Исследование антивирусов 6

Printable View

Показывать 40 сообщений этой темы на одной странице

11.05.2008, 19:44
mayas

свежак =)

a-squared 3.5.0.18 2008.05.10 2008-05-10 [COLOR=green]-[/COLOR]
40.542 AhnLab V3 2008.05.09.00 2008.05.09 2008-05-09 [COLOR=green]-[/COLOR]
40.487 AntiVir 7.8.0.17 7.0.4.23 2008-05-09 [COLOR=green]-[/COLOR]
4.003 Arcavir 1.0.4 200805101105 2008-05-10 [COLOR=green]-[/COLOR]
3.343 AVAST! 1.0.8 080510-0 2008-05-10 [COLOR=green]-[/COLOR]
3.061 AVG 7.5.51.442 269.23.15/1426 2008-05-10 [COLOR=green]-[/COLOR]
2.840 BitDefender 7.60825.1191169 7.18939 2008-05-11 [COLOR=#cc0000]Trojan.Patched.BR[/COLOR]
4.312 CA (VET) 9.0.0.143 31.4.5772 2008-05-09 [COLOR=green]-[/COLOR]
40.249 ClamAV 0.93 7087 2008-05-11 [COLOR=green]-[/COLOR]
0.072 Comodo 2.11 2.0.0.521 2008-05-11 [COLOR=green]-[/COLOR]
20.153 CP Secure 1.1.0.715 2008.05.11 2008-05-11 [COLOR=green]-[/COLOR]
7.316 Dr.Web 4.44.0.9170 2008.05.10 2008-05-10 [COLOR=green]-[/COLOR]
6.973 ewido 4.0.0.2 2008.05.09 2008-05-09 [COLOR=green]-[/COLOR]
6.702 F-Prot 4.4.1.52 20080510 2008-05-10 [COLOR=green]-[/COLOR]
6.633 F-Secure 5.51.6100 2008.05.10.01 2008-05-10 [COLOR=green]-[/COLOR]
12.418 Fortinet 2.81-3.11 9.65 2008-05-10 [COLOR=#cc0000]Suspicious[/COLOR]
13.768 Ikarus T3.1.01.26 2008.05.11.70733 2008-05-11 [COLOR=green]-[/COLOR]
6.619 JiangMin 10.00.650 2008.05.11 2008-05-11 [COLOR=green]-[/COLOR]
12.071 Kaspersky 5.5.10 2008.05.11 2008-05-11 [COLOR=green]-[/COLOR]
32.835 KingSoft 2007.6.20.249 2008.5.7 2008-05-07 [COLOR=green]-[/COLOR]
1.664 McAfee 5.2.00 5292 2008-05-09 [COLOR=green]-[/COLOR]
13.820 Microsoft 1.3408 2008.05.10 2008-05-10 [COLOR=#cc0000]VirTool:Win32/Obfuscator.AX(Suspicious)[/COLOR]
8.617 mks_vir 2.01 2008.05.10 2008-05-10 [COLOR=green]-[/COLOR]
18.378 Norman 5.92.06 5.92.00 2008-05-0900:14:51 [COLOR=green]-[/COLOR]
36.136 nProtect 2008-05-02.00 1441206 2008-05-02 [COLOR=#cc0000]Trojan.Patched.BR[/COLOR]
6.668 Panda 9.04.03.0001 2008.05.11 2008-05-11 [COLOR=#cc0000]Suspicious file[/COLOR]
10.268 Prevx V2 20080511 2008-05-11 [COLOR=#cc0000]TROJAN.DOWNLOADER.GEN[/COLOR]
5.197 Quick Heal 9.00 2008.05.10 2008-05-10 [COLOR=#cc0000]Suspicious - DNAScan[/COLOR]
3.566 Rising 20.0 20.43.62.00 2008-05-11 [COLOR=#cc0000]Packer.Win32.Agent.d[/COLOR]
2.603 Sophos 2.73.0 4.29 2008-05-11 [COLOR=green]-[/COLOR]
12.886 Symantec 1.3.0.24 20080510.006 2008-05-10 [COLOR=green]-[/COLOR]
0.201 The Hacker 6.2.92 v00307 2008-05-10 [COLOR=green]-[/COLOR]
1.356 Trend Micro 8.500-1001 5.270.01 2008-05-09 [COLOR=green]-[/COLOR]
0.044 VBA32 3.12.6.5 20080509.1907 2008-05-09 [COLOR=#cc0000]Malware-Cryptor.Win32.Vserafno[/COLOR]
5.312 ViRobot 20080510 2008.05.10 2008-05-10 [COLOR=green]-[/COLOR]
3.600 VirusBuster 4.3.19:9 9.127.13/11.0 2008-05-11 [COLOR=green]-[/COLOR]
4.193

[size="1"][color="#666686"][B][I]Добавлено через 50 минут[/I][/B][/color][/size]
[U]типа новая версия квипа 8060
[/U]
[QUOTE]AhnLab-V3 2008.5.10.0 2008.05.10 -
AntiVir 7.8.0.17 2008.05.09 -
Authentium 4.93.8 2008.05.11 -
Avast 4.8.1169.0 2008.05.10 -
AVG 7.5.0.516 2008.05.11 -
BitDefender 7.2 2008.05.08 -
CAT-QuickHeal 9.50 2008.05.10 -
ClamAV 0.92.1 2008.05.11 -
DrWeb 4.44.0.09170 2008.05.10 -
eSafe 7.0.15.0 2008.05.09 -
eTrust-Vet 31.4.5772 2008.05.09 -
[B]Ewido 4.0 2008.05.11 Worm.Lamar.f[/B]
F-Prot 4.4.2.54 2008.05.10 -
[B]F-Secure 6.70.13260.0 2008.05.10 IM-Worm.Win32.Lamar.i[/B]
Fortinet 3.14.0.0 2008.05.11 -
Ikarus T3.1.1.26.0 2008.05.11 -
[B]Kaspersky 7.0.0.125 2008.05.11 IM-Worm.Win32.Lamar.i[/B]
McAfee 5292 2008.05.10 -
Microsoft 1.3408 2008.05.11 -
NOD32v2 3090 2008.05.09 -
Norman 5.80.02 2008.05.09 -
Panda 9.0.0.4 2008.05.11 -
Prevx1 V2 2008.05.11 -
Rising 20.43.62.00 2008.05.11 -
Sophos 4.29.0 2008.05.11 -
Sunbelt 3.0.1097.0 2008.05.07 -
Symantec 10 2008.05.11 -
TheHacker 6.2.92.307 2008.05.11 -
VBA32 3.12.6.5 2008.05.11 -
VirusBuster 4.3.26:9 2008.05.10 -
Webwasher-Gateway 6.6.2 2008.05.09 -[/QUOTE]
11.05.2008, 21:44
Groft

типо еще 1 квип :)
[QUOTE]Файл qip.exe получен 2008.05.11 19:42:33 (CET)
Текущий статус: закончено
Результат: 13/31 (41.94%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.10.0 2008.05.10 -
[B]AntiVir 7.8.0.17 2008.05.11 TR/Crypt.XPACK.Gen[/B]
Authentium 4.93.8 2008.05.11 -
[B]Avast 4.8.1169.0 2008.05.10 Win32:LdPinch-CNU
AVG 7.5.0.516 2008.05.11 Downloader.Agent
BitDefender 7.2 2008.05.08 Trojan.Dropper.RTS[/B]
CAT-QuickHeal 9.50 2008.05.10 -
[B]ClamAV 0.92.1 2008.05.11 Trojan.Dropper-6121
DrWeb 4.44.0.09170 2008.05.10 Trojan.DownLoader.59620
[/B]eSafe 7.0.15.0 2008.05.09 -
eTrust-Vet 31.4.5772 2008.05.09 -
Ewido 4.0 2008.05.11 -
F-Prot 4.4.2.54 2008.05.10 -
[B]F-Secure 6.70.13260.0 2008.05.10 Suspicious:W32/Malware!Gemini[/B]
Fortinet 3.14.0.0 2008.05.11 -
[B]Ikarus T3.1.1.26.0 2008.05.11 Packer.Pohernah.C
Kaspersky 7.0.0.125 2008.05.11 Backdoor.Win32.SdBot.dtu
[/B]McAfee 5292 2008.05.10 -
[B]Microsoft 1.3408 2008.05.11 VirTool:Win32/Obfuscator.AZ[/B]
NOD32v2 3090 2008.05.09 -
Norman 5.80.02 2008.05.09 -
[B]Panda 9.0.0.4 2008.05.11 Suspicious file[/B]
Prevx1 V2 2008.05.11 -
Rising 20.43.62.00 2008.05.11 -
Sophos 4.29.0 2008.05.11 -
Sunbelt 3.0.1097.0 2008.05.07 -
Symantec 10 2008.05.11 -
TheHacker 6.2.92.307 2008.05.11 -
[B]VBA32 3.12.6.5 2008.05.11 suspected of Backdoor.Delf.180 (paranoid heuristics)[/B]
VirusBuster 4.3.26:9 2008.05.11 -
[B]Webwasher-Gateway 6.6.2 2008.05.11 Trojan.Crypt.XPACK.Gen[/B]
Дополнительная информация
File size: 3512125 bytes
MD5...: fd6bc4a89a59bf367564e2305e2d1dfb
SHA1..: 7211d4c1566043aa4cc6ffa9743b2d148a2c5ba2
SHA256: 783ebd45afadba2de570e846770acbac65c2c5d27b4de1880da61840dbdef70e
SHA512: 4b7079d7607e9edc5623ed20f4bb4b07c9b7cda06992c5cba9e20b0f6511a08d
eea01ca3687a7a27589e9037da109cf2a5da0468247fa532471a4611b5b83c7c
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x401059
timedatestamp.....: 0x47e8bd39 (Tue Mar 25 08:52:09 2008)
machinetype.......: 0x14c (I386)

( 2 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x200 0x200 6.16 c43ed6876da81358d10503706c2e5b6a
.rsrc 0x2000 0x35933d 0x35933d 6.79 4455f3eb85c1e1c85283a7d394dec146
( 0 imports )
( 0 exports )[/QUOTE]
[url]http://www.virustotal.com/ru/analisis/edf556144c24a94902048ab05285d753[/url]
12.05.2008, 11:37
Shu_b

t 22727[CODE]File braviax.exe received on 05.12.2008 09:29:16 (CET)
Antivirus Version Last Update Result
AhnLab-V3 2008.5.10.0 2008.05.10 -
[B]AntiVir 7.8.0.17 2008.05.11 HEUR/Malware[/B]
Authentium 4.93.8 2008.05.10 -
Avast 4.8.1169.0 2008.05.11 -
AVG 7.5.0.516 2008.05.11 -
BitDefender 7.2 2008.05.08 -
CAT-QuickHeal 9.50 2008.05.10 -
ClamAV None 2008.05.12 -
DrWeb 4.44.0.09170 2008.05.12 -
eSafe 7.0.15.0 2008.05.12 -
eTrust-Vet 31.4.5772 2008.05.09 -
Ewido 4.0 2008.05.11 -
F-Prot 4.4.2.54 2008.05.12 -
[B]F-Secure 6.70.13260.0 2008.05.12 W32/Malware[/B]
Fortinet 3.14.0.0 2008.05.12 -
Ikarus T3.1.1.26.0 2008.05.12 -
[B]Kaspersky 7.0.0.125 2008.05.12 Heur.Trojan.Generic[/B]
McAfee 5291 2008.05.08 -
Microsoft 1.3408 2008.05.12 -
NOD32v2 3091 2008.05.12 -
Norman 5.80.02 2008.05.09 -
Panda 9.0.0.4 2008.05.11 -
Prevx1 V2 2008.05.12 -
Rising 20.43.62.00 2008.05.11 -
Sophos 4.29.0 2008.05.12 -
Sunbelt 3.0.1114.0 2008.05.12 -
Symantec 10 2008.05.12 -
TheHacker 6.2.92.307 2008.05.12 -
VBA32 3.12.6.5 2008.05.12 -
VirusBuster 4.3.26:9 2008.05.11 -
[B]Webwasher-Gateway 6.6.2 2008.05.11 Heuristic.Malware[/B]
Additional information
File size: 37376 bytes[/CODE]
13.05.2008, 17:09
Groft

Файл opr003SL.exe получен 2008.05.13 15:05:46 (CET)
Текущий статус: закончено
Результат: 8/32 (25%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.10.0 2008.05.13 -
[B]AntiVir 7.8.0.17 2008.05.13 TR/Crypt.XPACK.Gen[/B]
Authentium 5.1.0.4 2008.05.13 -
Avast 4.8.1169.0 2008.05.12 -
[B]AVG 7.5.0.516 2008.05.13 Downloader.Zlob.12.AH[/B]
BitDefender 7.2 2008.05.08 -
[B]CAT-QuickHeal 9.50 2008.05.12 (Suspicious) - DNAScan[/B]
ClamAV 0.92.1 2008.05.13 -
DrWeb 4.44.0.09170 2008.05.13 -
[B]eSafe 7.0.15.0 2008.05.12 Suspicious File[/B]
eTrust-Vet 31.4.5783 2008.05.12 -
Ewido 4.0 2008.05.13 -
F-Prot 4.4.2.54 2008.05.13 -
F-Secure 6.70.13260.0 2008.05.13 -
Fortinet 3.14.0.0 2008.05.13 -
GData 2.0.7306.1023 2008.05.13 -
Ikarus T3.1.1.26.0 2008.05.13 -
Kaspersky 7.0.0.125 2008.05.13 -
McAfee 5293 2008.05.12 -
[B]Microsoft 1.3408 2008.05.13 Trojan:Win32/Tibs.gen!G[/B]
NOD32v2 3095 2008.05.13 -
Norman 5.80.02 2008.05.09 -
Panda 9.0.0.4 2008.05.12 -
Prevx1 V2 2008.05.13 -
Rising 20.44.12.00 2008.05.13 -
[B]Sophos 4.29.0 2008.05.13 Mal/EncPk-DA[/B]
Sunbelt 3.0.1114.0 2008.05.12 -
Symantec 10 2008.05.13 -
TheHacker 6.2.92.309 2008.05.13 -
[B]VBA32 3.12.6.6 2008.05.13 suspected of Downloader.Zlob.8[/B]
VirusBuster 4.3.26:9 2008.05.12 -
[B]Webwasher-Gateway 6.6.2 2008.05.13 Trojan.Crypt.XPACK.Gen[/B]
[URL]http://www.virustotal.com/ru/analisis/ed563a5e677ae388f4a5dec80d6f5293[/URL]
14.05.2008, 19:19
mayas

новый зверек :)

Antivirus Version Last Update Result
AhnLab-V3 2008.5.10.0 2008.05.13 -
[B]AntiVir 7.8.0.17 2008.05.13 HEUR/Win32.Virus.Damaged[/B]
[B]Authentium 5.1.0.4 2008.05.14 W32/NewUnknownMalware-P74!Maximus[/B]
Avast 4.8.1169.0 2008.05.12 -
[B]AVG 7.5.0.516 2008.05.13 Win32/PolyCrypt[/B]
BitDefender 7.2 2008.05.08 -
CAT-QuickHeal 9.50 2008.05.12 -
ClamAV 0.92.1 2008.05.13 -
DrWeb 4.44.0.09170 2008.05.13 -
eSafe 7.0.15.0 2008.05.12 -
eTrust-Vet 31.4.5784 2008.05.13 -
Ewido 4.0 2008.05.13 -
[B]F-Prot 4.4.2.54 2008.05.13 W32/NewUnknownMalware-P74!Maximus[/B]
[B]F-Secure 6.70.13260.0 2008.05.13 Suspicious:W32/Malware!Gemini[/B]
Fortinet 3.14.0.0 2008.05.13 -
GData 2.0.7306.1023 2008.05.14 -
[B]Ikarus T3.1.1.26.0 2008.05.13 Trojan.MulDrop.4111[/B]
Kaspersky 7.0.0.125 2008.05.13 -
McAfee 5293 2008.05.12 -
[B]Microsoft 1.3408 2008.05.13 VirTool:Win32/Obfuscator.AX[/B]
NOD32v2 3095 2008.05.13 -
Norman 5.80.02 2008.05.09 -
Panda 9.0.0.4 2008.05.12 -
Rising 20.44.12.00 2008.05.13 -
[B]Sophos 4.29.0 2008.05.13 Sus/UnkPacker[/B]
Sunbelt 3.0.1114.0 2008.05.12 -
Symantec 10 2008.05.13 -
TheHacker 6.2.92.309 2008.05.13 -
VBA32 3.12.6.6 2008.05.13 -
VirusBuster 4.3.26:9 2008.05.12 -
[B]Webwasher-Gateway 6.6.2 2008.05.13 Heuristic.Win32.Virus.Damaged[/B]
Additional information
File size: 595085 bytes
MD5...: 12931f9ad898e6a776a08c66c551365d
SHA1..: ffb8fe5cc11b382af407fcfc70a31de04ced502b
SHA256: a1db3f79a36ba5cb6e6fb9bf2848bc7b704169189d4cdd11326c9d5fc73da429
SHA512: 6ddbbc3c951ff22c84fca5d74d86f0ae0c2d3c4613addd6b39de5e614b18ae75
28b92dd94a3cc2370fa27cac1b9f4401f8722606e7b31bf71baca166d4b38f50
16.05.2008, 16:17
ALEX(XX)

File autorun.exe received on 05.16.2008 14:14:45 (CET)

[CODE]Antivirus Version Last Update Result
AhnLab-V3 2008.5.16.0 2008.05.16 -
[B]AntiVir 7.8.0.19 2008.05.16 CC/UKMalw.LB[/B]
[B]Authentium 5.1.0.4 2008.05.16 W32/Trojan.BWKV
Avast 4.8.1169.0 2008.05.12 Win32:Trojan-gen {VC}[/B]
AVG 7.5.0.516 2008.05.16 -
BitDefender 7.2 2008.05.16 -
[B]CAT-QuickHeal 9.50 2008.05.15 Trojan.Soltek.kj
ClamAV 0.92.1 2008.05.16 Trojan.Agent-17889
[/B]DrWeb 4.44.0.09170 2008.05.16 -
eSafe 7.0.15.0 2008.05.16 -
eTrust-Vet 31.4.5788 2008.05.14 -
[B]Ewido 4.0 2008.05.14 Trojan.Legmir
F-Prot 4.4.2.54 2008.05.16 W32/Trojan.BWKV[/B]
F-Secure 6.70.13260.0 2008.05.16 -
[B]Fortinet 3.14.0.0 2008.05.15 W32/Small.K!tr
GData 2.0.7306.1023 2008.05.16 Win32:Trojan-gen
Ikarus T3.1.1.26.0 2008.05.16 Trojan-PWS.Legmir[/B]
Kaspersky 7.0.0.125 2008.05.16 -
McAfee 5296 2008.05.16 -
Microsoft 1.3408 2008.05.13 -
NOD32v2 3104 2008.05.16 -
Norman 5.80.02 2008.05.15 -
Panda 9.0.0.4 2008.05.15 -
[B]Prevx1 V2 2008.05.16 Malicious Software[/B]
Rising 20.44.32.00 2008.05.15 -
[B]Sophos 4.29.0 2008.05.16 Troj/Userin-B[/B]
Sunbelt 3.0.1114.0 2008.05.12 -
[B]Symantec 10 2008.05.16 Backdoor.EggDrop[/B]
[B]TheHacker 6.2.92.311 2008.05.15 Trojan/Legmir.gen
VBA32 3.12.6.6 2008.05.16 Trojan.PWS.Legmir[/B]
VirusBuster 4.3.26:9 2008.05.15 -
[B]Webwasher-Gateway 6.6.2 2008.05.16 Virus.UKMalw.LB[/B]
[/CODE]
18.05.2008, 14:16
mayas

было приклеено к другой программе

Result: 4/32 (12.5%)

[QUOTE]Antivirus Version Last Update Result
AhnLab-V3 2008.5.10.0 2008.05.13 -
AntiVir 7.8.0.17 2008.05.13 -
Authentium 5.1.0.4 2008.05.14 -
Avast 4.8.1169.0 2008.05.12 [B]Win32:SdBot-4752[/B]
AVG 7.5.0.516 2008.05.13 -
BitDefender 7.2 2008.05.08 -
CAT-QuickHeal 9.50 2008.05.12 -
ClamAV 0.92.1 2008.05.13 -
DrWeb 4.44.0.09170 2008.05.13 -
eSafe 7.0.15.0 2008.05.12 [B]Win32.Womble[/B]
eTrust-Vet 31.4.5784 2008.05.13 -
Ewido 4.0 2008.05.13 -
F-Prot 4.4.2.54 2008.05.13 -
F-Secure 6.70.13260.0 2008.05.13 -
Fortinet 3.14.0.0 2008.05.13 -
GData 2.0.7306.1023 2008.05.14 [B]Win32:SdBot-4752[/B]
Ikarus T3.1.1.26.0 2008.05.13 -
Kaspersky 7.0.0.125 2008.05.13 -
McAfee 5293 2008.05.12 -
Microsoft 1.3408 2008.05.13 -
NOD32v2 3095 2008.05.13 -
Norman 5.80.02 2008.05.09 -
Panda 9.0.0.4 2008.05.12 [B][I]Suspicious file[/I][/B]
Prevx1 V2 2008.05.18 -
Rising 20.44.12.00 2008.05.13 -
Sophos 4.29.0 2008.05.13 -
Sunbelt 3.0.1114.0 2008.05.12 -
Symantec 10 2008.05.13 -
TheHacker 6.2.92.309 2008.05.13 -
VBA32 3.12.6.6 2008.05.13 -
VirusBuster 4.3.26:9 2008.05.12 -
Webwasher-Gateway 6.6.2 2008.05.13 -
Additional information
File size: 38912 bytes
MD5...: da155c66d91243301aaf91aeb97fbea9
SHA1..: e4722ade34722e73e7b5f046c763d597e0a03d35
SHA256: 6c8662a403e2451f24f5351f4973e00f5fc894bff5a6b8fa6dc055e2a64a6810
SHA512: 154550a12404ec25772c18700842fd307a4cf51783e814bfc431e04e04ce9fe8
a2deeb57d128b87080aa2b1c3c93be7c96dd83b7adac067f41db502c3ef63994
PEiD..: UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x417010
timedatestamp.....: 0x482e9052 (Sat May 17 07:59:14 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0xd000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0xe000 0xa000 0x9200 7.90 7cced073e5b6aa9d88e1cbf47df8d513
UPX2 0x18000 0x1000 0x200 2.91 6d33674852f41435a18abd2d4b19afd4

( 4 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
> SHLWAPI.dll: PathIsDirectoryA
> USER32.dll: ShowWindow
> WS2_32.dll: -

( 0 exports )
packers (Kaspersky): PE_Patch.UPX, UPX
packers (F-Prot): UPX[/QUOTE]
[I]
ответ [email][email protected][/email]
\qip2.exe Инфицирован Trojan-Dropper.Win32.Pincher.bg [/I]
18.05.2008, 15:49
Alex_Goodwin

---
[CODE]Файл wstest.dll получен 2008.05.18 12:11:41 (CET)
Текущий статус: закончено
Результат: 3/32 (9.38%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.10.0 2008.05.13 -
[b]AntiVir 7.8.0.17 2008.05.13 HEUR/Malware[/b]
Authentium 5.1.0.4 2008.05.14 -
Avast 4.8.1169.0 2008.05.12 -
AVG 7.5.0.516 2008.05.13 -
BitDefender 7.2 2008.05.08 -
CAT-QuickHeal 9.50 2008.05.12 -
ClamAV 0.92.1 2008.05.13 -
DrWeb 4.44.0.09170 2008.05.13 -
eSafe 7.0.15.0 2008.05.12 -
eTrust-Vet 31.4.5784 2008.05.13 -
Ewido 4.0 2008.05.13 -
F-Prot 4.4.2.54 2008.05.13 -
F-Secure 6.70.13260.0 2008.05.13 -
Fortinet 3.14.0.0 2008.05.13 -
GData 2.0.7306.1023 2008.05.14 -
Ikarus T3.1.1.26.0 2008.05.13 -
Kaspersky 7.0.0.125 2008.05.13 -
McAfee 5293 2008.05.12 -
Microsoft 1.3408 2008.05.13 -
NOD32v2 3095 2008.05.13 -
Norman 5.80.02 2008.05.09 -
[b]Panda 9.0.0.4 2008.05.12 Suspicious file[/b]
Prevx1 V2 2008.05.18 -
Rising 20.44.12.00 2008.05.13 -
Sophos 4.29.0 2008.05.13 -
Sunbelt 3.0.1114.0 2008.05.12 -
Symantec 10 2008.05.13 -
TheHacker 6.2.92.309 2008.05.13 -
VBA32 3.12.6.6 2008.05.13 -
VirusBuster 4.3.26:9 2008.05.12 -
[b]Webwasher-Gateway 6.6.2 2008.05.13 Heuristic.Malware[/b]
Дополнительная информация
File size: 7680 bytes
MD5...: 692f13c703ff9fc8a71f2da0617bfd99
SHA1..: 37f5722091998b483063e10da872880aeda706a7
SHA256: bc6021f4e171ac7505e7c18f95ad28707ca35d3ef38fbcdd1cb5f9f7237fc4ce
SHA512: d78ce19f6e5a274b8c65c83d7abb8903348cc0491e39d17a37d66038223e2863
fe9d849765bb9ed9f0b193635ece2e380aee1372acdd2d9916345b33a49d6d60
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x100009d6
timedatestamp.....: 0x48077ecc (Thu Apr 17 16:46:04 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x200 0x118e 0x1200 5.76 9f63dcc93871507979b00c4429c75508
.data 0x1400 0x62e 0x800 4.21 8604c046dca04a429a41d065b25c4d04
.reloc 0x1c00 0x186 0x200 4.65 7777b7ed8ed6c57fde52d25d96edafa2

( 4 imports )
> WSOCK32.dll: -, -, -, -, -, -, -, -, -
> KERNEL32.dll: CreateToolhelp32Snapshot, Process32First, OpenProcess, TerminateProcess, Process32Next, lstrlenA, lstrcatA, lstrcpyA, CloseHandle, WriteFile, CreateFileA, Sleep, WinExec, lstrcmpiA, GetVersionExA, GetVolumeInformationA, DeleteFileA, GetFileSize, ReadFile, GetSystemDirectoryA, GetProcAddress, LoadLibraryExA
> USER32.dll: wsprintfA
> ADVAPI32.dll: RegOpenKeyExA, RegQueryValueExA, RegCloseKey

( 1 exports )
winl[/CODE]
19.05.2008, 23:01
Surfer

File index.htm received on 05.19.2008 20:58:55 (CET)
Result: 4/32 (12.5%)

AhnLab-V3 2008.5.20.0 2008.05.19 -
AntiVir 7.8.0.19 2008.05.19 -
Authentium 5.1.0.4 2008.05.18 -
Avast 4.8.1195.0 2008.05.18 -
AVG 7.5.0.516 2008.05.19 -
BitDefender 7.2 2008.05.19 -
CAT-QuickHeal 9.50 2008.05.19 -
ClamAV 0.92.1 2008.05.19 -
DrWeb 4.44.0.09170 2008.05.19 -
eSafe 7.0.15.0 2008.05.19 -
eTrust-Vet 31.4.5798 2008.05.16 -
Ewido 4.0 2008.05.19 -
F-Prot 4.4.2.54 2008.05.16 -
[B]F-Secure 6.70.13260.0 2008.05.19 Trojan-Spy.HTML.Prikolfraud.c [/B]
Fortinet 3.14.0.0 2008.05.19 -
[B]GData 2.0.7306.1023 2008.05.19 Trojan-Spy.HTML.Prikolfraud.c
Ikarus T3.1.1.26.0 2008.05.19 Trojan-Spy.HTML.Prikolfraud.c
Kaspersky 7.0.0.125 2008.05.19 Trojan-Spy.HTML.Prikolfraud.c [/B]
McAfee 5298 2008.05.19 -
Microsoft 1.3408 2008.05.13 -
NOD32v2 3110 2008.05.19 -
Norman 5.80.02 2008.05.19 -
Panda 9.0.0.4 2008.05.19 -
Prevx1 V2 2008.05.19 -
Rising 20.45.02.00 2008.05.19 -
Sophos 4.29.0 2008.05.19 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.19 -
TheHacker 6.2.92.313 2008.05.19 -
VBA32 3.12.6.6 2008.05.19 -
VirusBuster 4.3.26:9 2008.05.19 -
Webwasher-Gateway 6.6.2 2008.05.19 -

[url]http://www.virustotal.com/analisis/13537f6e045fd3943d50af694a21c396[/url]
20.05.2008, 13:25
Макcим

t=23113

[QUOTE]Файл avz00002.dta получен 2008.05.20 11:12:26 (CET)
Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.20.0 2008.05.20 -
[B]AntiVir 7.8.0.19 2008.05.20 DR/Delphi.Gen[/B]
Authentium 5.1.0.4 2008.05.19 -
Avast 4.8.1195.0 2008.05.19 -
[B]AVG 7.5.0.516 2008.05.19 Dropper.Generic.XNM[/B]
BitDefender 7.2 2008.05.20 -
CAT-QuickHeal 9.50 2008.05.19 -
ClamAV 0.92.1 2008.05.20 -
DrWeb 4.44.0.09170 2008.05.20 -
[B]eSafe 7.0.15.0 2008.05.19 suspicious Trojan/Worm[/B]
eTrust-Vet 31.4.5805 2008.05.20 -
Ewido 4.0 2008.05.19 -
F-Prot 4.4.2.54 2008.05.16 -
F-Secure 6.70.13260.0 2008.05.20 -
[B]Fortinet 3.14.0.0 2008.05.20 Dropper.BB!tr
GData 2.0.7306.1023 2008.05.20 Win32:Rootkit-gen
Ikarus T3.1.1.26.0 2008.05.20 Virus.Win32.Zapchast.DA[/B]
Kaspersky 7.0.0.125 2008.05.20 -
[B]McAfee 5298 2008.05.19 Generic Dropper.bb
Microsoft 1.3520 2008.05.20 Trojan:Win32/Delfobfus.A
NOD32v2 3113 2008.05.20 a variant of Win32/Injector.AJ[/B]
Norman 5.80.02 2008.05.19 -
Panda 9.0.0.4 2008.05.20 -
[B]Prevx1 V2 2008.05.20 Cloaked Malware
Rising 20.45.11.00 2008.05.20 Trojan.DL.Win32.Agent.bxw[/B]
Sophos 4.29.0 2008.05.20 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.20 -
TheHacker 6.2.92.314 2008.05.20 -
VBA32 3.12.6.6 2008.05.19 -
VirusBuster 4.3.26:9 2008.05.19 -
[B]Webwasher-Gateway 6.6.2 2008.05.20 Trojan.Dropper.Delphi.Gen[/B]
Дополнительная информация
File size: 39424 bytes
MD5...: 16bd8b5e9a1548ef83e7af2062ab10ad
SHA1..: c8a21f80d0f1d56441492478517cbfd1f7bb42af
SHA256: e3f710326e1d2a8109677d3b5700505d1e42f72e2f4ab3952adeccbf5804df4d
SHA512: a42b9801591a593a095131a0c46564c5b171b0aae1ddb6f8608bd3ee8a00a613 850969dc7044505ab56acfcca9256a7cdf6fb29ebc8f90c5030498f3f6765770
PEiD..: -
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x2180f0 timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 UPX0 0x1000 0x10e000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e UPX1 0x10f000 0xa000 0x9400 7.73 584d0de443dc9c81a69adc3d3c1d2d9f .rsrc 0x119000 0x1000 0x200 3.02 3a68472f58715037a971f3c97b0e8f1f ( 3 imports ) > KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess > gdi32.dll: SetTextColor > user32.dll: GetDC ( 0 exports ) 
Prevx info: [url]http://info.prevx.com/aboutprogramtext.asp?PX5=E64804100097A1FB9A8B0088711A6C0011CFD500[/url]
packers (Kaspersky): PE_Patch.UPX, UPX
packers (F-Prot): UPX[/QUOTE]
20.05.2008, 18:19
Surfer

File video.exe received on 05.20.2008 16:00:49 (CET)
Result: 7/32 (21.88%)

AhnLab-V3 2008.5.20.0 2008.05.20 -
AntiVir 7.8.0.19 2008.05.20 -
Authentium 5.1.0.4 2008.05.19 -
Avast 4.8.1195.0 2008.05.20 -
AVG 7.5.0.516 2008.05.20 -
BitDefender 7.2 2008.05.20 -
[B]CAT-QuickHeal 9.50 2008.05.19 (Suspicious) - DNAScan [/B]
ClamAV 0.92.1 2008.05.20 -
DrWeb 4.44.0.09170 2008.05.20 -
[B]eSafe 7.0.15.0 2008.05.19 Suspicious File [/B]
eTrust-Vet 31.4.5806 2008.05.20 -
Ewido 4.0 2008.05.20 -
F-Prot 4.4.2.54 2008.05.16 -
F-Secure 6.70.13260.0 2008.05.20 -
[B]Fortinet 3.14.0.0 2008.05.20 W32/PolyZlob!tr.dldr [/B]
GData 2.0.7306.1023 2008.05.20 -
Ikarus T3.1.1.26.0 2008.05.20 -
Kaspersky 7.0.0.125 2008.05.20 -
McAfee 5298 2008.05.19 -
[B]Microsoft 1.3520 2008.05.20 TrojanDropper:Win32/Nuwar.gen!lds [/B]
NOD32v2 3114 2008.05.20 -
Norman 5.80.02 2008.05.19 -
Panda 9.0.0.4 2008.05.20 -
Prevx1 V2 2008.05.20 -
Rising 20.45.12.00 2008.05.20 -
Sophos 4.29.0 2008.05.20 Mal/EncPk-DA
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.20 -
TheHacker 6.2.92.314 2008.05.20 -
[B]VBA32 3.12.6.6 2008.05.19 MalwareScope.Worm.Nuwar-Glowa.1 [/B]
VirusBuster 4.3.26:9 2008.05.19 -
[B]Webwasher-Gateway 6.6.2 2008.05.20 Worm.Win32.Malware.gen (suspicious) [/B]

[url]http://www.virustotal.com/analisis/6343f73d3c5d30ad50bab7ca915dfe8f[/url]
21.05.2008, 17:35
Shu_b

t 23161[CODE]File tcpsr.sys received on 05.21.2008 12:49:09 (CET)
Antivirus Version Last Update Result
AhnLab-V3 2008.5.20.0 2008.05.21 -
[B]AntiVir 7.8.0.19 2008.05.21 TR/Rootkit.Gen[/B]
Authentium 5.1.0.4 2008.05.21 -
Avast 4.8.1195.0 2008.05.21 -
[B]AVG 7.5.0.516 2008.05.20 SpamBot.G[/B]
BitDefender 7.2 2008.05.21 -
CAT-QuickHeal 9.50 2008.05.19 -
ClamAV 0.92.1 2008.05.21 -
DrWeb 4.44.0.09170 2008.05.21 -
eSafe 7.0.15.0 2008.05.20 -
eTrust-Vet 31.4.5808 2008.05.21 -
Ewido 4.0 2008.05.21 -
F-Prot 4.4.2.54 2008.05.16 -
F-Secure 6.70.13260.0 2008.05.21 -
Fortinet 3.14.0.0 2008.05.21 -
GData 2.0.7306.1023 2008.05.21 -
[B]Ikarus T3.1.1.26.0 2008.05.21 Trojan.Rootkit[/B]
Kaspersky 7.0.0.125 2008.05.21 -
McAfee 5299 2008.05.20 -
[B]Microsoft 1.3520 2008.05.21 VirTool:WinNT/Cutwail.gen!C[/B]
NOD32v2 3116 2008.05.21 -
Norman 5.80.02 2008.05.20 -
Panda 9.0.0.4 2008.05.21 -
Prevx1 V2 2008.05.21 -
Rising 20.45.12.00 2008.05.20 -
Sophos 4.29.0 2008.05.21 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.21 -
TheHacker 6.2.92.314 2008.05.20 -
VBA32 3.12.6.6 2008.05.20 -
VirusBuster 4.3.26:9 2008.05.20 -
[B]Webwasher-Gateway 6.6.2 2008.05.21 Trojan.Rootkit.Gen[/B]
Additional information
File size: 8064 bytes[/CODE]

t 23174[CODE]Файл chief.scr получен 2008.05.21 10:19:31 (CET)
Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.20.0 2008.05.21 -
AntiVir 7.8.0.19 2008.05.21 -
Authentium 5.1.0.4 2008.05.21 -
Avast 4.8.1195.0 2008.05.21 -
[B]AVG 7.5.0.516 2008.05.20 Dropper.FreeJoiner.D
BitDefender 7.2 2008.05.21 Trojan.PWS.LdPinch.TNV[/B]
CAT-QuickHeal 9.50 2008.05.19 -
ClamAV 0.92.1 2008.05.21 -
DrWeb 4.44.0.09170 2008.05.21 -
eSafe 7.0.15.0 2008.05.20 -
eTrust-Vet 31.4.5808 2008.05.21 -
Ewido 4.0 2008.05.20 -
F-Prot 4.4.2.54 2008.05.16 -
F-Secure 6.70.13260.0 2008.05.21 -
Fortinet 3.14.0.0 2008.05.21 -
GData 2.0.7306.1023 2008.05.21 -
Ikarus T3.1.1.26.0 2008.05.21 -
Kaspersky 7.0.0.125 2008.05.21 -
McAfee 5299 2008.05.20 -
Microsoft 1.3520 2008.05.21 -
[B]NOD32v2 3115 2008.05.20 probably a variant of Win32/TrojanDropper.Agent.NKS[/B]
Norman 5.80.02 2008.05.20 -
[B]Panda 9.0.0.4 2008.05.21 Suspicious file[/B]
Prevx1 V2 2008.05.21 -
Rising 20.45.12.00 2008.05.20 -
[B]Sophos 4.29.0 2008.05.21 Mal/EncPk-CO[/B]
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.21 -
TheHacker 6.2.92.314 2008.05.20 -
VBA32 3.12.6.6 2008.05.20 -
VirusBuster 4.3.26:9 2008.05.20 -
[B]Webwasher-Gateway 6.6.2 2008.05.21 Win32.Malware.gen!80 (suspicious)[/B]
Дополнительная информация
File size: 84480 bytes[/CODE]

[size="1"][color="#666686"][B][I]Добавлено через 2 часа 0 минут[/I][/B][/color][/size]

t 22934[CODE]File avz.exe_ received on 05.21.2008 14:52:14 (CET)
Antivirus Version Last Update Result
AhnLab-V3 2008.5.20.0 2008.05.21 -
AntiVir 7.8.0.19 2008.05.21 -
Authentium 5.1.0.4 2008.05.21 -
Avast 4.8.1195.0 2008.05.21 -
AVG 7.5.0.516 2008.05.21 -
[B]BitDefender 7.2 2008.05.21 Trojan.Inject.HP[/B]
CAT-QuickHeal 9.50 2008.05.19 -
ClamAV 0.92.1 2008.05.21 -
DrWeb 4.44.0.09170 2008.05.21 -
[B]eSafe 7.0.15.0 2008.05.20 suspicious Trojan/Worm[/B]
eTrust-Vet 31.4.5808 2008.05.21 -
Ewido 4.0 2008.05.21 -
F-Prot 4.4.2.54 2008.05.16 -
[B]F-Secure 6.70.13260.0 2008.05.21 Virus.Win32.Afgan.a
Fortinet 3.14.0.0 2008.05.21 W32/Afgen.A
GData 2.0.7306.1023 2008.05.21 Virus.Win32.Afgan.a
Ikarus T3.1.1.26.0 2008.05.21 BehavesLike.Win32.ExplorerHijack
Kaspersky 7.0.0.125 2008.05.21 Virus.Win32.Afgan.a[/B]
McAfee 5299 2008.05.20 -
[B]Microsoft 1.3520 2008.05.21 Virus:Win32/Afgar.A[/B]
NOD32v2 3116 2008.05.21 -
Norman 5.80.02 2008.05.20 -
Panda 9.0.0.4 2008.05.21 -
Prevx1 V2 2008.05.21 -
Rising 20.45.12.00 2008.05.21 -
Sophos 4.29.0 2008.05.21 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.21 -
TheHacker 6.2.92.314 2008.05.20 -
VBA32 3.12.6.6 2008.05.21 -
VirusBuster 4.3.26:9 2008.05.20 -
Webwasher-Gateway 6.6.2 2008.05.21 -
Additional information
File size: 758784 bytes
MD5...: d108b4e849d00764d935c951578fb9bc[/CODE]

[size="1"][color="#666686"][B][I]Добавлено через 39 минут[/I][/B][/color][/size]

t 23175[CODE]File temp\winlogon.exe received on 05.21.2008 15:27:02 (CET)
Antivirus Version Last Update Result
AhnLab-V3 2008.5.20.0 2008.05.21 -
[B]AntiVir 7.8.0.19 2008.05.21 DR/Delphi.Gen[/B]
Authentium 5.1.0.4 2008.05.21 -
Avast 4.8.1195.0 2008.05.21 -
AVG 7.5.0.516 2008.05.21 -
BitDefender 7.2 2008.05.21 -
CAT-QuickHeal 9.50 2008.05.21 -
ClamAV 0.92.1 2008.05.21 -
DrWeb 4.44.0.09170 2008.05.21 -
[B]eSafe 7.0.15.0 2008.05.20 suspicious Trojan/Worm[/B]
eTrust-Vet 31.4.5808 2008.05.21 -
Ewido 4.0 2008.05.21 -
F-Prot 4.4.2.54 2008.05.16 -
F-Secure 6.70.13260.0 2008.05.21 -
Fortinet 3.14.0.0 2008.05.21 -
GData 2.0.7306.1023 2008.05.21 -
[B]Ikarus T3.1.1.26.0 2008.05.21 Virus.Win32.Zapchast.DA[/B]
Kaspersky 7.0.0.125 2008.05.21 -
[B]McAfee 5299 2008.05.20 Generic Dropper.bb
Microsoft 1.3520 2008.05.21 Trojan:Win32/Delfobfus.A
NOD32v2 3116 2008.05.21 a variant of Win32/Injector.AJ[/B]
Norman 5.80.02 2008.05.20 -
Panda 9.0.0.4 2008.05.21 -
[B]Prevx1 V2 2008.05.21 Cloaked Malware
Rising 20.45.12.00 2008.05.21 Trojan.DL.Win32.Agent.bxw[/B]
Sophos 4.29.0 2008.05.21 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.21 -
TheHacker 6.2.92.314 2008.05.20 -
VBA32 3.12.6.6 2008.05.21 -
VirusBuster 4.3.26:9 2008.05.20 -
[B]Webwasher-Gateway 6.6.2 2008.05.21 Trojan.Dropper.Delphi.Gen[/B]
Additional information
File size: 39424 bytes[/CODE]
22.05.2008, 14:53
Groft

[QUOTE]Файл autorun.inf получен 2008.05.22 12:39:26 (CET)
Текущий статус: закончено
Результат: 13/32 (40.63%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.22.1 2008.05.22 -
AntiVir 7.8.0.19 2008.05.22 -
[B]Authentium 5.1.0.4 2008.05.21 IS/Autorun[/B]
[B]Avast 4.8.1195.0 2008.05.22 VBS:Malware-gen[/B]
[B]AVG 7.5.0.516 2008.05.22 Worm/AutoRun[/B]
BitDefender 7.2 2008.05.22 -
CAT-QuickHeal 9.50 2008.05.21 -
ClamAV 0.92.1 2008.05.22 -
[B]DrWeb 4.44.0.09170 2008.05.22 Win32.HLLW.Autoruner.1252[/B]
eSafe 7.0.15.0 2008.05.21 -
[B]eTrust-Vet 31.4.5812 2008.05.22 INF/Frethog[/B]
Ewido 4.0 2008.05.22 -
[B]F-Prot 4.4.2.54 2008.05.16 IS/Autorun[/B]
F-Secure 6.70.13260.0 2008.05.22 -
[B]Fortinet 3.14.0.0 2008.05.22 W32/OnLineGames.NLI!tr.pws
GData 2.0.7306.1023 2008.05.22 VBS:Malware-gen[/B]
Ikarus T3.1.1.26.0 2008.05.22 -
Kaspersky 7.0.0.125 2008.05.22 -
[B]McAfee 5300 2008.05.21 Generic!atr[/B]
Microsoft 1.3520 2008.05.22 -
[B]NOD32v2 3120 2008.05.22 Win32/PSW.OnLineGames.NLI[/B]
Norman 5.80.02 2008.05.21 -
[B]Panda 9.0.0.4 2008.05.22 W32/Lineage.GYE.worm[/B]
Prevx1 V2 2008.05.22 -
Rising 20.45.32.00 2008.05.22 -
[B]Sophos 4.29.0 2008.05.22 W32/AutoRun-AG[/B]
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.22 -
[B]TheHacker 6.2.92.316 2008.05.22 Trojan/Small.autorun[/B]
VBA32 3.12.6.6 2008.05.21 -
VirusBuster 4.3.26:9 2008.05.21 -
Webwasher-Gateway 6.6.2 2008.05.22 -[/QUOTE]
[url]http://www.virustotal.com/ru/analisis/8a843186aa732b14abab897ea7f5860e[/url]
в режиме real-time у vba32 он подозрительный :)
22.05.2008, 20:18
senyak

Файл codecthe51070.ety получен 2008.05.22 16:28:26 (CET)
Текущий статус: закончено
Результат: 8/32 (25.00%)

[QUOTE]Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.22.1 2008.05.22 -
[B]AntiVir 7.8.0.19 2008.05.22 TR/Dldr.Zlob.NMO[/B]
Authentium 5.1.0.4 2008.05.21 -
Avast 4.8.1195.0 2008.05.22 -
[B]AVG 7.5.0.516 2008.05.22 Downloader.Zlob.ZV[/B]
BitDefender 7.2 2008.05.22 -
CAT-QuickHeal 9.50 2008.05.22 -
[B]ClamAV 0.92.1 2008.05.22 Trojan.Zlob-4837[/B]
DrWeb 4.44.0.09170 2008.05.22 -
eSafe 7.0.15.0 2008.05.22 -
eTrust-Vet 31.4.5812 2008.05.22 -
Ewido 4.0 2008.05.22 -
F-Prot 4.4.2.54 2008.05.16 -
[B]F-Secure 6.70.13260.0 2008.05.22 Trojan-Downloader.Win32.Zlob.eie[/B]
Fortinet 3.14.0.0 2008.05.22 -
[B]GData 2.0.7306.1023 2008.05.22 Trojan-Downloader.Win32.Zlob.eie[/B]
Ikarus T3.1.1.26.0 2008.05.22 -
[B]Kaspersky 7.0.0.125 2008.05.22 Trojan-Downloader.Win32.Zlob.eie[/B]
McAfee 5300 2008.05.21 -
Microsoft 1.3520 2008.05.22 -
NOD32v2 3121 2008.05.22 -
Norman 5.80.02 2008.05.22 -
Panda 9.0.0.4 2008.05.22 -
Prevx1 V2 2008.05.22 -
Rising 20.45.32.00 2008.05.22 -
Sophos 4.29.0 2008.05.22 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.22 -
[B]TheHacker 6.2.92.316 2008.05.22 Trojan/Downloader.Zlob.eie[/B]
VBA32 3.12.6.6 2008.05.22 -
VirusBuster 4.3.26:9 2008.05.22 -
[B]Webwasher-Gateway 6.6.2 2008.05.22 Trojan.Dldr.Zlob.NMO[/B][/QUOTE]

Дополнительная информация
File size: 74856 bytes
MD5...: bc428b5b166205452b6b4aa2f7fc61c1
SHA1..: 0e8625d3d02049367fed37b5f7e8e7869523933d
SHA256: 2a6c34e8f6388e49a4d5a39c6f274d6e74807d7777147f16af6294b764bb27a2
SHA512: 8a60010c6ba73aeb2bee88d403bb4cf6cb9067ef6e7e4eec0347d91d8e94c6a4
2e2f1152c633e26743c08552bebddbcac9cdcebb7007680fac7fdc14307c8621
PEiD..: -
PEInfo: PE Structure information
23.05.2008, 05:16
ZhIV

[CODE]Файл jeur430.exe получен 2008.05.23 02:28:37 (CET)
Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.22.1 2008.05.22 -
[B]AntiVir 7.8.0.19 2008.05.22 PCK/NSIS.M[/B]
Authentium 5.1.0.4 2008.05.22 -
Avast 4.8.1195.0 2008.05.22 -
[B]AVG 7.5.0.516 2008.05.22 DNSChanger.AA
BitDefender 7.2 2008.05.23 Trojan.DNSChanger.SL
[/B]CAT-QuickHeal 9.50 2008.05.22 -
ClamAV 0.92.1 2008.05.22 -
DrWeb 4.44.0.09170 2008.05.23 -
eSafe 7.0.15.0 2008.05.22 -
eTrust-Vet 31.4.5814 2008.05.22 -
Ewido 4.0 2008.05.22 -
F-Prot 4.4.2.54 2008.05.16 -
[B]F-Secure 6.70.13260.0 2008.05.22 Trojan.Win32.DNSChanger.bov
[/B]Fortinet 3.14.0.0 2008.05.22 -
GData 2.0.7306.1023 2008.05.23 -
Ikarus T3.1.1.26.0 2008.05.23 -
[B]Kaspersky 7.0.0.125 2008.05.23 Trojan.Win32.DNSChanger.bov
[/B]McAfee 5301 2008.05.22 -
[B]Microsoft 1.3520 2008.05.23 TrojanDropper:Win32/Alureon.D[/B]
NOD32v2 3124 2008.05.23 -
Norman 5.80.02 2008.05.22 -
Panda 9.0.0.4 2008.05.22 -
[B]Prevx1 V2 2008.05.23 Malware Dropper[/B]
Rising 20.45.32.00 2008.05.22 -
Sophos 4.29.0 2008.05.22 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.23 -
TheHacker 6.2.92.318 2008.05.23 -
VBA32 3.12.6.6 2008.05.22 -
VirusBuster 4.3.26:9 2008.05.22 -
[B]Webwasher-Gateway 6.6.2 2008.05.23 Packer.NSIS.M[/B]

Дополнительная информация
File size: 109192 bytes[/CODE]

[size="1"][color="#666686"][B][I]Добавлено через 15 минут[/I][/B][/color][/size]

[CODE]Файл jeur599.exe получен 2008.05.23 02:30:25 (CET)
Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.22.1 2008.05.22 -
[B]AntiVir 7.8.0.19 2008.05.22 TR/Drop.Ag.37888-28[/B]
Authentium 5.1.0.4 2008.05.22 -
Avast 4.8.1195.0 2008.05.22 -
[B]AVG 7.5.0.516 2008.05.22 PSW.Webmoner.D[/B]
BitDefender 7.2 2008.05.23 -
CAT-QuickHeal 9.50 2008.05.22 -
ClamAV 0.92.1 2008.05.22 -
[B]DrWeb 4.44.0.09170 2008.05.23 Trojan.PWS.Webmonier.18
eSafe 7.0.15.0 2008.05.22 Suspicious File
[/B]eTrust-Vet 31.4.5814 2008.05.22 -
[B]Ewido 4.0 2008.05.22 Logger.Webmoner.jl[/B]
F-Prot 4.4.2.54 2008.05.16 -
[B]F-Secure 6.70.13260.0 2008.05.22 Trojan-Spy.Win32.Webmoner.jl
Fortinet 3.14.0.0 2008.05.22 Spy/Webmoner
GData 2.0.7306.1023 2008.05.23 Trojan-Spy.Win32.Webmoner.jl
Ikarus T3.1.1.26.0 2008.05.23 Trojan-Spy.Win32.Webmoner.jl
Kaspersky 7.0.0.125 2008.05.23 Trojan-Spy.Win32.Webmoner.jl
[/B]McAfee 5301 2008.05.22 -
Microsoft 1.3520 2008.05.23 -
NOD32v2 3124 2008.05.23 -
[B]Norman 5.80.02 2008.05.22 W32/Webmoner.VV[/B]
Panda 9.0.0.4 2008.05.22 -
[B]Prevx1 V2 2008.05.23 Malicious Software[/B]
Rising 20.45.32.00 2008.05.22 -
[B]Sophos 4.29.0 2008.05.22 Mal/Generic-A[/B]
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.23 -
[B]TheHacker 6.2.92.318 2008.05.23 Trojan/Spy.Webmoner.jl
VBA32 3.12.6.6 2008.05.22 Trojan-Spy.Win32.Webmoner.jl
[/B]VirusBuster 4.3.26:9 2008.05.22 -
[B]Webwasher-Gateway 6.6.2 2008.05.23 Trojan.Drop.Ag.37888-28[/B]

Дополнительная информация
File size: 37888 bytes
MD5...: 1067d0e85cb48c0a810ce1d6ae18f0c7[/CODE]

[CODE]Файл jeur623.exe получен 2008.05.23 02:39:44 (CET)
Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.22.1 2008.05.22 -
[B]AntiVir 7.8.0.19 2008.05.22 TR/Crypt.XPACK.Gen[/B]
Authentium 5.1.0.4 2008.05.22 -
Avast 4.8.1195.0 2008.05.22 -
[B]AVG 7.5.0.516 2008.05.22 SHeur.BLNN
BitDefender 7.2 2008.05.23 Trojan.Crypt.DI
CAT-QuickHeal 9.50 2008.05.22 Worm.Socks.md
[/B]ClamAV 0.92.1 2008.05.22 -
DrWeb 4.44.0.09170 2008.05.23 -
eSafe 7.0.15.0 2008.05.22 -
eTrust-Vet 31.4.5814 2008.05.22 -
Ewido 4.0 2008.05.22 -
F-Prot 4.4.2.54 2008.05.16 -
[B]F-Secure 6.70.13260.0 2008.05.22 Worm.Win32.Socks.md
Fortinet 3.14.0.0 2008.05.22 W32/Socks.MD!worm
GData 2.0.7306.1023 2008.05.23 Worm.Win32.Socks.md
Ikarus T3.1.1.26.0 2008.05.23 Trojan.Crypt.DI
Kaspersky 7.0.0.125 2008.05.23 Worm.Win32.Socks.md
[/B]McAfee 5301 2008.05.22 -
[B]Microsoft 1.3520 2008.05.23 TrojanDropper:Win32/Buzus.gen!A[/B]
NOD32v2 3124 2008.05.23 -
[B]Norman 5.80.02 2008.05.22 W32/Socks.T[/B]
Panda 9.0.0.4 2008.05.22 -
[B]Prevx1 V2 2008.05.23 Malicious Software[/B]
Rising 20.45.32.00 2008.05.22 -
[B]Sophos 4.29.0 2008.05.22 Mal/Generic-A
Sunbelt 3.0.1123.1 2008.05.17 VIPRE.Suspicious
[/B]Symantec 10 2008.05.23 -
TheHacker 6.2.92.318 2008.05.23 -
VBA32 3.12.6.6 2008.05.22 -
VirusBuster 4.3.26:9 2008.05.22 -
[B]Webwasher-Gateway 6.6.2 2008.05.23 Trojan.Crypt.XPACK.Gen[/B]

Дополнительная информация
File size: 9216 bytes
MD5...: f15988aa3743b6ab54b34b5d90dfa692[/CODE]

[CODE]Файл jeur627.exe получен 2008.05.23 02:41:19 (CET)
Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.22.1 2008.05.22 -
AntiVir 7.8.0.19 2008.05.22 -
Authentium 5.1.0.4 2008.05.22 -
Avast 4.8.1195.0 2008.05.22 -
AVG 7.5.0.516 2008.05.22 -
BitDefender 7.2 2008.05.23 -
[B]CAT-QuickHeal 9.50 2008.05.22 Trojan.Srizbi.ag[/B]
ClamAV 0.92.1 2008.05.22 -
DrWeb 4.44.0.09170 2008.05.23 -
eSafe 7.0.15.0 2008.05.22 -
eTrust-Vet 31.4.5814 2008.05.22 -
Ewido 4.0 2008.05.22 -
F-Prot 4.4.2.54 2008.05.16 -
Fortinet 3.14.0.0 2008.05.22 -
[B]GData 2.0.7306.1023 2008.05.23 Trojan.Win32.Srizbi.ag
Ikarus T3.1.1.26.0 2008.05.23 Virus.Trojan.Win32.Srizbi.ag
Kaspersky 7.0.0.125 2008.05.23 Trojan.Win32.Srizbi.ag
[/B]McAfee 5301 2008.05.22 -
Microsoft 1.3520 2008.05.23 -
NOD32v2 3124 2008.05.23 -
Norman 5.80.02 2008.05.22 -
Panda 9.0.0.4 2008.05.22 -
Prevx1 V2 2008.05.23 -
Rising 20.45.32.00 2008.05.22 -
Sophos 4.29.0 2008.05.22 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.23 -
TheHacker 6.2.92.318 2008.05.23 -
VBA32 3.12.6.6 2008.05.22 -
VirusBuster 4.3.26:9 2008.05.22 -
[B]Webwasher-Gateway 6.6.2 2008.05.23 Win32.Malware.dam (suspicious)
[/B]
Дополнительная информация
File size: 56088 bytes
MD5...: d97e63f2c5c659db19eaa3b3fc84725d[/CODE]

[CODE]Файл jeur641.exe получен 2008.05.23 02:43:56 (CET)
Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.22.1 2008.05.22 -
[B]AntiVir 7.8.0.19 2008.05.22 TR/Crypt.CD.7[/B]
Authentium 5.1.0.4 2008.05.22 -
Avast 4.8.1195.0 2008.05.22 -
[B]AVG 7.5.0.516 2008.05.22 PSW.Agent.THE
BitDefender 7.2 2008.05.23 Trojan.Crypt.CD
CAT-QuickHeal 9.50 2008.05.22 TrojanPSW.Agent.alb
[/B]ClamAV 0.92.1 2008.05.22 -
DrWeb 4.44.0.09170 2008.05.23 -
eSafe 7.0.15.0 2008.05.22 Suspicious File
[B]eTrust-Vet 31.4.5814 2008.05.22 Win32/VMalum.CYWO
[/B]Ewido 4.0 2008.05.22 -
F-Prot 4.4.2.54 2008.05.16 -
[B]F-Secure 6.70.13260.0 2008.05.22 Trojan-PSW.Win32.Agent.alb
[/B]Fortinet 3.14.0.0 2008.05.22 -
[B]GData 2.0.7306.1023 2008.05.23 Trojan-PSW.Win32.Agent.alb
Ikarus T3.1.1.26.0 2008.05.23 Trojan.Crypt.CD
Kaspersky 7.0.0.125 2008.05.23 Trojan-PSW.Win32.Agent.alb
[/B]McAfee 5301 2008.05.22 -
[B]Microsoft 1.3520 2008.05.23 Trojan:Win32/Meredrop
[/B]NOD32v2 3124 2008.05.23 -
Norman 5.80.02 2008.05.22 -
[B]Panda 9.0.0.4 2008.05.22 Trj/WoW.TZ
Prevx1 V2 2008.05.23 Malicious Software
[/B]Rising 20.45.32.00 2008.05.22 -
[B]Sophos 4.29.0 2008.05.22 Mal/Generic-A
[/B]Sunbelt 3.0.1123.1 2008.05.17 -
[B]Symantec 10 2008.05.23 Infostealer
TheHacker 6.2.92.318 2008.05.23 Trojan/PSW.Agent.alb
[/B]VBA32 3.12.6.6 2008.05.22 -
VirusBuster 4.3.26:9 2008.05.22 -
[B]Webwasher-Gateway 6.6.2 2008.05.23 Trojan.Crypt.CD.7[/B]

Дополнительная информация
File size: 65024 bytes
MD5...: 45ccb5b40703c5f365ba076553ab3d05[/CODE]

[CODE]Файл jeur642.exe получен 2008.05.23 02:45:09 (CET)
Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.22.1 2008.05.22 -
AntiVir 7.8.0.19 2008.05.22 -
Authentium 5.1.0.4 2008.05.22 -
Avast 4.8.1195.0 2008.05.22 -
AVG 7.5.0.516 2008.05.22 -
BitDefender 7.2 2008.05.23 -
CAT-QuickHeal 9.50 2008.05.22 -
ClamAV 0.92.1 2008.05.22 -
DrWeb 4.44.0.09170 2008.05.23 -
eSafe 7.0.15.0 2008.05.22 -
eTrust-Vet 31.4.5814 2008.05.22 -
Ewido 4.0 2008.05.22 -
F-Prot 4.4.2.54 2008.05.16 -
F-Secure 6.70.13260.0 2008.05.22 -
Fortinet 3.14.0.0 2008.05.22 -
GData 2.0.7306.1023 2008.05.23 -
Ikarus T3.1.1.26.0 2008.05.23 -
Kaspersky 7.0.0.125 2008.05.23 -
McAfee 5301 2008.05.22 -
Microsoft 1.3520 2008.05.23 -
NOD32v2 3124 2008.05.23 -
Norman 5.80.02 2008.05.22 -
[B]Panda 9.0.0.4 2008.05.22 Suspicious file[/B]
Prevx1 V2 2008.05.23 -
Rising 20.45.32.00 2008.05.22 -
Sophos 4.29.0 2008.05.22 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.23 -
TheHacker 6.2.92.318 2008.05.23 -
VBA32 3.12.6.6 2008.05.22 -
VirusBuster 4.3.26:9 2008.05.22 -
[B]Webwasher-Gateway 6.6.2 2008.05.23 Win32.Malware.dam (suspicious)
[/B]
Дополнительная информация
File size: 14881 bytes
MD5...: ac9d4545dfd8ec5c6a1cfa79f6f7a8a1[/CODE]

[size="1"][color="#666686"][B][I]Добавлено через 24 минуты[/I][/B][/color][/size]

[CODE]Файл jeur345.exe получен 2008.05.23 03:11:27 (CET)
Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.22.1 2008.05.22 -
[B]AntiVir 7.8.0.19 2008.05.22 TR/Crypt.XPACK.Gen[/B]
Authentium 5.1.0.4 2008.05.22 -
Avast 4.8.1195.0 2008.05.22 -
[B]AVG 7.5.0.516 2008.05.22 SHeur.BHTK[/B]
BitDefender 7.2 2008.05.23 -
[B]CAT-QuickHeal 9.50 2008.05.22 (Suspicious) - DNAScan[/B]
ClamAV 0.92.1 2008.05.22 -
DrWeb 4.44.0.09170 2008.05.23 -
[B]eSafe 7.0.15.0 2008.05.22 Suspicious File[/B]
eTrust-Vet 31.4.5814 2008.05.22 -
Ewido 4.0 2008.05.22 -
F-Prot 4.4.2.54 2008.05.16 -
F-Secure 6.70.13260.0 2008.05.22 -
[B]Fortinet 3.14.0.0 2008.05.22 W32/STRAT_GEN.3!worm[/B]
GData 2.0.7306.1023 2008.05.23 -
[B]Ikarus T3.1.1.26.0 2008.05.23 Trojan.Crypt.XPACK[/B]
Kaspersky 7.0.0.125 2008.05.23 -
McAfee 5301 2008.05.22 -
[B]Microsoft 1.3520 2008.05.23 TrojanDropper:Win32/Srizbi.gen!D[/B]
NOD32v2 3124 2008.05.23 -
Norman 5.80.02 2008.05.22 -
Panda 9.0.0.4 2008.05.22 -
Prevx1 V2 2008.05.23 -
Rising 20.45.32.00 2008.05.22 -
[B]Sophos 4.29.0 2008.05.22 Mal/EncPk-CK[/B]
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.23 -
TheHacker 6.2.92.318 2008.05.23 -
VBA32 3.12.6.6 2008.05.22 -
VirusBuster 4.3.26:9 2008.05.22 -
[B]Webwasher-Gateway 6.6.2 2008.05.23 Trojan.Crypt.XPACK.Gen[/B]

Дополнительная информация
File size: 167936 bytes
MD5...: 9294b7367b75231e32fe38bdc765563d[/CODE]
23.05.2008, 06:42
R@nza

Файл svchosts.exe получен 2008.05.22 04:35:42 (CET)
Текущий статус: закончено
Результат: 8/32 (25.00%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.20.0 2008.05.21 -
[B]AntiVir 7.8.0.19 2008.05.21 TR/Crypt.XPACK.Gen[/B]
Authentium 5.1.0.4 2008.05.21 -
Avast 4.8.1195.0 2008.05.21 -
AVG 7.5.0.516 2008.05.21 Pakes
[B]BitDefender 7.2 2008.05.22 Trojan.Spy.Wsnpoem.CH[/B]
CAT-QuickHeal 9.50 2008.05.21 -
ClamAV 0.92.1 2008.05.22 -
DrWeb 4.44.0.09170 2008.05.21 -
[B]eSafe 7.0.15.0 2008.05.21 Suspicious File[/B]
eTrust-Vet 31.4.5808 2008.05.21 -
Ewido 4.0 2008.05.21 -
F-Prot 4.4.2.54 2008.05.16 -
[B]F-Secure 6.70.13260.0 2008.05.22 Suspicious:W32/Malware!Gemini[/B]
Fortinet 3.14.0.0 2008.05.22 -
GData 2.0.7306.1023 2008.05.22 -
Ikarus T3.1.1.26.0 2008.05.22 -
Kaspersky 7.0.0.125 2008.05.22 -
[B]McAfee 5300 2008.05.21 Spy-Agent.bw.gen.e
Microsoft 1.3520 2008.05.22 PWS:Win32/Zbot.gen!E[/B]
NOD32v2 3118 2008.05.21 -
Norman 5.80.02 2008.05.21 -
Panda 9.0.0.4 2008.05.22 -
Prevx1 V2 2008.05.22 -
Rising 20.45.22.00 2008.05.22 -
Sophos 4.29.0 2008.05.22 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.22 -
TheHacker 6.2.92.315 2008.05.21 -
VBA32 3.12.6.6 2008.05.21 -
VirusBuster 4.3.26:9 2008.05.21 -
[B]Webwasher-Gateway 6.6.2 2008.05.21 Trojan.Crypt.XPACK.G[/B]en
Дополнительная информация
File size: 50688 bytes
MD5...: dbbc12952a8f0fec8eb0268f7223f66f
SHA1..: 05ca78a3e43797cb019f076f3e98a4d88f3c2a66
SHA256: e48c8448c1ec44a4b07fd26438455e4551d100dc19c79699055b9446c6acfdb6
SHA512: 17cb55fbd91428445dfbbc99f90a7689a1846f6f53f0124459b2e9f30e8f518e
3dcfe6ce04de64921032288205dcf684d8de59de6097b8c8a80990d7a09fe339
23.05.2008, 10:29
Гриша

t=23264

[QUOTE]Файл avz00002.dta получен 2008.05.23 08:21:22 (CET)

Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.22.1 2008.05.23 -
[B]AntiVir 7.8.0.19 2008.05.22 HEUR/Malware[/B]
Authentium 5.1.0.4 2008.05.22 -
Avast 4.8.1195.0 2008.05.22 -
AVG 7.5.0.516 2008.05.22 -
BitDefender 7.2 2008.05.23 -
CAT-QuickHeal 9.50 2008.05.22 -
ClamAV 0.92.1 2008.05.23 -
DrWeb 4.44.0.09170 2008.05.23 -
eSafe 7.0.15.0 2008.05.22 -
eTrust-Vet 31.4.5814 2008.05.22 -
Ewido 4.0 2008.05.22 -
F-Prot 4.4.2.54 2008.05.16 -
[B]F-Secure 6.70.13260.0 2008.05.22-W32/Malware[/B]
Fortinet 3.14.0.0 2008.05.23 -
GData 2.0.7306.1023 2008.05.23 -
Ikarus T3.1.1.26.0 2008.05.23 -
Kaspersky 7.0.0.125 2008.05.23 -
McAfee 5301 2008.05.22 -
Microsoft 1.3520 2008.05.23 -
NOD32v2 3124 2008.05.23 -
[B]Norman 5.80.02 2008.05.22-W32/Malware[/B]
Panda 9.0.0.4 2008.05.22 -
Prevx1 V2 2008.05.23 -
[B]Rising 20.45.32.00 2008.05.22-Backdoor.Win32.RemoteAdmin.h[/B]
Sophos 4.29.0 2008.05.23 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.23 -
TheHacker 6.2.92.318 2008.05.23 -
VBA32 3.12.6.6 2008.05.22 -
VirusBuster 4.3.26:9 2008.05.22 -
Webwasher-Gateway 6.6.2 2008.05.23 [B]Heuristic.Malware[/B][/QUOTE]

[QUOTE]Файл avz00003.dta получен 2008.05.23 08:21:55 (CET)

Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.22.1 2008.05.23 -
[B]AntiVir 7.8.0.19 2008.05.22-HEUR/Malware[/B]
Authentium 5.1.0.4 2008.05.22 -
Avast 4.8.1195.0 2008.05.22 -
AVG 7.5.0.516 2008.05.22 -
BitDefender 7.2 2008.05.23 -
CAT-QuickHeal 9.50 2008.05.22 -
ClamAV 0.92.1 2008.05.23 -
DrWeb 4.44.0.09170 2008.05.23 -
eSafe 7.0.15.0 2008.05.22 -
eTrust-Vet 31.4.5814 2008.05.22 -
Ewido 4.0 2008.05.22 -
F-Prot 4.4.2.54 2008.05.16 -
Fortinet 3.14.0.0 2008.05.23 -
GData 2.0.7306.1023 2008.05.23 -
Ikarus T3.1.1.26.0 2008.05.23 -
Kaspersky 7.0.0.125 2008.05.23 -
McAfee 5301 2008.05.22 -
Microsoft 1.3520 2008.05.23 -
NOD32v2 3124 2008.05.23 -
[B]Norman 5.80.02 2008.05.22-W32/Malware[/B]
Panda 9.0.0.4 2008.05.22 -
Prevx1 V2 2008.05.23 -
[B]Rising 20.45.32.00 2008.05.22-Backdoor.Win32.RemoteAdmin.h[/B]
Sophos 4.29.0 2008.05.23 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.23 -
TheHacker 6.2.92.318 2008.05.23 -
VBA32 3.12.6.6 2008.05.22 -
VirusBuster 4.3.26:9 2008.05.22 -
[B]Webwasher-Gateway 6.6.2 2008.05.23-Heuristic.Malware[/B][/QUOTE]
23.05.2008, 12:54
Shu_b

[CODE]File Temp\wmsetup.dll received on 05.23.2008 10:13:42 (CET)
Antivirus Version Last Update Result
AhnLab-V3 2008.5.22.1 2008.05.23 -
AntiVir 7.8.0.19 2008.05.23 -
Authentium 5.1.0.4 2008.05.22 -
Avast 4.8.1195.0 2008.05.22 -
AVG 7.5.0.516 2008.05.22 -
[B]BitDefender 7.2 2008.05.23 DeepScan:Generic.Malware.dld!!.8E2E18BD[/B]
CAT-QuickHeal 9.50 2008.05.22 -
ClamAV 0.92.1 2008.05.23 -
[B]DrWeb 4.44.0.09170 2008.05.23 DLOADER.Trojan[/B]
eSafe 7.0.15.0 2008.05.22 -
eTrust-Vet 31.4.5814 2008.05.22 -
Ewido 4.0 2008.05.22 -
F-Prot 4.4.2.54 2008.05.16 -
[B]F-Secure 6.70.13260.0 2008.05.23 Trojan-Downloader.Win32.Murlo.nn[/B]
Fortinet 3.14.0.0 2008.05.23 -
[B]GData 2.0.7306.1023 2008.05.23 Trojan-Downloader.Win32.Murlo.nn[/B]
Ikarus T3.1.1.26.0 2008.05.23 -
[B]Kaspersky 7.0.0.125 2008.05.23 Trojan-Downloader.Win32.Murlo.nn[/B]
McAfee 5301 2008.05.22 -
Microsoft 1.3520 2008.05.23 -
NOD32v2 3124 2008.05.23 -
Norman 5.80.02 2008.05.22 -
Panda 9.0.0.4 2008.05.22 -
Prevx1 V2 2008.05.23 -
Rising 20.45.32.00 2008.05.22 -
Sophos 4.29.0 2008.05.23 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.23 -
TheHacker 6.2.92.318 2008.05.23 -
VBA32 3.12.6.6 2008.05.22 -
VirusBuster 4.3.26:9 2008.05.22 -
Webwasher-Gateway 6.6.2 2008.05.23 -
Additional information
File size: 5632 bytes[/CODE]
24.05.2008, 14:31
mayas

угоняет пароли фаерфокса

[QUOTE]Result: 4/32 (12.5%)

Antivirus Version Last Update Result
AhnLab-V3 2008.5.22.1 2008.05.23 -
AntiVir 7.8.0.19 2008.05.23 -
Authentium 5.1.0.4 2008.05.23 -
Avast 4.8.1195.0 2008.05.23 -
AVG 7.5.0.516 2008.05.24 -
BitDefender 7.2 2008.05.24 -
CAT-QuickHeal 9.50 2008.05.24 -
ClamAV 0.92.1 2008.05.24 -
DrWeb 4.44.0.09170 2008.05.24 [B]Trojan.DownLoader.origin[/B]
eSafe 7.0.15.0 2008.05.22 -
eTrust-Vet 31.4.5817 2008.05.23 -
Ewido 4.0 2008.05.23 -
F-Prot 4.4.4.56 2008.05.23 -
F-Secure 6.70.13260.0 2008.05.23 -
Fortinet 3.14.0.0 2008.05.24 -
GData 2.0.7306.1023 2008.05.23 -
Ikarus T3.1.1.26.0 2008.05.24 [B]Trojan-PWS.Win32.Firefox.k[/B]
Kaspersky 7.0.0.125 2008.05.24 -
McAfee 5302 2008.05.23 -
Microsoft 1.3520 2008.05.24 -
NOD32v2 3128 2008.05.23 -
Norman 5.80.02 2008.05.23 -
Panda 9.0.0.4 2008.05.23 -
Prevx1 V2 2008.05.24 [B]Adware[/B]
Rising 20.45.42.00 2008.05.23 -
Sophos 4.29.0 2008.05.24 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.24 -
TheHacker 6.2.92.318 2008.05.23 -
VBA32 3.12.6.6 2008.05.24 -
VirusBuster 4.3.26:9 2008.05.23 -
Webwasher-Gateway 6.6.2 2008.05.24 [B]Virus.Win32.FileInfector.gen!90 (suspicious)[/B][/QUOTE]

[url]http://www.virustotal.com/analisis/554c8060c241fdd115afdd2e9655073b[/url]

[QUOTE]

File ______________________.__.bat received on 05.25.2008 00:33:53
Result: 1/32 (3.13%)

Antivirus Version Last Update Result
AhnLab-V3 2008.5.22.1 2008.05.23 -
AntiVir 7.8.0.19 2008.05.24 -
Authentium 5.1.0.4 2008.05.23 -
Avast 4.8.1195.0 2008.05.24 -
AVG 7.5.0.516 2008.05.24 -
BitDefender 7.2 2008.05.24 [B]BehavesLike:Trojan.TaskDisabler[/B]
CAT-QuickHeal 9.50 2008.05.24 -
ClamAV 0.92.1 2008.05.24 -
DrWeb 4.44.0.09170 2008.05.24 -
eSafe 7.0.15.0 2008.05.22 -
eTrust-Vet 31.4.5817 2008.05.23 -
Ewido 4.0 2008.05.24 -
F-Prot 4.4.4.56 2008.05.23 -
F-Secure 6.70.13260.0 2008.05.23 -
Fortinet 3.14.0.0 2008.05.24 -
GData 2.0.7306.1023 2008.05.23 -
Ikarus T3.1.1.26.0 2008.05.24 -
Kaspersky 7.0.0.125 2008.05.24 -
McAfee 5302 2008.05.23 -
Microsoft 1.3520 2008.05.25 -
NOD32v2 3128 2008.05.23 -
Norman 5.80.02 2008.05.23 -
Panda 9.0.0.4 2008.05.24 -
Prevx1 V2 2008.05.25 -
Rising 20.45.42.00 2008.05.23 -
Sophos 4.29.0 2008.05.24 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.24 -
TheHacker 6.2.92.318 2008.05.23 -
VBA32 3.12.6.6 2008.05.24 -
VirusBuster 4.3.26:9 2008.05.24 -
Webwasher-Gateway 6.6.2 2008.05.25 -
Additional information
File size: 2486 bytes
MD5...: 5831dc9acd10f2a46334793d303676f9
SHA1..: fd37f0742210b95d93b1cf76ddc47bdb83a5fc23
SHA256: 29ed8253857f9535d5cda276640bf6fa9091adb1e5efc77b3a3cd1d5dfbc7fd0
SHA512: e5ff70d9d10b4805a2f9201891426fb5b515a6069afa2a4210db352d415d9faa
e36e0cbb0d5b13c540ba4cc1a7cf2aaf0b1feedbe5a4c18d8d8c3d4f50d820eb
PEiD..: -
PEInfo: -
packers (Kaspersky): bvm[/QUOTE]
25.05.2008, 06:23
Winsent

* name..: svchost.exe
* size..: 42496
* md5...: 2a0cfe442f8ac14b3b1d619597c87c1e
* sha1..: 04ef33ee52fb57009fb3fbd2935330e5ded5ecaf
* peid..: -

[ scan result ]
AhnLab-V3 2008.5.22.1/20080523 found nothing
[B]AntiVir 7.8.0.19/20080524 found [TR/Spy.Gen]
Authentium 5.1.0.4/20080523 found [W32/LdPinch.I.gen!Eldorado][/B]
Avast 4.8.1195.0/20080524 found nothing
[B]AVG 7.5.0.516/20080524 found [PSW.Ldpinch.11.BM]
BitDefender 7.2/20080525 found [Trojan.PWS.LdPinch.TMK]
CAT-QuickHeal 9.50/20080524 found [TrojanPSW.LdPinch.cdz][/B]
ClamAV 0.92.1/20080525 found nothing
DrWeb 4.44.0.09170/20080525 found nothing
eSafe 7.0.15.0/20080522 found nothing
eTrust-Vet 31.4.5817/20080523 found nothing
Ewido 4.0/20080524 found nothing
[B]F-Prot 4.4.4.56/20080523 found [W32/LdPinch.I.gen!Eldorado]
F-Secure 6.70.13260.0/20080523 found [LdPinch.gen1][/B]
Fortinet 3.14.0.0/20080524 found nothing
GData 2.0.7306.1023/20080523 found nothing
[B]Ikarus T3.1.1.26.0/20080525 found [MalwareScope.Trojan-PWS.Pinch.1][/B]
Kaspersky 7.0.0.125/20080525 found nothing
McAfee 5302/20080523 found nothing
[B]Microsoft 1.3520/20080525 found [PWS:Win32/Ldpinch.gen][/B]
NOD32v2 3128/20080523 found nothing
[B]Norman 5.80.02/20080523 found [LdPinch.gen1][/B]
Panda 9.0.0.4/20080524 found nothing
Prevx1 V2/20080525 found nothing
Rising 20.45.42.00/20080523 found nothing
[B]Sophos 4.29.0/20080524 found [Mal/Basine-C][/B]
Sunbelt 3.0.1123.1/20080517 found nothing
Symantec 10/20080525 found nothing
TheHacker 6.2.92.318/20080523 found nothing
[B]VBA32 3.12.6.6/20080524 found [MalwareScope.Trojan-PSW.Pinch.42][/B]
VirusBuster 4.3.26:9/20080524 found nothing
[B]Webwasher-Gateway 6.6.2/20080525 found [Trojan.Spy.Gen][/B]
26.05.2008, 05:38
R@nza

Z

[QUOTE]Файл avz00001.dta получен 2008.05.10 08:41:40 (CET)
Текущий статус: закончено
Результат: 13/31 (41.94%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 - - -
[b]AntiVir - - TR/Proxy.Small.MP[/b]
Authentium - - -
Avast - - -
[b]AVG - - SHeur.BHPE[/b]
BitDefender - - -
CAT-QuickHeal - - -
ClamAV - - -
[b]DrWeb - - Trojan.Spambot.3202[/b]
eSafe - - -
eTrust-Vet - - -
Ewido - - -
F-Prot - - -
[b]F-Secure - - Trojan-Proxy.Win32.Small.mp
Fortinet - - W32/Small.MP!tr
Ikarus - - Trojan-Proxy.Small.MP
Kaspersky - - Trojan-Proxy.Win32.Small.mp[/b]
McAfee - - -
Microsoft - - -
NOD32v2 - - -
Norman - - -
[b]Panda - - Trj/Downloader.MDW
Prevx1 - - Malicious Software[/b]
Rising - - -
[b]Sophos - - Mal/Generic-A[/b]
Sunbelt - - -
Symantec - - -
[b]TheHacker - - Trojan/Proxy.Small.mp
VBA32 - - Trojan-Proxy.Win32.Small.mp[/b]
VirusBuster - - -
[b]Webwasher-Gateway - - Trojan.Proxy.Small.MP[/b]
Дополнительная информация
MD5: f934c4eb4b8586bdb8433f6703b23fca
SHA1: f113ba255d4dfaeb1fe3fc62e6eae11bc2e6e484
SHA256: 47a4f0d1a387ce6992861dc3e5aa1fd6a2462198cef8f968fab520d3dcb618dd[/QUOTE]

[QUOTE]Файл ieupdater.exe_ получен 2008.05.24 16:35:43 (CET)
Текущий статус: закончено
Результат: 20/32 (62.50%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.22.1 2008.05.23 -
[b]AntiVir 7.8.0.19 2008.05.24 TR/Dldr.Winlagons.KE[/b]
Authentium 5.1.0.4 2008.05.23 -
Avast 4.8.1195.0 2008.05.23 -
[b]AVG 7.5.0.516 2008.05.24 Downloader.Generic7.OQY
BitDefender 7.2 2008.05.24 Trojan.Downloader.Tipikit.F
CAT-QuickHeal 9.50 2008.05.24 (Suspicious) - DNAScan
ClamAV 0.92.1 2008.05.24 Trojan.Downloader-34729[/b]
DrWeb 4.44.0.09170 2008.05.24 -
[b]eSafe 7.0.15.0 2008.05.22 suspicious Trojan/Worm[/b]
eTrust-Vet 31.4.5817 2008.05.23 -
Ewido 4.0 2008.05.24 -
[b]F-Prot 4.4.4.56 2008.05.23 W32/Tipikit.A!Eldorado
F-Secure 6.70.13260.0 2008.05.23 Suspicious_F.gen
Fortinet 3.14.0.0 2008.05.24 Tipiki!tr
GData 2.0.7306.1023 2008.05.23 Trojan-Downloader.Win32.Winlagons.ke
Ikarus T3.1.1.26.0 2008.05.24 Trojan-Downloader.Win32.Tipikit.C
Kaspersky 7.0.0.125 2008.05.24 Trojan-Downloader.Win32.Winlagons.ke[/b]
McAfee 5302 2008.05.23 -
[b]Microsoft 1.3520 2008.05.24 TrojanDownloader:Win32/Tipikit.C
NOD32v2 3128 2008.05.23 probably a variant of Win32/TrojanDownloader.Tiny.NJ
Norman 5.80.02 2008.05.23 Suspicious_F.gen
Panda 9.0.0.4 2008.05.24 Suspicious file[/b]
Prevx1 V2 2008.05.24 -
Rising 20.45.42.00 2008.05.23 -
[b]Sophos 4.29.0 2008.05.24 Troj/Tipiki-Fam
Sunbelt 3.0.1123.1 2008.05.17 VIPRE.Suspicious[/b]
Symantec 10 2008.05.24 -
TheHacker 6.2.92.318 2008.05.23 -
VBA32 3.12.6.6 2008.05.24 -
[b]VirusBuster 4.3.26:9 2008.05.23 Trojan.DL.Tipikit.Gen
Webwasher-Gateway 6.6.2 2008.05.24 Trojan.Dldr.Winlagons.KE[/b]
Дополнительная информация
File size: 3089 bytes
MD5...: 8c20d4f76b34ab660366bc87aedeed98
SHA1..: 92dd5bc527c0d1fe7de923fd1d076b1c96898631
SHA256: 3df27cb830c3c45ee6bda0f19808535845053cb2e5761d9f1b4c557720bfe28a
SHA512: c9762bd53ddd367fefa9042f4a2bc19f61283cbb1d69085b2900ffdb139b6a56
1b451244426c103d05130ce273b73796b612208e19349d634e4a8098f42f366a[/QUOTE]

[QUOTE]Файл avz00003.dta получен 2008.05.26 03:30:30 (CET)
Текущий статус: закончено
Результат: 16/32 (50%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.22.1 2008.05.23 -
[b]AntiVir 7.8.0.19 2008.05.25 TR/SubSys.DJ.2
Authentium 5.1.0.4 2008.05.26 W32/Agent.AZ.gen!Eldorado[/b]
Avast 4.8.1195.0 2008.05.25 -
[b]AVG 7.5.0.516 2008.05.25 Generic10.RDC
BitDefender 7.2 2008.05.26 Trojan.Agent.AGKK
CAT-QuickHeal 9.50 2008.05.24 Trojan.SubSys.dj[/b]
ClamAV 0.92.1 2008.05.25 -
[b]DrWeb 4.44.0.09170 2008.05.25 Trojan.Okuks.based[/b]
eSafe 7.0.15.0 2008.05.25 -
eTrust-Vet 31.4.5817 2008.05.23 -
Ewido 4.0 2008.05.25 -
[b]F-Prot 4.4.4.56 2008.05.23 W32/Agent.AZ.gen!Eldorado
F-Secure 6.70.13260.0 2008.05.26 Trojan.Win32.SubSys.dj[/b]
Fortinet 3.14.0.0 2008.05.25 -
[b]GData 2.0.7306.1023 2008.05.23 Trojan.Win32.SubSys.dj
Ikarus T3.1.1.26.0 2008.05.26 Virus.Trojan.Win32.SubSys.dj
Kaspersky 7.0.0.125 2008.05.26 Trojan.Win32.SubSys.dj[/b]
McAfee 5302 2008.05.23 -
[b]Microsoft 1.3520 2008.05.26 Trojan:Win32/Agent.gen!O[/b]
NOD32v2 3128 2008.05.23 -
[b]Norman 5.80.02 2008.05.23 W32/Smalltroj.EFEC
Panda 9.0.0.4 2008.05.25 Suspicious file[/b]
Prevx1 V2 2008.05.26 -
Rising 20.45.42.00 2008.05.23 -
[b]Sophos 4.29.0 2008.05.25 Troj/Agent-GXR[/b]
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.25 -
TheHacker 6.2.92.318 2008.05.23 -
VBA32 3.12.6.6 2008.05.25 -
VirusBuster 4.3.26:9 2008.05.25 -
[b]Webwasher-Gateway 6.6.2 2008.05.25 Trojan.SubSys.DJ.2[/b]
Дополнительная информация
File size: 24576 bytes
MD5...: 50938e882f780ca83c320cb41d4afcee
SHA1..: 63f2110efc8ca3af68daa61d5b93ba4af0caf715
SHA256: 59365c4a2d82ba3eeaeeb7240612e7c51b3d1984b8babc8fa3dc3ae083d7ff84
SHA512: 9c66df2f0a539aa6a8cd7b158ae0be535f935b04b9d38a9653d38338b08c562c
06797043c126773f3d351c742068636663be3ec4347032d3d976e5275973e494[/QUOTE]

пока хватит) стоял McAfee думаю пора его на свалку)

[[color=#CC0000]moderated: мартовские проверки наверное интересны, но не актуальны. Поэтому убраны.[/color]]
27.05.2008, 15:47
santy

Файл ntos.e получен 2008.05.27 13:24:46 (CET)
Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.22.1 2008.05.27 -
[b]AntiVir 7.8.0.19 2008.05.27 TR/Crypt.XPACK.Gen [/B]
Authentium 5.1.0.4 2008.05.26 -
[b]Avast 4.8.1195.0 2008.05.27 Win32:Zbot-gen[/b]
[b]AVG 7.5.0.516 2008.05.26 Pakes[/b]
[b]BitDefender 7.2 2008.05.27 Trojan.Spy.Wsnpoem.CH[/b]
CAT-QuickHeal 9.50 2008.05.26 -
ClamAV 0.92.1 2008.05.27 -
DrWeb 4.44.0.09170 2008.05.27 -
eSafe 7.0.15.0 2008.05.26 -
eTrust-Vet 31.4.5826 2008.05.27 -
Ewido 4.0 2008.05.27 -
[b]F-Prot 4.4.4.56 2008.05.26 W32/Zbot.G.gen!Eldorado[/b]
[b]F-Secure 6.70.13260.0 2008.05.27 Suspicious:W32/Malware!Gemini[/b]
Fortinet 3.14.0.0 2008.05.27 -
[b]GData 2.0.7306.1023 2008.05.27 Win32:Zbot-gen[/b]
Ikarus T3.1.1.26.0 2008.05.27 -
Kaspersky 7.0.0.125 2008.05.27 -
McAfee 5303 2008.05.26 Spy-Agent.bw.gen.e
[b]Microsoft 1.3520 2008.05.27 PWS:Win32/Zbot.gen!E[/b]
NOD32v2 3134 2008.05.27 -
Norman 5.80.02 2008.05.26 -
Panda 9.0.0.4 2008.05.27 -
Prevx1 V2 2008.05.27 -
Rising 20.46.12.00 2008.05.27 -
Sophos 4.29.0 2008.05.27 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.27 -
TheHacker 6.2.92.320 2008.05.26 -
VBA32 3.12.6.6 2008.05.27 -
VirusBuster 4.3.26:9 2008.05.26 -
[b]Webwasher-Gateway 6.6.2 2008.05.27 Trojan.Crypt.XPACK.Gen[/b]

[size="1"][color="#666686"][B][I]Добавлено через 3 минуты[/I][/B][/color][/size]

Файл svchosts.exe получен 2008.05.27 13:14:05 (CET)
Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.22.1 2008.05.27 -
[b]AntiVir 7.8.0.19 2008.05.27 TR/Crypt.XPACK.Gen[/b]
Authentium 5.1.0.4 2008.05.26 -
Avast 4.8.1195.0 2008.05.27 -
[b]AVG 7.5.0.516 2008.05.26 Pakes[/b]
[b]BitDefender 7.2 2008.05.27 Trojan.Peed.Gen[/b]
CAT-QuickHeal 9.50 2008.05.26 -
ClamAV 0.92.1 2008.05.27 -
DrWeb 4.44.0.09170 2008.05.27 -
[b]eSafe 7.0.15.0 2008.05.26 Suspicious File[/b]
eTrust-Vet 31.4.5826 2008.05.27 -
Ewido 4.0 2008.05.27 -
[b]F-Prot 4.4.4.56 2008.05.26 W32/Zbot.G.gen!Eldorado[/b]
[b]F-Secure 6.70.13260.0 2008.05.27 Suspicious:W32/Malware!Gemini[/b]
Fortinet 3.14.0.0 2008.05.27 -
GData 2.0.7306.1023 2008.05.27 -
Ikarus T3.1.1.26.0 2008.05.27 -
Kaspersky 7.0.0.125 2008.05.27 -
[b]McAfee 5303 2008.05.26 Spy-Agent.bw.gen.e[/b]
[b]Microsoft 1.3520 2008.05.27 PWS:Win32/Zbot.gen!E[/b]
NOD32v2 3134 2008.05.27 -
Norman 5.80.02 2008.05.26 -
Panda 9.0.0.4 2008.05.27 -
Prevx1 V2 2008.05.27 -
Rising 20.46.12.00 2008.05.27 -
Sophos 4.29.0 2008.05.27 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.27 -
TheHacker 6.2.92.320 2008.05.26 -
VBA32 3.12.6.6 2008.05.27 -
VirusBuster 4.3.26:9 2008.05.26 -
[b]Webwasher-Gateway 6.6.2 2008.05.27 Trojan.Crypt.XPACK.Gen[/b]
29.05.2008, 10:32
ISO

Файл mstc.exe получен 2008.05.29 08:03:55 (CET)
Текущий статус: закончено
Результат: 19/32 (59.38%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.29.0 2008.05.29 -
[B]AntiVir 7.8.0.19 2008.05.28 TR/Agent.5632.176
Authentium 5.1.0.4 2008.05.28 W32/Heuristic-210!Eldorado
Avast 4.8.1195.0 2008.05.29 Win32:Agent-TEN
AVG 7.5.0.516 2008.05.28 Downloader.Generic7.NYI
BitDefender 7.2 2008.05.29 DeepScan:Generic.Malware.dld!!.ED0C8AEA[/B]
CAT-QuickHeal 9.50 2008.05.28 -
[B]ClamAV 0.92.1 2008.05.28 PUA.Packed.PEPack
DrWeb 4.44.0.09170 2008.05.28 Trojan.DownLoader.61999
eSafe 7.0.15.0 2008.05.28 suspicious Trojan/Worm[/B]
eTrust-Vet 31.4.5831 2008.05.28 -
Ewido 4.0 2008.05.28 -
[B]F-Prot 4.4.4.56 2008.05.28 W32/Heuristic-210!Eldorado
F-Secure 6.70.13260.0 2008.05.29 W32/Downloader[/B]
Fortinet 3.14.0.0 2008.05.29 -
[B]GData 2.0.7306.1023 2008.05.29 Win32:Agent-TEN
Ikarus T3.1.1.26.0 2008.05.29 Backdoor.Win32.SdBot.XM[/B]
Kaspersky 7.0.0.125 2008.05.29 -
[B]McAfee 5305 2008.05.28 Generic Downloader.x[/B]
Microsoft 1.3520 2008.05.29 -
[B]NOD32v2 3142 2008.05.28 a variant of Win32/TrojanDownloader.Small.OAA
Norman 5.80.02 2008.05.28 W32/Downloader[/B]
Panda 9.0.0.4 2008.05.28 -
[B]Prevx1 V2 2008.05.29 Cloaked Malware[/B]
Rising 20.46.22.00 2008.05.28 -
[B]Sophos 4.29.0 2008.05.29 Mal/Generic-A[/B]
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.29 -
TheHacker 6.2.92.322 2008.05.28 -
[B]VBA32 3.12.6.6 2008.05.28 Trojan.Win32.Small.avf[/B]
VirusBuster 4.3.26:9 2008.05.28 -
[B]Webwasher-Gateway 6.6.2 2008.05.28 Trojan.Agent.5632.176[/B]
Дополнительная информация
File size: 5632 bytes
MD5...: 75353afd20ef7b53b7eb205b4fffcc72
SHA1..: a5b9ee506980a948e24c1df05699980033de44ee
SHA256: cbdc6a611115c20419141bf62efdeba456454766475ed1f7d334e3a45b532a77
SHA512: 26876f97e787842020ea95b3b164b81817e4f292175a952d06c8469966089bac
537cad8826c7cef96f7612e304b9ed8d9ba73091584f7bbbf5d4b96beb318566
PEiD..: Crypto-Lock v2.02 (Eng) -> Ryan Thian
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x40a080
timedatestamp.....: 0x48387199 (Sat May 24 19:50:49 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x8000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x9000 0x2000 0x1200 7.55 e77f91e3af256a16123cf47f293ff431
UPX2 0xb000 0x1000 0x200 1.44 805117c88e7f7cf2e567ccb44fdabc8a

( 2 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, ExitProcess
> USER32.DLL: wsprintfA

( 0 exports )
packers (Authentium): UPX, PE-Pack, Aspack
Norman Sandbox: [ General information ]
* **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: [email][email protected][/email] - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
* Creating several executable files on hard-drive.
* File length: 5632 bytes.

С каким паролем на [email][email protected][/email] отправлять файл?

Файл sy32.exe получен 2008.05.29 08:16:26 (CET)
Текущий статус: закончено
Результат: 15/32 (46.88%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.29.0 2008.05.29 -
[B]AntiVir 7.8.0.19 2008.05.28 TR/Crypt.ULPM.Gen
Authentium 5.1.0.4 2008.05.28 W32/Heuristic-MUP!Eldorado
Avast 4.8.1195.0 2008.05.29 Win32:JunkPoly
AVG 7.5.0.516 2008.05.28 Worm/AutoRun.CC
BitDefender 7.2 2008.05.29 Packer.Malware.LDPinch.A[/B]
CAT-QuickHeal 9.50 2008.05.28 -
ClamAV 0.92.1 2008.05.28 -
[B]DrWeb 4.44.0.09170 2008.05.28 Trojan.Inject.3265
eSafe 7.0.15.0 2008.05.28 suspicious Trojan/Worm[/B]
eTrust-Vet 31.4.5831 2008.05.28 -
Ewido 4.0 2008.05.28 -
[B]F-Prot 4.4.4.56 2008.05.28 W32/Heuristic-MUP!Eldorado[/B]
F-Secure 6.70.13260.0 2008.05.29 -
Fortinet 3.14.0.0 2008.05.29 -
[B]GData 2.0.7306.1023 2008.05.29 Win32:JunkPoly
Ikarus T3.1.1.26.0 2008.05.29 Virus.Win32.JunkPoly
Kaspersky 7.0.0.125 2008.05.29 Heur.Invader
McAfee 5305 2008.05.28 New Malware.bl[/B]
Microsoft 1.3520 2008.05.29 -
NOD32v2 3142 2008.05.28 -
Norman 5.80.02 2008.05.28 -
[B]Panda 9.0.0.4 2008.05.28 Suspicious file[/B]
Prevx1 V2 2008.05.29 -
Rising 20.46.30.00 2008.05.29 -
[B]Sophos 4.29.0 2008.05.29 Mal/HckPk-A[/B]
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.29 -
TheHacker 6.2.92.322 2008.05.28 -
VBA32 3.12.6.6 2008.05.28 -
VirusBuster 4.3.26:9 2008.05.28 -
[B]Webwasher-Gateway 6.6.2 2008.05.28 Trojan.Crypt.ULPM.Gen[/B]
Дополнительная информация
File size: 12506 bytes
MD5...: 50803e2c00a35657dff5a6b581495472
SHA1..: f5e18c76c0bbf0fd7ed999c45602212a2595db6e
SHA256: 5525b395f1fbf374d12bb2049051d5390e0b6fb4ec71cb76ea319fbafede9cbd
SHA512: a18c9557422080dd9e05fe2ff86e3070548495ca4cecfc88bf77a0b534650e7e
4233a29ac8271db0ebb191c43c9311d534e869cacc711d6cc518e06298d58c51
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x408200
timedatestamp.....: 0x47ec14d6 (Thu Mar 27 21:42:46 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x5000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x6000 0x2000 0x1c00 7.72 9a7c0330ddef28c50e4ffacfd1035d14
UPX2 0x8000 0x2000 0x10da 6.44 1aa4badbc4f2bbae4d2d5b5bc45eeabd

( 0 imports )

( 0 exports )
29.05.2008, 15:24
sergio342

Файл SuperMenuHook.dll получен 2008.05.29 13:20:26 (CET)
Он же baksm.dll, baksm.dat.

Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.29.0 2008.05.29 -
AntiVir 7.8.0.19 2008.05.29 -
Authentium 5.1.0.4 2008.05.28 -
Avast 4.8.1195.0 2008.05.29 -
AVG 7.5.0.516 2008.05.29 -
BitDefender 7.2 2008.05.29 -
CAT-QuickHeal 9.50 2008.05.28 -
ClamAV 0.92.1 2008.05.29 -
DrWeb 4.44.0.09170 2008.05.29 -
eSafe 7.0.15.0 2008.05.28 -
eTrust-Vet 31.4.5832 2008.05.29 -
Ewido 4.0 2008.05.29 -
F-Prot 4.4.4.56 2008.05.28 -
[B]F-Secure 6.70.13260.0 2008.05.29 Trojan.Win32.Delf.ceh [/B]
Fortinet 3.14.0.0 2008.05.29 -
[B]GData 2.0.7306.1023 2008.05.29 Trojan.Win32.Delf.ceh
Ikarus T3.1.1.26.0 2008.05.29 Trojan.Delf.ceh
Kaspersky 7.0.0.125 2008.05.29 Trojan.Win32.Delf.ceh [/B]
McAfee 5305 2008.05.28 -
Microsoft 1.3520 2008.05.29 -
NOD32v2 3143 2008.05.29 -
Norman 5.80.02 2008.05.28 -
Panda 9.0.0.4 2008.05.28 -
Prevx1 V2 2008.05.29 -
Rising 20.46.32.00 2008.05.29 -
[B]Sophos 4.29.0 2008.05.29 Mal/Generic-A [/B]
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.29 -
TheHacker 6.2.92.322 2008.05.28 -
[B]VBA32 3.12.6.6 2008.05.29 Trojan.Win32.Delf.ceh [/B]
VirusBuster 4.3.26:9 2008.05.28 -
[B]Webwasher-Gateway 6.6.2 2008.05.29 Win32.Malware.gen!84 (suspicious) [/B]
Дополнительная информация
File size: 269824 bytes
MD5...: 26a1592c74a90cfeadf3b00265b2e585
29.05.2008, 16:51
ISO

Файл delnew.exe получен 2008.05.29 14:47:24 (CET)
Текущий статус: закончено
Результат: 12/32 (37.5%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.29.0 2008.05.29 -
[B]AntiVir 7.8.0.19 2008.05.29 TR/Crypt.XPACK.Gen[/B]
Authentium 5.1.0.4 2008.05.28 -
[B]Avast 4.8.1195.0 2008.05.29 Win32:Rootkit-gen[/B]
AVG 7.5.0.516 2008.05.29 -
[B]BitDefender 7.2 2008.05.29 GenPack:Trojan.Downloader.VB.VPQ
CAT-QuickHeal 9.50 2008.05.28 (Suspicious) - DNAScan[/B]
ClamAV 0.92.1 2008.05.29 -
DrWeb 4.44.0.09170 2008.05.29 -
eSafe 7.0.15.0 2008.05.29 -
eTrust-Vet 31.4.5832 2008.05.29 -
Ewido 4.0 2008.05.29 -
[B]F-Prot 4.4.4.56 2008.05.28 W32/Heuristic-210!Eldorado[/B]
F-Secure 6.70.13260.0 2008.05.29 -
Fortinet 3.14.0.0 2008.05.29 -
[B]GData 2.0.7306.1023 2008.05.29 Win32:Rootkit-gen
Ikarus T3.1.1.26.0 2008.05.29 Generic.Trojan-Downloader.VB.VPQ[/B]
Kaspersky 7.0.0.125 2008.05.29 -
McAfee 5305 2008.05.28 -
Microsoft 1.3520 2008.05.29 -
NOD32v2 3143 2008.05.29 -
Norman 5.80.02 2008.05.28 -
[B]Panda 9.0.0.4 2008.05.28 Suspicious file
Prevx1 V2 2008.05.29 Malicious Software[/B]
Rising 20.46.32.00 2008.05.29 -
[B]Sophos 4.29.0 2008.05.29 Sus/UnkPacker[/B]
Sunbelt 3.0.1123.1 2008.05.17 -
[B]Symantec 10 2008.05.29 Trojan Horse[/B]
TheHacker 6.2.92.322 2008.05.28 -
VBA32 3.12.6.6 2008.05.29 -
VirusBuster 4.3.26:9 2008.05.28 -
[B]Webwasher-Gateway 6.6.2 2008.05.29 Trojan.Crypt.XPACK.Gen[/B]
Дополнительная информация
File size: 7680 bytes
MD5...: ef182fa62c132dc33461d598817bf7b2
SHA1..: 8bee727773f0c680665bd6ddd8ec0e76aa8d65b9
SHA256: 2f7b07da01ffb42f037014e127713e656ed28de6349945d8fb1d0c2104809ba7
SHA512: c00b6662ca7e7b5ce8d6c7bdc9a2df2f5bc5b37f46ff194f77d2980019959343
217b67f85006ec13081959157d05130b89beb1c88ea25f6a9b26d34f15c7e7ee
PEiD..: -
PEInfo: PE Structure information
29.05.2008, 18:07
rubin

[CODE]AhnLab-V3 2008.5.29.0 2008.05.29 -
[B]AntiVir 7.8.0.19 2008.05.29 Rkit/Agent.DU[/B]
Authentium 5.1.0.4 2008.05.28 -
Avast 4.8.1195.0 2008.05.29 -
[B]AVG 7.5.0.516 2008.05.29 Win32/Agent
BitDefender 7.2 2008.05.29 Trojan.Dropper.Cutwail.O[/B]
CAT-QuickHeal 9.50 2008.05.28 -
ClamAV 0.92.1 2008.05.29 -
[B]DrWeb 4.44.0.09170 2008.05.29 BackDoor.Bulknet.206[/B]
eSafe 7.0.15.0 2008.05.29 -
eTrust-Vet 31.4.5832 2008.05.29 -
Ewido 4.0 2008.05.29 -
F-Prot 4.4.4.56 2008.05.28 -
F-Secure 6.70.13260.0 2008.05.29 -
Fortinet 3.14.0.0 2008.05.29 -
GData 2.0.7306.1023 2008.05.29 -
Ikarus T3.1.1.26.0 2008.05.29 -
Kaspersky 7.0.0.125 2008.05.29 -
McAfee 5305 2008.05.28 -
[B]Microsoft 1.3520 2008.05.29 TrojanDownloader:Win32/Cutwail.S[/B]
NOD32v2 3144 2008.05.29 -
Norman 5.80.02 2008.05.28 -
Panda 9.0.0.4 2008.05.28 -
[B]Prevx1 V2 2008.05.29 Malicious Software
Rising 20.46.32.00 2008.05.29 Trojan.Win32.Undef.gzl
Sophos 4.29.0 2008.05.29 Troj/Pushdo-Gen[/B]
Sunbelt 3.0.1123.1 2008.05.17 -
[B]Symantec 10 2008.05.29 Trojan.Pandex[/B]
TheHacker 6.2.92.322 2008.05.28 -
VBA32 3.12.6.6 2008.05.29 -
[B]VirusBuster 4.3.26:9 2008.05.28 Trojan.DR.Pandex.Gen.4
Webwasher-Gateway 6.6.2 2008.05.29 Rootkit.Agent.DU[/B][/CODE]

File size: 12800 bytes
MD5...: dd98e05c96d05463317e6d1683f987b5
SHA1..: af8164fea8d6c33e73834380578859260c515d3c
SHA256: c9bb0fd804756a26da196c6067ceee1ec041a1cb75aa9a253a1487345121020c
SHA512: b4496dc9db7e475b33f29656fff9fcd7830215fee2468d3306e6d6d2c5c008f3
6b44ebd03a2a681734a245e802f96c96f8d0d3039ff2e4fd127bfc67e234ef2f
29.05.2008, 22:45
Numb

Карантин из темы [url]http://virusinfo.info/showthread.php?t=23675[/url] (файл C:\WINDOWS\ikdogy.dll)
[code]Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.29.0 2008.05.29 -
[b]AntiVir 7.8.0.24 2008.05.29 TR/Drop.BHO.AS[/b]
Authentium 5.1.0.4 2008.05.28 -
Avast 4.8.1195.0 2008.05.29 -
AVG 7.5.0.516 2008.05.29 -
[b]BitDefender 7.2 2008.05.29 Trojan.Delf.PFP[/b]
CAT-QuickHeal 9.50 2008.05.29 -
ClamAV 0.92.1 2008.05.29 -
DrWeb 4.44.0.09170 2008.05.29 -
[b]eSafe 7.0.15.0 2008.05.29 suspicious Trojan/Worm[/b]
[b]eTrust-Vet 31.4.5832 2008.05.29 Win32/Burgspill!generic[/b]
Ewido 4.0 2008.05.29 -
F-Prot 4.4.4.56 2008.05.29 -
F-Secure 6.70.13260.0 2008.05.29 -
Fortinet 3.14.0.0 2008.05.29 -
GData 2.0.7306.1023 2008.05.29 -
[b]Ikarus T3.1.1.26.0 2008.05.29 Trojan.Win32.Delflob.I[/b]
Kaspersky 7.0.0.125 2008.05.29 -
McAfee 5306 2008.05.29 -
Microsoft None 2008.05.29 -
NOD32v2 3145 2008.05.29 -
Norman 5.80.02 2008.05.29 -
Panda 9.0.0.4 2008.05.29 -
Prevx1 V2 2008.05.29 -
Rising 20.46.32.00 2008.05.29 -
Sophos 4.29.0 2008.05.29 -
Sunbelt 3.0.1139.1 2008.05.29 -
[b]Symantec 10 2008.05.29 Downloader.MisleadApp[/b]
TheHacker 6.2.92.322 2008.05.28 -
VBA32 3.12.6.6 2008.05.29 -
VirusBuster 4.3.26:9 2008.05.29 -
[b]Webwasher-Gateway 6.6.2 2008.05.29 Trojan.Drop.BHO.AS[/b][/code]
Дополнительная информация
File size: 252928 bytes
MD5...: 12d0f31177368f44abe6498b8d7bb1ce
SHA1..: fe641ca796277a11495d8640f553da052d42fb40
SHA256: d290ba1bc712e347a7cfd438918e339d0c88446cc2377b8e7ecf2a7b750c5f54
SHA512: 067f8aab1d66a5c8cd5dd7faca0d821286a612a0dcac102f1b02345f0ded8be8
92f2b99cf10d0bece1887a869ece8588a80bdbbe91bad7be964439866233fd16
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4b0f00
timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
code 0x1000 0x75000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
text 0x76000 0x3c000 0x3b200 7.92 33a1131e4fc7cf09236f18884a09d4a5
.rsrc 0xb2000 0x3000 0x2600 3.89 cba5ec134b328951831923c4e7020692

( 9 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree
> advapi32.dll: RegCloseKey
> comctl32.dll: ImageList_Add
> gdi32.dll: SaveDC
> ole32.dll: OleDraw
> oleaut32.dll: VariantCopy
> shell32.dll: ShellExecuteA
> user32.dll: GetDC
> version.dll: VerQueryValueA

( 4 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer
packers (Kaspersky): PE_Patch.UPX, UPX
packers (F-Prot): UPX
31.05.2008, 17:18
Groft

[QUOTE]Файл bro.txt получен 2008.05.31 15:05:17 (CET)
Текущий статус: закончено
Результат: 11/31 (35.49%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.30.1 2008.05.30 -
[B]AntiVir 7.8.0.25 2008.05.30 PERL/Shellbot.BF[/B]
Authentium 5.1.0.4 2008.05.31 -
Avast 4.8.1195.0 2008.05.31 -
AVG 7.5.0.516 2008.05.30 -
[B]BitDefender 7.2 2008.05.31 Backdoor.Perl.Shellbot.B[/B]
CAT-QuickHeal 9.50 2008.05.31 -
[B]ClamAV 0.92.1 2008.05.31 Trojan.IRCBot-1142[/B]
DrWeb 4.44.0.09170 2008.05.31 -
eSafe 7.0.15.0 2008.05.29 -
eTrust-Vet 31.4.5837 2008.05.30 -
[B]Ewido 4.0 2008.05.31 Backdoor.Shellbot.j[/B]
F-Prot 4.4.4.56 2008.05.31 -
[B]F-Secure 6.70.13260.0 2008.05.31 Backdoor.PHP.IRCBot.d[/B]
Fortinet 3.14.0.0 2008.05.31 -
[B]GData 2.0.7306.1023 2008.05.31 Backdoor.PHP.IRCBot.d[/B]
Ikarus T3.1.1.26.0 2008.05.31 -
[B]Kaspersky 7.0.0.125 2008.05.31 Backdoor.PHP.IRCBot.d[/B]
[B]McAfee 5307 2008.05.30 Perl/Shellbot[/B]
Microsoft None 2008.05.31 -
[B]NOD32v2 3148 2008.05.30 Perl/Shellbot.B[/B]
Norman 5.80.02 2008.05.30 -
Panda 9.0.0.4 2008.05.31 -
Prevx1 V2 2008.05.31 -
Rising 20.46.52.00 2008.05.31 -
Sophos 4.29.0 2008.05.31 -
Sunbelt 3.0.1139.1 2008.05.29 -
Symantec 10 2008.05.31 -
VBA32 3.12.6.6 2008.05.31 -
[B]VirusBuster 4.3.26:9 2008.05.30 Perl.Shellbot.I[/B]
[B]Webwasher-Gateway 6.6.2 2008.05.30 Script.Shellbot.BF[/B][/QUOTE]
[url]http://www.virustotal.com/ru/analisis/b654e015607752e548b2c647b5ef2744[/url]
[QUOTE]Файл fuckkr.exe получен 2008.05.31 15:03:39 (CET)
Текущий статус: закончено
Результат: 13/31 (41.94%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.30.1 2008.05.30 -
[B]AntiVir 7.8.0.25 2008.05.30 HEUR/Malware[/B]
Authentium 5.1.0.4 2008.05.31 -
Avast 4.8.1195.0 2008.05.31 -
[B]AVG 7.5.0.516 2008.05.30 Downloader.Generic7.QBL[/B]
[B]BitDefender 7.2 2008.05.31 Generic.Malware.Bdld.9FFC2563[/B]
CAT-QuickHeal 9.50 2008.05.31 -
ClamAV 0.92.1 2008.05.31 -
DrWeb 4.44.0.09170 2008.05.31 -
[B]eSafe 7.0.15.0 2008.05.29 suspicious Trojan/Worm[/B]
eTrust-Vet 31.4.5837 2008.05.30 -
Ewido 4.0 2008.05.31 -
F-Prot 4.4.4.56 2008.05.31 -
[B]F-Secure 6.70.13260.0 2008.05.31 Suspicious:W32/Malware!Gemini[/B]
Fortinet 3.14.0.0 2008.05.31 -
[B]GData 2.0.7306.1023 2008.05.31 Trojan-Downloader.Win32.VB.etb[/B]
Ikarus T3.1.1.26.0 2008.05.31 -
[B]Kaspersky 7.0.0.125 2008.05.31 Trojan-Downloader.Win32.VB.etb[/B]
McAfee 5307 2008.05.30 -
Microsoft None 2008.05.31 -
[B]NOD32v2 3148 2008.05.30 a variant of Win32/TrojanDownloader.VB.NOY[/B]
Norman 5.80.02 2008.05.30 -
[B]Panda 9.0.0.4 2008.05.31 Suspicious file[/B]
Prevx1 V2 2008.05.31 -
Rising 20.46.52.00 2008.05.31 -
[B]Sophos 4.29.0 2008.05.31 Mal/Behav-210[/B]
Sunbelt 3.0.1139.1 2008.05.29 -
[B]Symantec 10 2008.05.31 Trojan Horse[/B]
[B]VBA32 3.12.6.6 2008.05.31 suspected of Trojan.LowZones.12 (paranoid heuristics)[/B]
VirusBuster 4.3.26:9 2008.05.30 -
[B]Webwasher-Gateway 6.6.2 2008.05.30 Heuristic.Malware[/B][/QUOTE]
[url]http://www.virustotal.com/ru/analisis/e5716137c374bf520a264cabb624dd92[/url]
[QUOTE]Файл 2.doc получен 2008.05.31 15:06:32 (CET)
Текущий статус: закончено
Результат: 3/31 (9.68%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.30.1 2008.05.30 -
AntiVir 7.8.0.25 2008.05.30 -
Authentium 5.1.0.4 2008.05.31 -
[B]Avast 4.8.1195.0 2008.05.31 HTML:Iframe-gen[/B]
AVG 7.5.0.516 2008.05.30 -
[B]BitDefender 7.2 2008.05.31 Trojan.IFrame.AM[/B]
CAT-QuickHeal 9.50 2008.05.31 -
ClamAV 0.92.1 2008.05.31 -
DrWeb 4.44.0.09170 2008.05.31 -
eSafe 7.0.15.0 2008.05.29 -
eTrust-Vet 31.4.5837 2008.05.30 -
Ewido 4.0 2008.05.31 -
F-Prot 4.4.4.56 2008.05.31 -
F-Secure 6.70.13260.0 2008.05.31 -
Fortinet 3.14.0.0 2008.05.31 -
[B]GData 2.0.7306.1023 2008.05.31 HTML:Iframe-gen[/B]
Ikarus T3.1.1.26.0 2008.05.31 -
Kaspersky 7.0.0.125 2008.05.31 -
McAfee 5307 2008.05.30 -
Microsoft None 2008.05.31 -
NOD32v2 3148 2008.05.30 -
Norman 5.80.02 2008.05.30 -
Panda 9.0.0.4 2008.05.31 -
Prevx1 V2 2008.05.31 -
Rising 20.46.52.00 2008.05.31 -
Sophos 4.29.0 2008.05.31 -
Sunbelt 3.0.1139.1 2008.05.29 -
Symantec 10 2008.05.31 -
VBA32 3.12.6.6 2008.05.31 -
VirusBuster 4.3.26:9 2008.05.30 -
Webwasher-Gateway 6.6.2 2008.05.30 -[/QUOTE]
[url]http://www.virustotal.com/ru/analisis/77070912ada7c89f42906ec4053ea2ee[/url]
01.06.2008, 12:35
Groft

Типо кодек :)
[QUOTE]Файл MediaTubeCodec_ver1.1316.0.exe получен 2008.06.01 10:32:26 (CET)
Текущий статус: закончено
Результат: 7/31 (22.59%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.30.1 2008.05.30 -
AntiVir 7.8.0.26 2008.06.01 -
Authentium 5.1.0.4 2008.06.01 -
Avast 4.8.1195.0 2008.05.31 -
AVG 7.5.0.516 2008.05.31 -
BitDefender 7.2 2008.06.01 -
[B]CAT-QuickHeal 9.50 2008.05.31 (Suspicious) - DNAScan[/B]
ClamAV 0.92.1 2008.06.01 -
DrWeb 4.44.0.09170 2008.05.31 -
[B]eSafe 7.0.15.0 2008.05.29 Suspicious File[/B]
eTrust-Vet 31.4.5837 2008.05.30 -
Ewido 4.0 2008.05.31 -
F-Prot 4.4.4.56 2008.05.31 -
F-Secure 6.70.13260.0 2008.06.01 -
Fortinet 3.14.0.0 2008.06.01 -
GData 2.0.7306.1023 2008.06.01 -
Ikarus T3.1.1.26.0 2008.06.01 -
[B]Kaspersky 7.0.0.125 2008.06.01 Trojan-Downloader.Win32.Zlob.oeg[/B]
McAfee 5307 2008.05.30 -
[B]Microsoft 1.3520 2008.06.01 Trojan:Win32/Tibs.gen!G[/B]
NOD32v2 3149 2008.05.31 -
Norman 5.80.02 2008.05.30 -
Panda 9.0.0.4 2008.05.31 -
[B]Prevx1 V2 2008.06.01 Malware Dropper[/B]
Rising 20.46.61.00 2008.06.01 -
[B]Sophos 4.29.0 2008.06.01 Mal/EncPk-DA[/B]
Sunbelt 3.0.1139.1 2008.05.29 -
Symantec 10 2008.06.01 -
VBA32 3.12.6.6 2008.05.31 -
VirusBuster 4.3.26:9 2008.05.31 -
[B]Webwasher-Gateway 6.6.2 2008.06.01 Win32.Malware.gen (suspicious)[/B][/QUOTE]
[url]http://www.virustotal.com/ru/analisis/7ec3e0b406a9a1a10dca68e1648c4c45[/url]
[QUOTE]Файл opr00PLR.jpg получен 2008.06.01 14:28:11 (CET)
Текущий статус: закончено
Результат: 9/31 (29.04%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.30.1 2008.05.30 -
[B]AntiVir 7.8.0.26 2008.06.01 TR/Spy.Agent.96256[/B]
[B]Authentium 5.1.0.4 2008.06.01 W32/Trojan2.ASQE[/B]
Avast 4.8.1195.0 2008.05.31 -
[B]AVG 7.5.0.516 2008.05.31 Downloader.Agent.AHDA[/B]
BitDefender 7.2 2008.06.01 -
CAT-QuickHeal 9.50 2008.05.31 -
ClamAV 0.92.1 2008.06.01 -
DrWeb 4.44.0.09170 2008.06.01 -
[B]eSafe 7.0.15.0 2008.05.29 suspicious Trojan/Worm[/B]
eTrust-Vet 31.4.5837 2008.05.30 -
Ewido 4.0 2008.06.01 -
[B]F-Prot 4.4.4.56 2008.05.31 W32/Trojan2.ASQE[/B]
F-Secure 6.70.13260.0 2008.06.01 -
Fortinet 3.14.0.0 2008.06.01 -
GData 2.0.7306.1023 2008.06.01 -
[B]Ikarus T3.1.1.26.0 2008.06.01 Trojan-Spy.Agent.96256[/B]
Kaspersky 7.0.0.125 2008.06.01 -
McAfee 5307 2008.05.30 -
Microsoft 1.3520 2008.06.01 -
NOD32v2 3149 2008.05.31 -
Norman 5.80.02 2008.05.30 -
[B]Panda 9.0.0.4 2008.06.01 Suspicious file[/B]
[B]Prevx1 V2 2008.06.01 Malicious Software[/B]
Rising 20.46.62.00 2008.06.01 -
Sophos 4.29.0 2008.06.01 -
Sunbelt 3.0.1139.1 2008.05.29 -
Symantec 10 2008.06.01 -
VBA32 3.12.6.6 2008.06.01 -
VirusBuster 4.3.26:9 2008.05.31 -
[B]Webwasher-Gateway 6.6.2 2008.06.01 Trojan.Spy.Agent.96256[/B][/QUOTE]
[url]http://www.virustotal.com/ru/analisis/c297d9ee8581410c41cf84db1782817a[/url]
01.06.2008, 17:33
Surfer

AhnLab-V3 2008.5.30.1 2008.05.30 -
AntiVir 7.8.0.26 2008.06.01 -
Authentium 5.1.0.4 2008.06.01 -
Avast 4.8.1195.0 2008.05.31 -
AVG 7.5.0.516 2008.05.31 -
BitDefender 7.2 2008.06.01 -
[B]CAT-QuickHeal 9.50 2008.05.31 (Suspicious) - DNAScan[/B]
ClamAV 0.92.1 2008.06.01 -
DrWeb 4.44.0.09170 2008.06.01 -
[B]eSafe 7.0.15.0 2008.05.29 Suspicious File[/B]
eTrust-Vet 31.4.5837 2008.05.30 -
Ewido 4.0 2008.06.01 -
F-Prot 4.4.4.56 2008.05.31 -
[B]F-Secure 6.70.13260.0 2008.06.01 Trojan-Downloader.Win32.QQHelper.bjx[/B]
Fortinet 3.14.0.0 2008.06.01 -
[B]GData 2.0.7306.1023 2008.06.01 Trojan-Downloader.Win32.QQHelper.bjx[/B]
Ikarus T3.1.1.26.0 2008.06.01 -
[B]Kaspersky 7.0.0.125 2008.06.01 Trojan-Downloader.Win32.QQHelper.bjx[/B]
McAfee 5307 2008.05.30 -
[B]Microsoft 1.3520 2008.06.01 Trojan:Win32/Tibs.gen!lds[/B]
NOD32v2 3149 2008.05.31 -
Norman 5.80.02 2008.05.30 -
Panda 9.0.0.4 2008.06.01 -
[B]Prevx1 V2 2008.06.01 Malicious Software[/B]
Rising 20.46.62.00 2008.06.01 -
[B]Sophos 4.29.0 2008.06.01 Mal/EncPk-DA[/B]
Sunbelt 3.0.1139.1 2008.05.29 -
Symantec 10 2008.06.01 -
[B]VBA32 3.12.6.6 2008.06.01 MalwareScope.Worm.Nuwar-Glowa.1[/B]
VirusBuster 4.3.26:9 2008.05.31 -
[B]Webwasher-Gateway 6.6.2 2008.06.01 Worm.Win32.Malware.gen (suspicious)[/B]

[url]http://www.virustotal.com/analisis/e95096ef8c97245dd2387c048018494b[/url]
02.06.2008, 11:07
Shu_b

Вложений: 2

итоги мая:
02.06.2008, 18:55
ISO

Ещё один видеокодек
File space-codec5025.exe received on 06.02.2008 16:44:46 (CET)
Current status: finished
Result: 14/32 (43.75%)
Compact
Print results [CODE]Antivirus Version Last Update Result
AhnLab-V3 2008.5.30.1 2008.06.02 -
[B]AntiVir 7.8.0.26 2008.06.02 DR/Dldr.DNSChanger.Gen[/B]
Authentium 5.1.0.4 2008.06.01 -
Avast 4.8.1195.0 2008.06.02 -
[B]AVG 7.5.0.516 2008.06.02 DNSChanger.AA
BitDefender 7.2 2008.06.02 Dropped:Trojan.DNSChanger.SL
CAT-QuickHeal 9.50 2008.06.02 Win32.Trojan.DNSChanger.arn.5
ClamAV 0.92.1 2008.06.02 Trojan.Dropper-7527
DrWeb 4.44.0.09170 2008.06.02 Trojan.Starter.509[/B]
eSafe 7.0.15.0 2008.06.02 -
eTrust-Vet 31.4.5842 2008.06.02 -
Ewido 4.0 2008.06.02 -
F-Prot 4.4.4.56 2008.06.01 -
[B]F-Secure 6.70.13260.0 2008.06.02 W32/Malware[/B]
Fortinet 3.14.0.0 2008.06.02 -
GData 2.0.7306.1023 2008.06.02 -
Ikarus T3.1.1.26.0 2008.06.02 -
[B]Kaspersky 7.0.0.125 2008.06.02 Trojan.Win32.DNSChanger.bov[/B]
McAfee 5307 2008.05.30 -
[B]Microsoft 1.3520 2008.06.02 TrojanDropper:Win32/Alureon.D[/B]
NOD32v2 3152 2008.06.02 -
[B]Norman 5.80.02 2008.05.30 W32/Malware[/B]
Panda 9.0.0.4 2008.06.02 -
[B]Prevx1 V2 2008.06.02 Malware Dropper[/B]
Rising 20.47.02.00 2008.06.02 -
Sophos 4.29.0 2008.06.02 -
Sunbelt 3.0.1139.1 2008.05.29 -
[B]Symantec 10 2008.06.02 Trojan.Zlob[/B]
TheHacker 6.2.92.331 2008.06.02 -
[B]VBA32 3.12.6.6 2008.06.01 Trojan.Win32.DNSChanger[/B]
VirusBuster 4.3.26:9 2008.06.02 -
[B]Webwasher-Gateway 6.6.2 2008.06.02 Trojan.Dropper.Dldr.DNSChanger.Gen[/B]
Additional information
File size: 237758 bytes
MD5...: 870f7380b0582945a5980ee7fb2dfb0a[/CODE]
SHA1..: a5040b41dbfdbb2d7b019fac783d0fdc74557784
SHA256: 898e41f72ec4dbf8e6b4806f689570968af0f338b49f4dc82f41e145992cc727
SHA512: eb19aa22be67d940bf0c1a7f4453d04d4fc74e3d5141e2ee9952dacf6556a414
8c221d28c89105b1c65348f31ada20add3a4c74e59671580af2b84345644dd96
03.06.2008, 02:26
Groft

[QUOTE]Файл sfc_oe.dll получен 2008.06.03 00:21:57 (CET)
Текущий статус: закончено
Результат: 12/32 (37.5%)
Форматированные
Печать результатов Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.30.1 2008.06.02 -
AntiVir 7.8.0.26 2008.06.02 -
Authentium 5.1.0.4 2008.06.02 -
[B]Avast 4.8.1195.0 2008.06.02 Win32:AutoRun-SD[/B]
AVG 7.5.0.516 2008.06.02 -
BitDefender 7.2 2008.06.02 -
[B]CAT-QuickHeal 9.50 2008.06.02 Worm.AutoRun.byt[/B]
ClamAV 0.92.1 2008.06.02 -
[B]DrWeb 4.44.0.09170 2008.06.02 Win32.HLLW.Autoruner.1219[/B]
eSafe 7.0.15.0 2008.06.02 -
[B]eTrust-Vet 31.4.5842 2008.06.02 Win32/Milsni!generic[/B]
[B]Ewido 4.0 2008.06.02 Worm.AutoRun.byt[/B]
F-Prot 4.4.4.56 2008.06.02 -
[B]F-Secure 6.70.13260.0 2008.06.02 Worm.Win32.AutoRun.byt[/B]
Fortinet 3.14.0.0 2008.06.02 -
[B]GData 2.0.7306.1023 2008.06.02 Worm.Win32.AutoRun.byt[/B]
Ikarus T3.1.1.26.0 2008.06.02 -
[B]Kaspersky 7.0.0.125 2008.06.03 Worm.Win32.AutoRun.byt[/B]
[B]McAfee 5308 2008.06.02 Downloader-BIP[/B]
Microsoft 1.3520 2008.06.02 -
NOD32v2 3152 2008.06.02 -
Norman 5.80.02 2008.06.02 -
Panda 9.0.0.4 2008.06.02 -
[B]Prevx1 V2 2008.06.03 Email Worm[/B]
Rising 20.47.02.00 2008.06.02 -
[B]Sophos 4.29.0 2008.06.02 W32/Autorun-AV[/B]
Sunbelt 3.0.1139.1 2008.05.29 -
[B]Symantec 10 2008.06.03 W32.SillyFDC[/B]
TheHacker 6.2.92.331 2008.06.02 -
VBA32 3.12.6.6 2008.06.01 -
VirusBuster 4.3.26:9 2008.06.02 -
Webwasher-Gateway 6.6.2 2008.06.03 -[/QUOTE]
[url]http://www.virustotal.com/ru/analisis/30976a5b92b0453ebf02394e33c06377[/url]

+ авторан к червю
[QUOTE]AhnLab-V3 2008.5.30.1 2008.06.02 -
AntiVir 7.8.0.26 2008.06.02 -
Authentium 5.1.0.4 2008.06.02 -
Avast 4.8.1195.0 2008.06.02 -
AVG 7.5.0.516 2008.06.02 -
[B]BitDefender 7.2 2008.06.02 Worm.AutoRun.VCS[/B]
CAT-QuickHeal 9.50 2008.06.02 -
ClamAV 0.92.1 2008.06.02 -
DrWeb 4.44.0.09170 2008.06.02 -
eSafe 7.0.15.0 2008.06.02 -
eTrust-Vet 31.4.5842 2008.06.02 -
Ewido 4.0 2008.06.02 -
F-Prot 4.4.4.56 2008.06.02 -
[B]F-Secure 6.70.13260.0 2008.06.02 BAT/AutoRun.AE[/B]
Fortinet 3.14.0.0 2008.06.02 -
GData 2.0.7306.1023 2008.06.02 -
Ikarus T3.1.1.26.0 2008.06.02 -
[B]Kaspersky 7.0.0.125 2008.06.03 Worm.Win32.AutoRun.dpz[/B]
McAfee 5308 2008.06.02 -
Microsoft 1.3520 2008.06.02 -
NOD32v2 3152 2008.06.02 -
[B]Norman 5.80.02 2008.06.02 BAT/AutoRun.AE[/B]
Panda 9.0.0.4 2008.06.02 -
Prevx1 V2 2008.06.03 -
Rising 20.47.02.00 2008.06.02 -
[B]Sophos 4.29.0 2008.06.02 Sus/AutoInf-A[/B]
Sunbelt 3.0.1139.1 2008.05.29 -
Symantec 10 2008.06.03 -
TheHacker 6.2.92.331 2008.06.02 -
VBA32 3.12.6.6 2008.06.01 -
VirusBuster 4.3.26:9 2008.06.02 -
Webwasher-Gateway 6.6.2 2008.06.03 -[/QUOTE]
[url]http://www.virustotal.com/ru/analisis/49e1ca8c5b4e0e990b4b4f18e882ae79[/url]
04.06.2008, 07:54
ZhIV

Два файла вирус вроде один результаты разные.

Файл svchosts.exe получен 2008.06.04 05:10:31 (CET)
Текущий статус: закончено
Результат: 17/32 (53.13%)
Форматированные
Печать результатов [CODE]Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.30.1 2008.06.03 -
[B]AntiVir 7.8.0.26 2008.06.03 TR/Crypt.XPACK.Gen[/B]
Authentium 5.1.0.4 2008.06.04 -
Avast 4.8.1195.0 2008.06.04 -
[B]AVG 7.5.0.516 2008.06.04 Pakes
BitDefender 7.2 2008.06.04 Trojan.Spy.Zeus.1.Gen
CAT-QuickHeal 9.50 2008.06.03 TrojanSpy.Zbot.ccg
ClamAV 0.92.1 2008.06.04 Trojan.Zbot-941
DrWeb 4.44.0.09170 2008.06.03 Trojan.Proxy.3215
eSafe 7.0.15.0 2008.06.03 Suspicious File
[/B]eTrust-Vet 31.4.5845 2008.06.03 -
Ewido 4.0 2008.06.03 -
[B]F-Prot 4.4.4.56 2008.06.04 W32/Zbot.G.gen!Eldorado
F-Secure 6.70.13260.0 2008.06.04 Trojan-Spy.Win32.Zbot.ccg
[/B]Fortinet 3.14.0.0 2008.06.04 -
[B]GData 2.0.7306.1023 2008.06.04 Trojan-Spy.Win32.Zbot.ccg
[/B]Ikarus T3.1.1.26.0 2008.06.04 -
[B]Kaspersky 7.0.0.125 2008.06.04 Trojan-Spy.Win32.Zbot.ccg
McAfee 5309 2008.06.03 Spy-Agent.bw.gen.e
[/B]Microsoft None 2008.06.04 -
NOD32v2 3156 2008.06.03 -
[B]Norman 5.80.02 2008.06.03 W32/Zbot.TT[/B]
Panda 9.0.0.4 2008.06.04 -
Prevx1 V2 2008.06.04 -
Rising 20.47.12.00 2008.06.03 -
[B]Sophos 4.29.0 2008.06.04 Mal/Generic-A
[/B]Sunbelt 3.0.1143.1 2008.06.03 -
Symantec 10 2008.06.04 -
[B]TheHacker 6.2.92.333 2008.06.03 Trojan/Spy.Zbot.ccg
VBA32 3.12.6.7 2008.06.03 Trojan-Spy.Win32.Zbot.ccg
[/B]VirusBuster 4.3.26:9 2008.06.03 -
[B]Webwasher-Gateway 6.6.2 2008.06.04 Trojan.Crypt.XPACK.Gen[/B]
Дополнительная информация
File size: 50688 bytes
MD5...: f4f387486cdbc09027f1bb05c3618b91[/CODE]

Еще один ntos

Файл ntos.exe получен 2008.06.04 05:30:56 (CET)
Текущий статус: закончено
Результат: 16/32 (50%)
Форматированные
Печать результатов [CODE]Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.30.1 2008.06.03 -
[B]AntiVir 7.8.0.26 2008.06.03 TR/Crypt.XPACK.Gen
[/B]Authentium 5.1.0.4 2008.06.04 -
[B]Avast 4.8.1195.0 2008.06.04 Win32:Zbot-gen
AVG 7.5.0.516 2008.06.04 Pakes
BitDefender 7.2 2008.06.04 Trojan.Spy.Zeus.1.Gen
CAT-QuickHeal 9.50 2008.06.03 TrojanSpy.Zbot.ccg
ClamAV 0.92.1 2008.06.04 Trojan.Zbot-941
DrWeb 4.44.0.09170 2008.06.03 Trojan.Proxy.3215
[/B]eSafe 7.0.15.0 2008.06.03 -
eTrust-Vet 31.4.5845 2008.06.03 -
Ewido 4.0 2008.06.03 -
[B]F-Prot 4.4.4.56 2008.06.04 W32/Zbot.G.gen!Eldorado
F-Secure 6.70.13260.0 2008.06.04 Trojan-Spy.Win32.Zbot.ccg
[/B]Fortinet 3.14.0.0 2008.06.04 -
[B]GData 2.0.7306.1023 2008.06.04 Trojan-Spy.Win32.Zbot.ccg[/B]
Ikarus T3.1.1.26.0 2008.06.04 -
[B]Kaspersky 7.0.0.125 2008.06.04 Trojan-Spy.Win32.Zbot.ccg
McAfee 5309 2008.06.03 Spy-Agent.bw.gen.e
[/B]Microsoft None 2008.06.04 -
NOD32v2 3156 2008.06.03 -
[B]Norman 5.80.02 2008.06.03 W32/Zbot.TT
[/B]Panda 9.0.0.4 2008.06.04 -
Prevx1 V2 2008.06.04 -
Rising 20.47.12.00 2008.06.03 -
Sophos 4.29.0 2008.06.04 -
Sunbelt 3.0.1143.1 2008.06.03 -
Symantec 10 2008.06.04 -
[B]TheHacker 6.2.92.333 2008.06.03 Trojan/Spy.Zbot.ccg
VBA32 3.12.6.7 2008.06.03 Trojan-Spy.Win32.Zbot.ccg
[/B]VirusBuster 4.3.26:9 2008.06.03 -
[B]Webwasher-Gateway 6.6.2 2008.06.04 Trojan.Crypt.XPACK.Gen
[/B]Дополнительная информация
File size: 504320 bytes
MD5...: 9c87b6cd29418c82404ad5b4f81837a0[/CODE]
04.06.2008, 17:38
rubin

spools.exe

[CODE]AhnLab-V3 2008.5.30.1 2008.06.04 -
AntiVir 7.8.0.26 2008.06.04 -
Authentium 5.1.0.4 2008.06.04 -
Avast 4.8.1195.0 2008.06.04 -
[B]AVG 7.5.0.516 2008.06.04 SHeur.BMMO[/B]
BitDefender 7.2 2008.06.04 -
[B]CAT-QuickHeal 9.50 2008.06.03 TrojanDownloader.Small.wiw[/B]
ClamAV 0.92.1 2008.06.04 -
[B]DrWeb 4.44.0.09170 2008.06.04 Trojan.PWS.Pace.16[/B]
[B]eSafe 7.0.15.0 2008.06.03 Suspicious File[/B]
eTrust-Vet 31.6.5847 2008.06.04 -
Ewido 4.0 2008.06.04 -
F-Prot 4.4.4.56 2008.06.04 -
F-Secure 6.70.13260.0 2008.06.04 -
Fortinet 3.14.0.0 2008.06.04 -
GData 2.0.7306.1023 2008.06.04 -
Ikarus T3.1.1.26.0 2008.06.04 -
Kaspersky 7.0.0.125 2008.06.04 -
McAfee 5309 2008.06.03 -
Microsoft 1.3604 2008.06.04 -
NOD32v2 3157 2008.06.04 -
Norman 5.80.02 2008.06.03 -
Panda 9.0.0.4 2008.06.04 -
Prevx1 V2 2008.06.04 -
Rising 20.47.22.00 2008.06.04 -
Sophos 4.30.0 2008.06.04 -
Sunbelt 3.0.1144.1 2008.06.04 -
Symantec 10 2008.06.04 -
TheHacker 6.2.92.333 2008.06.03 -
[B]VBA32 3.12.6.7 2008.06.03 Trojan-Downloader.Win32.Small.wiw[/B]
VirusBuster 4.3.26:9 2008.06.03 -
[B]Webwasher-Gateway 6.6.2 2008.06.04 Win32.Malware.dam (suspicious)[/B][/CODE]

File size: 35224 bytes
MD5...: b16e8c3cedb07b6c71497a1b9c71c792
SHA1..: 03086e3564d89c706c3c9300e5b9a8214c9e3ee0
SHA256: faa6e82c5faffa097ddbbb936661985939adb506c868fce3095a0791c38e21cb
SHA512: 064558c5a09ec62d2e39c53d162f5424d16c81f73e38b24d594ed40fdddaa58f
c409c2686e935724ecc201c6458ca1082fac2b50efb82567d94b656aa95218b8

[size="1"][color="#666686"][B][I]Добавлено через 59 минут[/I][/B][/color][/size]

Файл xdhdg.dll_ получен 2008.06.04 14:21:13 (CET)

[CODE]AhnLab-V3 2008.5.30.1 2008.06.04 -
[B]AntiVir 7.8.0.26 2008.06.04 TR/Agent.7680
Authentium 5.1.0.4 2008.06.04 W32/Heuristic-KPP!Eldorado
Avast 4.8.1195.0 2008.06.04 Win32:OnLineGames-DJV
AVG 7.5.0.516 2008.06.04 PSW.OnlineGames.ARUJ
BitDefender 7.2 2008.06.04 Trojan.PWS.OnlineGames.YYB[/B]
CAT-QuickHeal 9.50 2008.06.03 -
ClamAV 0.92.1 2008.06.04 -
[B]DrWeb 4.44.0.09170 2008.06.04 Trojan.PWS.Wsgame.origin[/B]
eSafe 7.0.15.0 2008.06.03 -
[B]eTrust-Vet 31.6.5847 2008.06.04 Win32/KBHooker.B[/B]
Ewido 4.0 2008.06.04 -
[B]F-Prot 4.4.4.56 2008.06.04 W32/Heuristic-KPP!Eldorado
F-Secure 6.70.13260.0 2008.06.04 -
Fortinet 3.14.0.0 2008.06.04 W32/OnLineGames.NBK!tr.pws
GData 2.0.7306.1023 2008.06.04 Win32:OnLineGames-DJV
Ikarus T3.1.1.26.0 2008.06.04 Virus.Win32.Onlinegames.BBH[/B]
Kaspersky 7.0.0.125 2008.06.04 -
McAfee 5309 2008.06.03 -
[B]Microsoft 1.3604 2008.06.04 Trojan:Win32/Hookja.A
NOD32v2 3157 2008.06.04 a variant of Win32/PSW.OnLineGames.NNV[/B]
[B]Norman 5.80.02 2008.06.03 W32/Smalltroj.ESKT
Panda 9.0.0.4 2008.06.04 Suspicious file[/B]
Prevx1 V2 2008.06.04 -
[B]Rising 20.47.22.00 2008.06.04 Trojan.PSW.Win32.ZhuXian.ht
Sophos 4.30.0 2008.06.04 Mal/Generic-A[/B]
Sunbelt 3.0.1144.1 2008.06.04 -
Symantec 10 2008.06.04 -
TheHacker 6.2.92.333 2008.06.03 -
[B]VBA32 3.12.6.7 2008.06.03 suspected of Embedded.Trojan-PSW.Win32.OnLineGames.akvc[/B]
VirusBuster 4.3.26:9 2008.06.03 -
[B]Webwasher-Gateway 6.6.2 2008.06.04 Trojan.Agent.7680[/B][/CODE]

File size: 28304 bytes
MD5...: be7a62b5fe0d516de077385f3663da74
SHA1..: b31a4401b1d80bd4eee71ff27b35060875c18050
SHA256: 676a517348d7cb22329f80c555ccf178432bea5ec44a1e302a40a1261e0e82bd
SHA512: b19ed3e11dc50eaed71b272f088538fc700795e90c32707b7a1c3ebf0f4e654e
e6fb69a3a1adead6b338872b5c1926648c100b437237c5a2662f27a45c497d99

Файл avz00010.dta получен 2008.06.04 14:19:18 (CET)

[CODE]AhnLab-V3 2008.5.30.1 2008.06.04 -
AntiVir 7.8.0.26 2008.06.04 -
Authentium 5.1.0.4 2008.06.04 -
Avast 4.8.1195.0 2008.06.04 -
AVG 7.5.0.516 2008.06.04 -
BitDefender 7.2 2008.06.04 -
CAT-QuickHeal 9.50 2008.06.03 -
[B]ClamAV 0.92.1 2008.06.04 Trojan.PWS.Wexd[/B]
DrWeb 4.44.0.09170 2008.06.04 -
eSafe 7.0.15.0 2008.06.03 -
eTrust-Vet 31.6.5847 2008.06.04 -
Ewido 4.0 2008.06.04 -
F-Prot 4.4.4.56 2008.06.04 -
F-Secure 6.70.13260.0 2008.06.04 -
Fortinet 3.14.0.0 2008.06.04 -
GData 2.0.7306.1023 2008.06.04 -
[B]Ikarus T3.1.1.26.0 2008.06.04 Trojan-Spy.Win32.Delf.FK[/B]
Kaspersky 7.0.0.125 2008.06.04 -
McAfee 5309 2008.06.03 -
Microsoft 1.3604 2008.06.04 -
NOD32v2 3157 2008.06.04 -
Norman 5.80.02 2008.06.03 -
[B]Panda 9.0.0.4 2008.06.04 Suspicious file[/B]
Prevx1 V2 2008.06.04 -
[B]Rising 20.47.22.00 2008.06.04 Trojan.Spy.PCAgent.35.dll[/B]
Sophos 4.30.0 2008.06.04 -
Sunbelt 3.0.1144.1 2008.06.04 -
Symantec 10 2008.06.04 -
TheHacker 6.2.92.333 2008.06.03 -
VBA32 3.12.6.7 2008.06.03 -
VirusBuster 4.3.26:9 2008.06.03 -
Webwasher-Gateway 6.6.2 2008.06.04 -[/CODE]

File size: 10240 bytes
MD5...: 05f1580bdd822c37edffd8655e582ba8
SHA1..: c8b8d34752600eaac5566e5dc68c3f21140bfdca
SHA256: b5b6051f2b5461ef329e5f2798417721b1a49d84f4e403277eafda7ecb9617bd
SHA512: 709a5a2256e73b0429d649723414b43bff13fbc48f4fa12225cdaa51851fc8ee
958db84aa8589bf7b6834c0c4b04ad39f29968e199ddb3590994a4df1cc64692

Файл ThunderAdvise.dll_ получен 2008.06.04 14:21:20 (CET)

[CODE][B]AntiVir 7.8.0.26 2008.06.04 ADSPY/Bho.daq[/B]
Authentium 5.1.0.4 2008.06.04 -
Avast 4.8.1195.0 2008.06.04 -
AVG 7.5.0.516 2008.06.04 -
BitDefender 7.2 2008.06.04 -
CAT-QuickHeal 9.50 2008.06.03 -
ClamAV 0.92.1 2008.06.04 -
[B]DrWeb 4.44.0.09170 2008.06.04 Adware.ThunderAdvise.1[/B]
eSafe 7.0.15.0 2008.06.03 -
eTrust-Vet 31.6.5847 2008.06.04 -
Ewido 4.0 2008.06.04 -
F-Prot 4.4.4.56 2008.06.04 -
F-Secure 6.70.13260.0 2008.06.04 -
Fortinet 3.14.0.0 2008.06.04 -
GData 2.0.7306.1023 2008.06.04 -
Ikarus T3.1.1.26.0 2008.06.04 -
Kaspersky 7.0.0.125 2008.06.04 -
McAfee 5309 2008.06.03 -
Microsoft 1.3604 2008.06.04 -
[B]NOD32v2 3157 2008.06.04 Win32/Agent.QNW[/B]
Norman 5.80.02 2008.06.03 -
Panda 9.0.0.4 2008.06.04 -
[B]Prevx1 V2 2008.06.04 Malicious Software[/B]
Rising 20.47.22.00 2008.06.04 -
Sophos 4.30.0 2008.06.04 -
Sunbelt 3.0.1144.1 2008.06.04 -
Symantec 10 2008.06.04 -
TheHacker 6.2.92.333 2008.06.03 -
VBA32 3.12.6.7 2008.06.03 -
VirusBuster 4.3.26:9 2008.06.03 -
[B]Webwasher-Gateway 6.6.2 2008.06.04 Ad-Spyware.Bho.daq[/B][/CODE]

File size: 45056 bytes
MD5...: cf84d56c3cb3e98e14e296c4c0774392
SHA1..: b298443fa23e32fcf34fa47ec2176abdca64e09f
SHA256: c823e5154b764fd02370d06a4a88538be1e00b419f0bf01eee50cbbf46fdda54
SHA512: d8836fe48911d2c3a1835d7bdd0af3f770ca7eeae8df66464a6b0926f36658e3
8c0c4de6c77efde6f2696895944f6445594f6eb9eb94b7b01d94cf53d9fcb064

Файл sthth.dll_ получен 2008.06.04 14:21:34 (CET)

[CODE]AhnLab-V3 2008.5.30.1 2008.06.04 -
[B]AntiVir 7.8.0.26 2008.06.04 TR/Agent.7680
Authentium 5.1.0.4 2008.06.04 W32/Heuristic-KPP!Eldorado
Avast 4.8.1195.0 2008.06.04 Win32:OnLineGames-DJV
AVG 7.5.0.516 2008.06.04 Generic10.AGAW
BitDefender 7.2 2008.06.04 Trojan.PWS.OnlineGames.YYD[/B]
CAT-QuickHeal 9.50 2008.06.03 -
ClamAV 0.92.1 2008.06.04 -
[B]DrWeb 4.44.0.09170 2008.06.04 Trojan.PWS.Wsgame.origin[/B]
eSafe 7.0.15.0 2008.06.03 -
eTrust-Vet 31.6.5847 2008.06.04 -
Ewido 4.0 2008.06.04 -
[B]F-Prot 4.4.4.56 2008.06.04 W32/Heuristic-KPP!Eldorado
F-Secure 6.70.13260.0 2008.06.04 -
Fortinet 3.14.0.0 2008.06.04 W32/OnLineGames.NBK!tr.pws
GData 2.0.7306.1023 2008.06.04 Win32:OnLineGames-DJV
Ikarus T3.1.1.26.0 2008.06.04 Virus.Win32.Onlinegames.BBH[/B]
Kaspersky 7.0.0.125 2008.06.04 -
McAfee 5309 2008.06.03 -
[B]Microsoft 1.3604 2008.06.04 Trojan:Win32/Hookja.A
NOD32v2 3157 2008.06.04 probably a variant of Win32/Genetik
Norman 5.80.02 2008.06.03 W32/Smalldrp.ZGE
Panda 9.0.0.4 2008.06.04 Generic Malware
Prevx1 V2 2008.06.04 Malicious Software
Rising 20.47.22.00 2008.06.04 Trojan.PSW.Win32.GameOL.ntt
Sophos 4.30.0 2008.06.04 Mal/Dloadr-E[/B]
Sunbelt 3.0.1144.1 2008.06.04 -
Symantec 10 2008.06.04 -
TheHacker 6.2.92.333 2008.06.03 -
[B]VBA32 3.12.6.7 2008.06.03 suspected of Embedded.Trojan-PSW.Win32.OnLineGames.akzq[/B]
VirusBuster 4.3.26:9 2008.06.03 -
[B]Webwasher-Gateway 6.6.2 2008.06.04 Trojan.Agent.7680[/B][/CODE]

File size: 32536 bytes
MD5...: b4fe1376c9cd6b798bffb3002b0a8f7a
SHA1..: 3470d082e729264421d93ae724123f6ae4354d28
SHA256: bbdb460d3bfcc3f371b908703b9195704121d47f886e66f8828518d76226b4df
SHA512: 1e2a0e645e596d06f5e3dd0b524f742c2a1b00ca41f81cd4cdf05b699304fa3a
9e19b4fedc0d3fa5f43995c61615eb6c8039caf7dfe8bb5081919115d9d25484

Файл jmkcgt.dll_ получен 2008.06.04 14:21:39 (CET)
[CODE]AhnLab-V3 2008.5.30.1 2008.06.04 -
[B]AntiVir 7.8.0.26 2008.06.04 HEUR/Malware[/B]
Authentium 5.1.0.4 2008.06.04 -
[B]Avast 4.8.1195.0 2008.06.04 Win32:OnLineGames-DJV
AVG 7.5.0.516 2008.06.04 PSW.OnlineGames.APFW
BitDefender 7.2 2008.06.04 Trojan.Loader.W[/B]
CAT-QuickHeal 9.50 2008.06.03 -
ClamAV 0.92.1 2008.06.04 -
[B]DrWeb 4.44.0.09170 2008.06.04 Trojan.PWS.Wsgame.5167[/B]
eSafe 7.0.15.0 2008.06.03 -
[B]eTrust-Vet 31.6.5847 2008.06.04 Win32/KBHooker.B[/B]
Ewido 4.0 2008.06.04 -
F-Prot 4.4.4.56 2008.06.04 -
F-Secure 6.70.13260.0 2008.06.04 -
Fortinet 3.14.0.0 2008.06.04 -
[B]GData 2.0.7306.1023 2008.06.04 Win32:OnLineGames-DJV
Ikarus T3.1.1.26.0 2008.06.04 Virus.Win32.OnLineGames.DJV
Kaspersky 7.0.0.125 2008.06.04 Trojan-PSW.Win32.OnLineGames.amms
McAfee 5309 2008.06.03 Generic PWS.y
Microsoft 1.3604 2008.06.04 PWS:Win32/OnLineGames.EO
NOD32v2 3157 2008.06.04 Win32/PSW.OnLineGames.NNV
Norman 5.80.02 2008.06.03 W32/Malware.CYHP[/B]
Panda 9.0.0.4 2008.06.04 -
[B]Prevx1 V2 2008.06.04 Malicious Software
Rising 20.47.22.00 2008.06.04 Trojan.PSW.Win32.GameOL.nkn[/B]
Sophos 4.30.0 2008.06.04 -
Sunbelt 3.0.1144.1 2008.06.04 -
Symantec 10 2008.06.04 -
TheHacker 6.2.92.333 2008.06.03 -
[B]VBA32 3.12.6.7 2008.06.03 Trojan.PWS.Wsgame.5167[/B]
VirusBuster 4.3.26:9 2008.06.03 -
[B]Webwasher-Gateway 6.6.2 2008.06.04 Heuristic.Malware[/B][/CODE]
File size: 7168 bytes
MD5...: 8d397035b053fe67520569c24b4aeb37
SHA1..: d57a68e51823f5e7f87ea01876cfed64e50b4225
SHA256: 89bacca4b22823cc2cee256860e4d434cb78c40dc83217290dc294d8d26bf8f9
SHA512: 527c39ea3e450c99762e6727b510832f047b4656cd40fded2b45012efc41c451
3e59ba168fc16219bc0a7e03ee7761dca00e3ca187dd61b1aca3d8a96623e483

[size="1"][color="#666686"][B][I]Добавлено через 1 час 5 минут[/I][/B][/color][/size]

Файл WinCtrl32.dll_ получен 2008.06.04 15:35:47 (CET)
[CODE]AhnLab-V3 2008.5.30.1 2008.06.04 -
[B]AntiVir 7.8.0.26 2008.06.04 TR/Crypt.XPACK.Gen[/B]
Authentium 5.1.0.4 2008.06.04 -
[B]Avast 4.8.1195.0 2008.06.04 Win32:Mutant-AL
AVG 7.5.0.516 2008.06.04 Win32/Agent
BitDefender 7.2 2008.06.04 Trojan.Dropper.Kobcka.C[/B]
CAT-QuickHeal 9.50 2008.06.03 -
ClamAV 0.92.1 2008.06.04 -
[B]DrWeb 4.44.0.09170 2008.06.04 BackDoor.Bulknet.208[/B]
eSafe 7.0.15.0 2008.06.03 -
eTrust-Vet 31.6.5847 2008.06.04 -
[B]Ewido 4.0 2008.06.04 Downloader.Mutant.ow
F-Prot 4.4.4.56 2008.06.02 W32/Downloader.Z1.gen!Eldorado[/B]
F-Secure 6.70.13260.0 2008.06.04 -
Fortinet 3.14.0.0 2008.06.04 -
[B]GData 2.0.7306.1023 2008.06.04 Win32:Mutant-AL
Ikarus T3.1.1.26.0 2008.06.04 Trojan-Dropper.Kobcka.C[/B]
Kaspersky 7.0.0.125 2008.06.04 -
McAfee 5309 2008.06.03 -
[B]Microsoft 1.3604 2008.06.04 TrojanDownloader:Win32/Cutwail.S[/B]
NOD32v2 3157 2008.06.04 -
Norman 5.80.02 2008.06.04 -
[B]Panda 9.0.0.4 2008.06.04 Trj/Agent.IWV
Prevx1 V2 2008.06.04 Malicious Software
Rising 20.47.22.00 2008.06.04 Trojan.Win32.Undef.hel
Sophos 4.30.0 2008.06.04 Troj/Dropr-M[/B]
Sunbelt 3.0.1144.1 2008.06.04 -
Symantec 10 2008.06.04 -
TheHacker 6.2.92.333 2008.06.03 -
VBA32 3.12.6.7 2008.06.03 -
[B]VirusBuster 4.3.26:9 2008.06.03 Trojan.DR.Pandex.Gen.4
Webwasher-Gateway 6.6.2 2008.06.04 Trojan.Crypt.XPACK.Gen[/B][/CODE]

File size: 14848 bytes
MD5...: e519c47fcd6e5d363ecb7d090cc1d501
SHA1..: 49ec52aeffda6216211f1d87bfd2fc0473fd0108
SHA256: a5448f32c473c07665f077227106a32cc0b037f93cae8d1c82b58223617c4acf
SHA512: afa4fc1d3a88f73713c3737b6bced98298d936f7757f1cc60904d3052b72b38d
82ffda458e4b27b2f90f0ccb5ce012552ee7a01470031255a289290169e708fc
05.06.2008, 18:53
Pili

Файл ps.exe получен 2008.06.05 16:50:14 (CET)
[CODE]Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.30.1 2008.06.05 -
[B]AntiVir 7.8.0.26 2008.06.05 W32/Sality
Authentium 5.1.0.4 2008.06.05 W32/Sality.AJ[/B]
Avast 4.8.1195.0 2008.06.05 -
AVG 7.5.0.516 2008.06.05 -
[B]BitDefender 7.2 2008.06.05 Win32.Sality.NX
CAT-QuickHeal 9.50 2008.06.05 W32.Sality.T[/B]
ClamAV 0.92.1 2008.06.05 -
[B]DrWeb 4.44.0.09170 2008.06.05 Win32.Sector.5[/B]
eSafe 7.0.15.0 2008.06.04 -
[B]eTrust-Vet 31.6.5850 2008.06.05 Win32/Sality.W[/B]
Ewido 4.0 2008.06.05 -
[B]F-Prot 4.4.4.56 2008.06.05 W32/Sality.AJ
F-Secure 6.70.13260.0 2008.06.05 W32/Sality.AA
Fortinet 3.14.0.0 2008.06.05 W32/Sality.Y
GData 2.0.7306.1023 2008.06.05 Virus.Win32.Sality.y[/B]
Ikarus T3.1.1.26.0 2008.06.05 -
[B]Kaspersky 7.0.0.125 2008.06.05 Virus.Win32.Sality.y
McAfee 5310 2008.06.04 W32/Sality.ae
Microsoft 1.3604 2008.06.05 Virus:Win32/Sality.AM
NOD32v2 3161 2008.06.05 Win32/Sality.NAO
Norman 5.80.02 2008.06.04 W32/Sality.AA
Panda 9.0.0.4 2008.06.05 W32/Sality.AE[/B]
Prevx1 V2 2008.06.05 -
[B]Rising 20.47.32.00 2008.06.05 Win32.KUKU.a
Sophos 4.30.0 2008.06.05 W32/Sality-AM[/B]
Sunbelt 3.0.1145.1 2008.06.05 -
[B]Symantec 10 2008.06.05 W32.Sality.AE[/B]
TheHacker 6.2.92.335 2008.06.05 -
[B]VBA32 3.12.6.7 2008.06.05 Virus.Win32.Sality.z
VirusBuster 4.3.26:9 2008.06.04 Win32.Sality.AL
Webwasher-Gateway 6.6.2 2008.06.05 Win32.Sality[/B][/CODE]

Дополнительная информация
File size: 263168 bytes
MD5...: 9e63eee8d0ce2d721d2bb8618fb530a0
SHA1..: aa52cfec1149b3c180ac98eac463b90a35f1a312
SHA256: ecd58f804b740b4695b2df07fdae9e6c043f46506145b70823a855c0a7ce71e0
SHA512: fd8f8d82797c6c2ce5d00e985943cc09370edefea4d80608e9527b967486f6df
db742e484dbbcfec7c4f5e2dacd8dba92225e6e9586e46071edd32dbff5d28de
06.06.2008, 14:23
maXmo

какой-то мощный руткит, в сейфмод не пущает, сопротивляется перезагрузкой.
[url]http://www.virustotal.com/analisis/ee4d338f9142fb3ded0020b5b8605a75[/url]
[CODE]AhnLab-V3 2008.5.30.1 2008.06.05 -
AntiVir 7.8.0.26 2008.06.06 -
Authentium 5.1.0.4 2008.06.06 -
Avast 4.8.1195.0 2008.06.06 Win32:Srizbi
AVG 7.5.0.516 2008.06.06 -
BitDefender 7.2 2008.06.06 -
CAT-QuickHeal 9.50 2008.06.05 -
ClamAV 0.92.1 2008.06.06 -
DrWeb 4.44.0.09170 2008.06.06 -
eSafe 7.0.15.0 2008.06.05 -
eTrust-Vet 31.6.5853 2008.06.06 -
Ewido 4.0 2008.06.05 -
F-Prot 4.4.4.56 2008.06.05 -
F-Secure 6.70.13260.0 2008.06.06 Srizbi.gen1
Fortinet 3.14.0.0 2008.06.06 -
GData 2.0.7306.1023 2008.06.06 Win32:Srizbi
Ikarus T3.1.1.26.0 2008.06.06 Rootkit.Win32.Agent.ea
Kaspersky 7.0.0.125 2008.06.06 -
McAfee 5311 2008.06.05 -
Microsoft 1.3604 2008.06.06 -
NOD32v2 3163 2008.06.06 -
Norman 5.80.02 2008.06.05 Srizbi.gen1
Panda 9.0.0.4 2008.06.05 -
Prevx1 V2 2008.06.06 -
Rising 20.47.40.00 2008.06.06 -
Sophos 4.30.0 2008.06.06 -
Sunbelt 3.0.1145.1 2008.06.05 -
Symantec 10 2008.06.06 -
TheHacker 6.2.92.337 2008.06.06 -
VBA32 3.12.6.7 2008.06.05 -
VirusBuster 4.3.26:9 2008.06.05 -
Webwasher-Gateway 6.6.2 2008.06.06 Win32.Malware.gen!80 (suspicious)[/CODE]

А не, вот исходный файл [url]http://www.virustotal.com/ru/analisis/c365d3e0c153927da58b37a1b511c6de[/url] (я дамп анализировал)
06.06.2008, 16:59
rubin

[CODE]AhnLab-V3 2008.5.30.1 2008.06.05 -
[B]AntiVir 7.8.0.26 2008.06.06 TR/Spy.ZBot.DQ[/B]
Authentium 5.1.0.4 2008.06.06 -
Avast 4.8.1195.0 2008.06.06 -
[B]AVG 7.5.0.516 2008.06.06 SHeur.BOPL
BitDefender 7.2 2008.06.06 Trojan.Spy.Zbot.DQ[/B]
CAT-QuickHeal 9.50 2008.06.05 -
ClamAV 0.92.1 2008.06.06 -
DrWeb 4.44.0.09170 2008.06.06 -
[B]eSafe 7.0.15.0 2008.06.05 suspicious Trojan/Worm[/B]
eTrust-Vet 31.6.5853 2008.06.06 -
Ewido 4.0 2008.06.06 -
F-Prot 4.4.4.56 2008.06.05 -
F-Secure 6.70.13260.0 2008.06.06 -
Fortinet 3.14.0.0 2008.06.06 -
GData 2.0.7306.1023 2008.06.06 -
[B]Ikarus T3.1.1.26.0 2008.06.06 Trojan-Spy.Zbot.DQ[/B]
Kaspersky 7.0.0.125 2008.06.06 -
McAfee 5311 2008.06.05 -
[B]Microsoft 1.3604 2008.06.06 Program:Win32/WinSpywareProtect[/B]
NOD32v2 3163 2008.06.06 -
Norman 5.80.02 2008.06.06 -
Panda 9.0.0.4 2008.06.05 -
[B]Prevx1 V2 2008.06.06 Malicious Software[/B]
Rising 20.47.40.00 2008.06.06 -
Sophos 4.30.0 2008.06.06 -
Sunbelt 3.0.1145.1 2008.06.05 -
Symantec 10 2008.06.06 -
TheHacker 6.2.92.337 2008.06.06 -
VBA32 3.12.6.7 2008.06.05 -
VirusBuster 4.3.26:9 2008.06.05 -
[B]Webwasher-Gateway 6.6.2 2008.06.06 Trojan.Spy.ZBot.DQ[/B][/CODE]
File size: 41984 bytes
MD5...: 09328b8de2095606a6c6217c80ea5a31
SHA1..: f6912d765c8cf41f2e075bb0f1e16b0332674fa2
SHA256: f468c13432cb1ef2ee9f21af02595097174ac027febde1f1580eb0f28475fed3
SHA512: 61f06479304040605a8048ea5e41fd85e14e1301d5bb44d3f9540051bea46ba8
785ab15aff123f46129f50f6634e94b4b6aa5bbd73fcd0e59df96976d21d8900

[size="1"][color="#666686"][B][I]Добавлено через 24 минуты[/I][/B][/color][/size]

Файл c-setup.exe получен 2008.06.06 14:51:18 (CET)

[CODE]AhnLab-V3 2008.5.30.1 2008.06.05 -
[B]AntiVir 7.8.0.26 2008.06.06 ADSPY/Agent.dgn[/B]
Authentium 5.1.0.4 2008.06.06 -
Avast 4.8.1195.0 2008.06.06 -
AVG 7.5.0.516 2008.06.06 -
BitDefender 7.2 2008.06.06 -
CAT-QuickHeal 9.50 2008.06.05 -
ClamAV 0.92.1 2008.06.06 -
[B]DrWeb 4.44.0.09170 2008.06.06 Trojan.MulDrop.16361
eSafe 7.0.15.0 2008.06.05 Suspicious File[/B]
eTrust-Vet 31.6.5853 2008.06.06 -
Ewido 4.0 2008.06.06 -
[B]F-Prot 4.4.4.56 2008.06.05 W32/Delf.C.gen!Eldorado
F-Secure 6.70.13260.0 2008.06.06 Suspicious:W32/Malware!Gemini
Fortinet 3.14.0.0 2008.06.06 W32/Fake.B!tr.dldr[/B]
GData 2.0.7306.1023 2008.06.06 -
[B]Ikarus T3.1.1.26.0 2008.06.06 Trojan-Downloader.Win32.Chengtot.A
Kaspersky 7.0.0.125 2008.06.06 not-a-virus:AdWare.Win32.Agent.dgn
McAfee 5311 2008.06.05 Generic Downloader.c[/B]
Microsoft 1.3604 2008.06.06 -
NOD32v2 3163 2008.06.06 -
[B]Norman 5.80.02 2008.06.06 W32/DLoader.HNHV
Panda 9.0.0.4 2008.06.05 Suspicious file
Prevx1 V2 2008.06.06 Malicious Software
Rising 20.47.40.00 2008.06.06 Dropper.Win32.DownLoader.c
Sophos 4.30.0 2008.06.06 Mal/Heuri-E[/B]
Sunbelt 3.0.1145.1 2008.06.05 -
Symantec 10 2008.06.06 -
TheHacker 6.2.92.337 2008.06.06 -
VBA32 3.12.6.7 2008.06.05 -
VirusBuster 4.3.26:9 2008.06.05 -
[B]Webwasher-Gateway 6.6.2 2008.06.06 Ad-Spyware.Agent.dgn[/B][/CODE]

File size: 86504 bytes
MD5...: d07ffc4e0032b76d0cde316a2dba5d79
SHA1..: 2e7e6791c4ba672417266083667615ceadb7d340
SHA256: db5fceceffa8290931461fee2ede382e297a32704614144aa16a9f4f4eb7cf77
SHA512: d58ad789a74b81ac95407550a292483f729f0323515148363aacafcc8443d245
722ca638f9f07a18924123d5f482b12f515203895d12acabf1995b88124767dc

[size="1"][color="#666686"][B][I]Добавлено через 4 минуты[/I][/B][/color][/size]

Файл setup_501_18_.exe получен 2008.06.06 14:57:53 (CET)
[CODE]AhnLab-V3 2008.5.30.1 2008.06.05 -
AntiVir 7.8.0.26 2008.06.06 -
Authentium 5.1.0.4 2008.06.06 -
Avast 4.8.1195.0 2008.06.06 -
[B]AVG 7.5.0.516 2008.06.06 SHeur.BOPI[/B]
BitDefender 7.2 2008.06.06 -
CAT-QuickHeal 9.50 2008.06.05 -
ClamAV 0.92.1 2008.06.06 -
DrWeb 4.44.0.09170 2008.06.06 -
[B]eSafe 7.0.15.0 2008.06.05 suspicious Trojan/Worm[/B]
eTrust-Vet 31.6.5853 2008.06.06 -
Ewido 4.0 2008.06.06 -
F-Prot 4.4.4.56 2008.06.05 -
F-Secure 6.70.13260.0 2008.06.06 -
Fortinet 3.14.0.0 2008.06.06 -
GData 2.0.7306.1023 2008.06.06 -
Ikarus T3.1.1.26.0 2008.06.06 -
Kaspersky 7.0.0.125 2008.06.06 -
McAfee 5311 2008.06.05 -
[B]Microsoft 1.3604 2008.06.06 Program:Win32/WinSpywareProtect[/B]
NOD32v2 3163 2008.06.06 -
Norman 5.80.02 2008.06.06 -
Panda 9.0.0.4 2008.06.05 -
Prevx1 V2 2008.06.06 -
Rising 20.47.40.00 2008.06.06 -
Sophos 4.30.0 2008.06.06 -
Sunbelt 3.0.1145.1 2008.06.05 -
Symantec 10 2008.06.06 -
TheHacker 6.2.92.337 2008.06.06 -
VBA32 3.12.6.7 2008.06.05 -
VirusBuster 4.3.26:9 2008.06.05 -
Webwasher-Gateway 6.6.2 2008.06.06 -[/CODE]

File size: 37376 bytes
MD5...: 60de3eb6167c822e646c5d140571522a
SHA1..: 29837278414d61ed729ef1a57e7fac385357d70f
SHA256: 499b063d41c9afc4f43716576be008760bc96c6ce468fee70c5d2dce5a161e58
SHA512: 76e673d9d5ed3ed4ed073ed72dc959e8225c4192aece8957c92bd4f2bf86dc25
3ac38fe6a82ae1d79e0671002c155bd84fcb36b89834424049c7e61f04c24f70
07.06.2008, 18:25
senyak

Файл explorer.exe получен 2008.06.07 16:14:45 (CET)
Текущий статус: закончено
Результат: 13/32 (40.62%)

[QUOTE]Антивирус Версия Обновление Результат
AhnLab-V3 2008.5.30.1 2008.06.05 -
[B]AntiVir 7.8.0.55 2008.06.06 TR/Hijack.Explor.4709[/B]
Authentium 5.1.0.4 2008.06.06 -
[B]Avast 4.8.1195.0 2008.06.07 Win32:Afgan
AVG 7.5.0.516 2008.06.07 Win32/Small.DO
BitDefender 7.2 2008.06.07 Trojan.Inject.HP[/B]
CAT-QuickHeal 9.50 2008.06.07 -
ClamAV 0.92.1 2008.06.07 -
[B]DrWeb 4.44.0.09170 2008.06.07 Win32.Kolumb.2[/B]
eSafe 7.0.15.0 2008.06.05 -
eTrust-Vet 31.6.5853 2008.06.06 -
Ewido 4.0 2008.06.07 -
F-Prot 4.4.4.56 2008.06.06 -
[B]F-Secure 6.70.13260.0 2008.06.07 Virus.Win32.Afgan.a[/B]
Fortinet 3.14.0.0 2008.06.07 W32/Afgen.A
[B]GData 2.0.7306.1023 2008.06.07 Virus.Win32.Afgan.a
Ikarus T3.1.1.26.0 2008.06.07 BehavesLike.Win32.ExplorerHijack
Kaspersky 7.0.0.125 2008.06.07 Virus.Win32.Afgan.a[/B]
McAfee 5312 2008.06.06 -
[B]Microsoft 1.3604 2008.06.07 Virus:Win32/Afgar.A
NOD32v2 3165 2008.06.06 Win32/Afgan.A[/B]
Norman 5.80.02 2008.06.06 -
Panda 9.0.0.4 2008.06.07 -
Prevx1 V2 2008.06.07 -
Rising 20.47.42.00 2008.06.06 -
Sophos 4.30.0 2008.06.07 -
Sunbelt 3.0.1145.1 2008.06.05 -
Symantec 10 2008.06.07 -
TheHacker 6.2.92.339 2008.06.07 -
VBA32 3.12.6.7 2008.06.06 -
VirusBuster 4.3.26:9 2008.06.06 -
[B]Webwasher-Gateway 6.6.2 2008.06.07 Trojan.Hijack.Explor.4709[/B][/QUOTE]

Дополнительная информация
File size: 1057792 bytes
MD5...: e3673f60debcfb61abc0c932a23d1bde
SHA1..: 3647b3dbb7e072be7d8373656608458ec9bc0823
SHA256: 35539f95ce6c0ab4433ef38114c6d7912e71f1e82ca579f9fdb6e0c0c40eecb6
SHA512: 25c267d23165179d1e3170f6ce11292d539a9021257c79ff84cf4711c0b38db8
a99f1fb444f2d41c3b01328b59e12060087cae937e49adaa43e2ed39f4fc94e6
PEiD..: -
PEInfo: PE Structure information
08.06.2008, 18:12
rubin

Файл avz00001.dta получен 2008.06.08 16:05:28 (CET)

[CODE]AhnLab-V3 2008.5.30.1 2008.06.05 -
AntiVir 7.8.0.55 2008.06.06 -
[B]Authentium 5.1.0.4 2008.06.08 W32/Threat-HLLSI-based!Maximus
Avast 4.8.1195.0 2008.06.08 Win32:Iespy-H
AVG 7.5.0.516 2008.06.07 PSW.Spy.D
BitDefender 7.2 2008.06.08 Trojan.Spy.IESpy.B[/B]
CAT-QuickHeal 9.50 2008.06.07 -
ClamAV None 2008.06.08 -
DrWeb 4.44.0.09170 2008.06.08 -
[B]eSafe 7.0.15.0 2008.06.05 suspicious Trojan/Worm
eTrust-Vet 31.6.5858 2008.06.08 Win32/Ramerl!generic[/B]
Ewido 4.0 2008.06.08 -
[B]F-Prot 4.4.4.56 2008.06.08 W32/Threat-HLLSI-based!Maximus
F-Secure 6.70.13260.0 2008.06.08 W32/Horst.gen33[/B]
Fortinet 3.14.0.0 2008.06.08 -
[B]GData 2.0.7306.1023 2008.06.08 Win32:Iespy-H
Ikarus T3.1.1.26.0 2008.06.08 Virus.Win32.Iespy.H[/B]
Kaspersky 7.0.0.125 2008.06.08 -
[B]McAfee 5312 2008.06.06 Downloader-ASL
Microsoft 1.3604 2008.06.08 TrojanSpy:Win32/Lespy.gen
NOD32v2 3165 2008.06.06 a variant of Win32/Spy.Iespy
Norman 5.80.02 2008.06.06 W32/Horst.gen33[/B]
Panda 9.0.0.4 2008.06.08 -
Prevx1 V2 2008.06.08 -
Rising 20.47.42.00 2008.06.06 -
Sophos 4.30.0 2008.06.08 -
Sunbelt 3.0.1145.1 2008.06.05 -
Symantec 10 2008.06.08 -
TheHacker 6.2.92.339 2008.06.07 -
VBA32 3.12.6.7 2008.06.08 -
[B]VirusBuster 4.3.26:9 2008.06.08 Trojan.IESPy.Gen[/B]
[B]Webwasher-Gateway 6.6.2 2008.06.08 Trojan.Downloader.Win32.Malware.gen (suspicious)[/B][/CODE]

File size: 7680 bytes
MD5...: 0fbb92da51641ccb2da2fb03ae02bbd8
SHA1..: 35353055d08c8614390647eb328d990f13daa6a9
SHA256: d0b1f67a15448e444d9db68d1e018b4218c42d28e6d79f8d63cef10f72970e5f
SHA512: 2e7fe650bb0fe5bcffa96857c642ede4aff009adadffa05c5718354e37d56c9e
23540f97b25679273cd4b79d655bb1292a0ef8f39e7752afbc555ac0253d4c64

Файл avz00002.dta получен 2008.06.08 16:05:48 (CET)
[CODE]AhnLab-V3 2008.5.30.1 2008.06.05 -
[B]AntiVir 7.8.0.55 2008.06.06 TR/Crypt.Morphine.Gen
Authentium 5.1.0.4 2008.06.08 W32/Heuristic-324!Eldorado
Avast 4.8.1195.0 2008.06.08 Win32:Daemonize-AI
AVG 7.5.0.516 2008.06.07 Packed.Morphine.C
BitDefender 7.2 2008.06.08 Packer.Morphine.B
CAT-QuickHeal 9.50 2008.06.07 Win32.Email-Worm.Bagle.pp02
ClamAV 0.92.1 2008.06.08 Trojan.Packed-86
DrWeb 4.44.0.09170 2008.06.08 BackDoor.Salidol
eSafe 7.0.15.0 2008.06.05 Suspicious File[/B]
eTrust-Vet 31.6.5858 2008.06.08 -
Ewido 4.0 2008.06.08 -
[B]F-Prot 4.4.4.56 2008.06.08 W32/Heuristic-324!Eldorado
F-Secure 6.70.13260.0 2008.06.08 W32/Malware
Fortinet 3.14.0.0 2008.06.08 W32/NewThreat!Morphine
GData 2.0.7306.1023 2008.06.08 Win32:Daemonize-AI[/B]
Ikarus T3.1.1.26.0 2008.06.08 -
Kaspersky 7.0.0.125 2008.06.08 -
[B]McAfee 5312 2008.06.06 New Malware.cn
Microsoft 1.3604 2008.06.08 VirTool:Win32/Obfuscator.E
NOD32v2 3165 2008.06.06 a variant of Win32/TrojanProxy.Daemonize
Norman 5.80.02 2008.06.06 W32/Malware
Panda 9.0.0.4 2008.06.08 Suspicious file[/B]
Prevx1 V2 2008.06.08 -
[B]Rising 20.47.42.00 2008.06.06 Packer.Win32.Morphine.a
Sophos 4.30.0 2008.06.08 Mal/TibsPak[/B]
Sunbelt 3.0.1145.1 2008.06.05 -
[B]Symantec 10 2008.06.08 Backdoor.Trojan[/B]
TheHacker 6.2.92.339 2008.06.07 -
[B]VBA32 3.12.6.7 2008.06.08 BackDoor.Salidol
VirusBuster 4.3.26:9 2008.06.08 Packed/Morphine.B
Webwasher-Gateway 6.6.2 2008.06.08 Trojan.Crypt.Morphine.Gen[/B][/CODE]

File size: 44032 bytes
MD5...: 35ae0eb3a1737239f58df9d75fd2d7e8
SHA1..: e09dcd2c3987a396de27d8636365434b81046d27
SHA256: 8ff80abe936515d071bc8b7cf763ba685923880338421c3c8e873d47cf8b1b3e
SHA512: 567ccf4b5d12ce5700614e3c12ba241c1788f35b2e3ddfc8e59f1333c1ef8a41
53f55be463e234de3de5f4f79ffef03cc7996b3b5346cda03cc484363714eca3

PS: А на второй файл восьмерка ругается :) на ВТ нет

Показывать 40 сообщений этой темы на одной странице