e' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Drop.Agent.adm.The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

Filename

Result

qd.ex3e

MALWARE

The file 'qd.ex3e' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Drop.Agent.adn.The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

Hello,

79219905_270406958_db1.ex2e - Trojan-Dropper.Win32.Agent.crku,
79219905_270406961_qd.ex3e - Trojan-Dropper.Win32.Agent.crkv

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

--
Best regards, Alexander Antukh
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

显示全部楼层 · 发表于 2010-8-12 17:20:02

同177楼..

显示全部楼层 · 发表于 2010-8-12 17:20:40

178
启发，to xandora(panda)

[病毒样本] qd.exe及db1.exe (此帖已完,1394楼有新帖子的地址)