qd.exe及db1.exe (此帖已完,1394楼有新帖子的地址)

显示全部楼层 · 发表于 2010-8-31 07:05:48

回复 268楼 sam.to 的帖子
ess 清空

显示全部楼层 · 发表于 2010-8-31 12:56:50

本帖最后由 sam.to 于 2010.8.31 18:33 编辑

5123b8874c552c8c1020bd13d0dce260 db1.exe0
417b8f0eb9c27ce5158defbf6c174872 qd.exe-

to kl,ll,mcafeee,comodo,avira

A listing of files contained inside archives alongside their results can be found below:

File ID	Filename	Size (Byte)	Result
25869106	qd.exe-	416 KB	UNDER ANALYSIS
25869107	db1.exe0	376 KB	UNDER ANALYSIS

Please find a detailed report concerning each individual sample below:

Filename

Result

qd.exe-

MALWARE

The file 'qd.exe-' has been determined to be 'MALWARE'.
Our analysts named the threat TR/WSearch.C.The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

Filename

Result

db1.exe0

MALWARE

The file 'db1.exe0' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Drop.Agent.acj.The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

显示全部楼层 · 发表于 2010-8-31 13:38:29

回复 272楼 sam.to 的帖子

ess 清空

显示全部楼层 · 发表于 2010-8-31 17:25:46

本帖最后由 sam.to 于 2010.8.31 20:47 编辑

7fcc8b8997e2a4324c892613494811f5 qd.e1xe
7859a781103a251c5eec1ba13f41c608 db1.exe0

to kl,ll,mcafee,comodo,avira

A listing of files contained inside archives alongside their results can be found below:

File ID	Filename	Size (Byte)	Result
25869382	qd.e1xe	416 KB	UNDER ANALYSIS
25869383	db1.exe0	376 KB	UNDER ANALYSIS

Please find a detailed report concerning each individual sample below:

Filename

Result

qd.e1xe

MALWARE

The file 'qd.e1xe' has been determined to be 'MALWARE'.
Our analysts named the threat ADSPY/WSearch.A.The term "ADSPY/" denotes adware or spyware. This type of malware is able to change browser settings for example by manipulating registry settings or byusing of NTFS-streams. Very often IEexploits are used to manipulate the browserhelp.dll.Detection will be added to our virus definition file (VDF) with one of the next updates.

Filename

Result

db1.exe0

MALWARE

The file 'db1.exe0' has been determined to be 'MALWARE'.
Our analysts named the threat ADSPY/WSearch.AA.The term "ADSPY/" denotes adware or spyware. This type of malware is able to change browser settings for example by manipulating registry settings or byusing of NTFS-streams. Very often IEexploits are used to manipulate the browserhelp.dll.Detection will be added to our virus definition file (VDF) with one of the next updates.

Hello,

db1.exe0 - Trojan-Dropper.Win32.Agent.cwvn,
qd.e1xe - Trojan-Dropper.Win32.Agent.cwvo

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

-------------------------------------------
Regards, Ivan Kargapoltsev.
Virus analyst , Kaspersky Lab.

显示全部楼层 · 发表于 2010-8-31 17:30:00

回复 274楼 sam.to 的帖子

密码呢？

显示全部楼层 · 发表于 2010-8-31 18:03:42

infected

显示全部楼层 · 发表于 2010-8-31 18:12:55

274楼的。 nis 2011全灭

显示全部楼层 · 发表于 2010-8-31 21:15:29

to kl,ll,mcafee,comodo,avira

qd.ex2e - Trojan-Dropper.Win32.Agent.clfd

Ne ...
sam.to 发表于 2010.7.19 12:28

threatexpert：

http://www.threatexpert.com/report.aspx?md5=e48d956f8682cc7f0741fe3a36c8a7fe

显示全部楼层 · 发表于 2010-8-31 21:41:55

TO ESET

显示全部楼层 · 发表于 2010-9-1 07:48:33

回复 274楼 sam.to 的帖子
ess 清空

[病毒样本] qd.exe及db1.exe (此帖已完,1394楼有新帖子的地址)