Исследование антивирусов 7

**zorro84** · 28.11.2008, 08:55

Файл ntos.exe получен 2008.11.26 06:16:33 (CET)
Текущий статус: закончено
Результат: 11/37 (29.73%)

Код:

Антивирус 	Версия 	Обновление 	Результат
AhnLab-V3 	2008.11.24.3 	2008.11.26 	-
AntiVir 	7.9.0.35 	2008.11.25 	DR/Delphi.Gen
Authentium 	5.1.0.4 	2008.11.25 	-
Avast 	4.8.1281.0 	2008.11.25 	Win32:Delf-LMN
AVG 	8.0.0.199 	2008.11.25 	Win32/Heur
BitDefender 	7.2 	2008.11.26 	Trojan.Dropper.LdPinch.AO
CAT-QuickHeal 	10.00 	2008.11.25 	-
ClamAV 	0.94.1 	2008.11.26 	-
DrWeb 	4.44.0.09170 	2008.11.26 	Trojan.PWS.Panda.17
eSafe 	7.0.17.0 	2008.11.25 	-
eTrust-Vet 	31.6.6228 	2008.11.26 	-
Ewido 	4.0 	2008.11.25 	-
F-Prot 	4.4.4.56 	2008.11.25 	-
F-Secure 	8.0.14332.0 	2008.11.26 	Trojan.Win32.Agent.aqpj
Fortinet 	3.117.0.0 	2008.11.25 	-
GData 	19 	2008.11.26 	Trojan.Dropper.LdPinch.AO
Ikarus 	T3.1.1.45.0 	2008.11.26 	Trojan-Dropper.LdPinch
K7AntiVirus 	7.10.533 	2008.11.25 	-
Kaspersky 	7.0.0.125 	2008.11.26 	Trojan.Win32.Agent.aqpj
McAfee 	5445 	2008.11.25 	-
McAfee+Artemis 	5445 	2008.11.25 	-
Microsoft 	1.4104 	2008.11.26 	-
NOD32 	3641 	2008.11.26 	-
Norman 	5.80.02 	2008.11.25 	-
Panda 	9.0.0.4 	2008.11.25 	-
PCTools 	4.4.2.0 	2008.11.25 	-
Prevx1 	V2 	2008.11.26 	-
Rising 	21.05.12.00 	2008.11.25 	-
SecureWeb-Gateway 	6.7.6 	2008.11.25 	Trojan.Dropper.Delphi.Gen
Sophos 	4.35.0 	2008.11.25 	-
Sunbelt 	3.1.1823.2 	2008.11.22 	-
Symantec 	10 	2008.11.26 	Infostealer
TheHacker 	6.3.1.1.163 	2008.11.25 	-
TrendMicro 	8.700.0.1004 	2008.11.26 	-
VBA32 	3.12.8.9 	2008.11.26 	-
ViRobot 	2008.11.26.1486 	2008.11.26 	-
VirusBuster 	4.5.11.0 	2008.11.25 	-

Дополнительная информация
File size: 699392 bytes
MD5...: d48bc81b3ad1acd0b4416ddefe1eea09
SHA1..: 51009421c683bad2a2eb6d7dee324c806632cd67

Надоело быть жертвой? Стань профи по информационной безопасности, получай самую свежую информацию об угрозах и средствах защиты от ведущего российского аналитического центра Anti-Malware.ru:

**Shu_b** · 28.11.2008, 13:09

File msansspc.dll received on 11.28.2008 06:05:23 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.11.27.4	2008.11.28	-
AntiVir	7.9.0.35	2008.11.27	TR/Agent.aqkz
Authentium	5.1.0.4	2008.11.28	-
Avast	4.8.1281.0	2008.11.27	Win32:Trojan-gen {Other}
AVG	8.0.0.199	2008.11.27	Agent.AMYR
BitDefender	7.2	2008.11.28	-
CAT-QuickHeal	10.00	2008.11.28	Trojan.Agent.aqkz
ClamAV	0.94.1	2008.11.28	-
DrWeb	4.44.0.09170	2008.11.28	Trojan.Botnetlog.1
eSafe	7.0.17.0	2008.11.27	Suspicious File
eTrust-Vet	31.6.6233	2008.11.27	-
Ewido	4.0	2008.11.27	-
F-Prot	4.4.4.56	2008.11.27	-
F-Secure	8.0.14332.0	2008.11.28	-
Fortinet	3.117.0.0	2008.11.27	-
GData	19	2008.11.28	Win32:Trojan-gen {Other}
Ikarus	T3.1.1.45.0	2008.11.28	-
K7AntiVirus	7.10.536	2008.11.27	-
Kaspersky	7.0.0.125	2008.11.28	-
McAfee	5447	2008.11.27	-
McAfee+Artemis	5447	2008.11.27	-
Microsoft	1.4104	2008.11.28	-
NOD32	3647	2008.11.27	-
Norman	5.80.02	2008.11.27	-
Panda	9.0.0.4	2008.11.28	-
PCTools	4.4.2.0	2008.11.27	-
Prevx1	V2	2008.11.28	-
Rising	21.05.40.00	2008.11.28	Trojan.Win32.Undef.tff
SecureWeb-Gateway	6.7.6	2008.11.27	Trojan.Agent.aqkz
Sophos	4.36.0	2008.11.28	-
Sunbelt	3.1.1832.2	2008.11.27	-
Symantec	10	2008.11.28	-
TheHacker	6.3.1.1.166	2008.11.28	-
TrendMicro	8.700.0.1004	2008.11.27	-
VBA32	3.12.8.9	2008.11.27	-
ViRobot	2008.11.27.1489	2008.11.27	-
VirusBuster	4.5.11.0	2008.11.27	-

Additional information
File size: 27648 bytes
MD5...: de110803efec6c70e69016f51ed23832

Добавлено через 1 час 57 минут

File mdm.exe received on 11.28.2008 08:58:31 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.11.27.4	2008.11.28	-
AntiVir	7.9.0.35	2008.11.28	-
Authentium	5.1.0.4	2008.11.28	-
Avast	4.8.1281.0	2008.11.27	-
AVG	8.0.0.199	2008.11.27	SHeur2.DRQ
BitDefender	7.2	2008.11.28	-
CAT-QuickHeal	10.00	2008.11.28	Backdoor.IRCBot.gqg
ClamAV	0.94.1	2008.11.28	-
DrWeb	4.44.0.09170	2008.11.28	BackDoor.IRC.Rxbot.26
eSafe	7.0.17.0	2008.11.27	-
eTrust-Vet	31.6.6233	2008.11.27	-
Ewido	4.0	2008.11.27	-
F-Prot	4.4.4.56	2008.11.27	-
Fortinet	3.117.0.0	2008.11.27	W32/IRCBot.GQG!tr.bdr
GData	19	2008.11.28	-
Ikarus	T3.1.1.45.0	2008.11.28	-
K7AntiVirus	7.10.536	2008.11.27	Backdoor.Win32.IRCBot.gqg
Kaspersky	7.0.0.125	2008.11.28	Backdoor.Win32.IRCBot.gqg
McAfee	5447	2008.11.27	-
McAfee+Artemis	5447	2008.11.27	-
Microsoft	1.4104	2008.11.28	-
NOD32	3647	2008.11.27	-
Norman	5.80.02	2008.11.27	-
Panda	9.0.0.4	2008.11.28	-
PCTools	4.4.2.0	2008.11.27	-
Prevx1	V2	2008.11.28	-
Rising	21.05.40.00	2008.11.28	-
SecureWeb-Gateway	6.7.6	2008.11.28	-
Sophos	4.36.0	2008.11.28	-
Sunbelt	3.1.1832.2	2008.11.27	-
Symantec	10	2008.11.28	-
TheHacker	6.3.1.1.166	2008.11.28	-
TrendMicro	8.700.0.1004	2008.11.28	WORM_MAINBOT.MCL
VBA32	3.12.8.9	2008.11.27	-
ViRobot	2008.11.28.1490	2008.11.28	-
VirusBuster	4.5.11.0	2008.11.27	-

Additional information
File size: 35840 bytes
MD5...: dbf6bdddfbe8bb6035e9ae885cbf5d04

**Numb** · 28.11.2008, 13:21

Из раздела "Помогите!":
Файл avz00002.dta получен 2008.11.28 11:06:47 (CET)
(оригинальное имя - C:\Program Files\Microsoft Common\svchost.exe)

Код:

AhnLab-V3	2008.11.27.4	2008.11.28	-
AntiVir	7.9.0.35	2008.11.28	-
Authentium	5.1.0.4	2008.11.28	-
Avast	4.8.1281.0	2008.11.27	-
AVG	8.0.0.199	2008.11.27	Win32/Cryptor
BitDefender	7.2	2008.11.28	-
CAT-QuickHeal	10.00	2008.11.28	(Suspicious) - DNAScan
ClamAV	0.94.1	2008.11.28	-
DrWeb	4.44.0.09170	2008.11.28	-
eSafe	7.0.17.0	2008.11.27	-
eTrust-Vet	31.6.6234	2008.11.28	-
Ewido	4.0	2008.11.27	-
F-Prot	4.4.4.56	2008.11.27	-
F-Secure	8.0.14332.0	2008.11.28	-
Fortinet	3.117.0.0	2008.11.28	-
GData	19	2008.11.28	-
Ikarus	T3.1.1.45.0	2008.11.28	-
K7AntiVirus	7.10.536	2008.11.27	-
Kaspersky	7.0.0.125	2008.11.28	-
McAfee	5447	2008.11.27	-
McAfee+Artemis	5447	2008.11.27	-
Microsoft	1.4104	2008.11.28	TrojanDropper:Win32/Emold.C
NOD32	3647	2008.11.27	-
Norman	5.80.02	2008.11.27	-
Panda	9.0.0.4	2008.11.28	-
PCTools	4.4.2.0	2008.11.27	-
Prevx1	V2	2008.11.28	-
Rising	21.05.40.00	2008.11.28	-
SecureWeb-Gateway	6.7.6	2008.11.28	-
Sophos	4.36.0	2008.11.28	Mal/EncPk-GH
Sunbelt	3.1.1832.2	2008.11.27	-
Symantec	10	2008.11.28	-
TheHacker	6.3.1.1.166	2008.11.28	-
TrendMicro	8.700.0.1004	2008.11.28	PAK_Generic.001
VBA32	3.12.8.9	2008.11.27	suspected of Unknown.Win32Virus
ViRobot	2008.11.28.1490	2008.11.28	-
VirusBuster	4.5.11.0	2008.11.27	Worm.Autorun.Gen!Pac.14

Дополнительная информация
File size: 28672 bytes
MD5...: b5446b4263b5c3f443bd19f6860bf157
SHA1..: 4e590b3d85ef4e3624915ed8eb28e0aa698ff312

Файл avz00009.dta получен 2008.11.28 11:10:25 (CET)
(оригинальное имя - c:\windows\system32\msmsg.exe)

Код:

AhnLab-V3	2008.11.28.2	2008.11.28	-
AntiVir	7.9.0.35	2008.11.28	TR/ATRAPS.Gen
Authentium	5.1.0.4	2008.11.28	-
Avast	4.8.1281.0	2008.11.27	-
AVG	8.0.0.199	2008.11.27	-
BitDefender	7.2	2008.11.28	-
CAT-QuickHeal	10.00	2008.11.28	-
ClamAV	0.94.1	2008.11.28	-
DrWeb	4.44.0.09170	2008.11.28	-
eSafe	7.0.17.0	2008.11.27	Suspicious File
eTrust-Vet	31.6.6234	2008.11.28	-
Ewido	4.0	2008.11.27	-
F-Prot	4.4.4.56	2008.11.27	-
F-Secure	8.0.14332.0	2008.11.28	-
Fortinet	3.117.0.0	2008.11.28	-
GData	19	2008.11.28	-
Ikarus	T3.1.1.45.0	2008.11.28	-
K7AntiVirus	7.10.536	2008.11.27	-
Kaspersky	7.0.0.125	2008.11.28	-
McAfee	5447	2008.11.27	-
McAfee+Artemis	5447	2008.11.27	-
Microsoft	1.4104	2008.11.28	Trojan:Win32/Anomaly.gen!A
NOD32	3647	2008.11.27	-
Norman	5.80.02	2008.11.27	-
Panda	9.0.0.4	2008.11.28	-
PCTools	4.4.2.0	2008.11.27	-
Prevx1	V2	2008.11.28	-
Rising	21.05.40.00	2008.11.28	Packer.RyCrypt
SecureWeb-Gateway	6.7.6	2008.11.28	Trojan.ATRAPS.Gen
Sophos	4.36.0	2008.11.28	-
Sunbelt	3.1.1832.2	2008.11.27	-
Symantec	10	2008.11.28	-
TheHacker	6.3.1.1.166	2008.11.28	-
TrendMicro	8.700.0.1004	2008.11.28	Possible_Virus
VBA32	3.12.8.9	2008.11.27	-
ViRobot	2008.11.28.1490	2008.11.28	-
VirusBuster	4.5.11.0	2008.11.27	-

Дополнительная информация
File size: 52224 bytes
MD5...: 8e7aa93d943c5022bedeeb7fc3444764
SHA1..: 4a8c3528f304dd96a7884feb7c32908c5e619f91

**Shu_b** · 28.11.2008, 15:58

File fccyaXqn.dll received on 11.28.2008 13:46:49 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.11.28.2	2008.11.28	-
AntiVir	7.9.0.36	2008.11.28	-
Authentium	5.1.0.4	2008.11.28	-
Avast	4.8.1281.0	2008.11.27	-
AVG	8.0.0.199	2008.11.27	Vundo.AT
BitDefender	7.2	2008.11.28	Trojan.Vundo.FXR
CAT-QuickHeal	10.00	2008.11.28	-
ClamAV	0.94.1	2008.11.28	-
DrWeb	4.44.0.09170	2008.11.28	-
eSafe	7.0.17.0	2008.11.27	-
eTrust-Vet	31.6.6234	2008.11.28	-
Ewido	4.0	2008.11.28	-
F-Prot	4.4.4.56	2008.11.27	-
Fortinet	3.117.0.0	2008.11.28	-
GData	19	2008.11.28	Trojan.Vundo.FXR
Ikarus	T3.1.1.45.0	2008.11.28	-
K7AntiVirus	7.10.536	2008.11.27	-
Kaspersky	7.0.0.125	2008.11.28	-
McAfee	5447	2008.11.27	-
McAfee+Artemis	5447	2008.11.27	-
Microsoft	1.4104	2008.11.28	Trojan:Win32/Vundo.gen!R
NOD32	3648	2008.11.28	a variant of Win32/Adware.Virtumonde.NDK
Norman	5.80.02	2008.11.28	-
Panda	9.0.0.4	2008.11.28	-
PCTools	4.4.2.0	2008.11.27	-
Prevx1	V2	2008.11.28	-
Rising	21.05.42.00	2008.11.28	-
SecureWeb-Gateway	6.7.6	2008.11.28	Riskware.LooksLike.Fraud.An
Sophos	4.36.0	2008.11.28	-
Sunbelt	3.1.1832.2	2008.11.27	-
Symantec	10	2008.11.28	Packed.Generic.201
TheHacker	6.3.1.1.166	2008.11.28	-
TrendMicro	8.700.0.1004	2008.11.28	-
VBA32	3.12.8.9	2008.11.28	-
ViRobot	2008.11.28.1491	2008.11.28	-
VirusBuster	4.5.11.0	2008.11.27	-

Additional information
File size: 246272 bytes
MD5...: 89088dcede745e1f6cb169207ab58fce

File cBSifEvT.dll received on 11.28.2008 13:50:33 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.11.28.2	2008.11.28	-
AntiVir	7.9.0.36	2008.11.28	TR/Vundo.fxr.84
Authentium	5.1.0.4	2008.11.28	-
Avast	4.8.1281.0	2008.11.27	-
AVG	8.0.0.199	2008.11.27	Vundo.AT
BitDefender	7.2	2008.11.28	Trojan.Vundo.FXR
CAT-QuickHeal	10.00	2008.11.28	Win32.Trojan.Vundo.gen!R.3
ClamAV	0.94.1	2008.11.28	-
DrWeb	4.44.0.09170	2008.11.28	Trojan.Siggen.630
eSafe	7.0.17.0	2008.11.27	-
eTrust-Vet	31.6.6234	2008.11.28	-
Ewido	4.0	2008.11.28	-
F-Prot	4.4.4.56	2008.11.27	-
F-Secure	8.0.14332.0	2008.11.28	Trojan:W32/Vundo.BV
Fortinet	3.117.0.0	2008.11.28	PossibleThreat
GData	19	2008.11.28	Trojan.Vundo.FXR
Ikarus	T3.1.1.45.0	2008.11.28	Trojan.Win32.Monder
K7AntiVirus	7.10.536	2008.11.27	-
Kaspersky	7.0.0.125	2008.11.28	-
McAfee	5447	2008.11.27	-
McAfee+Artemis	5447	2008.11.27	Generic!Artemis
Microsoft	1.4104	2008.11.28	Trojan:Win32/Vundo.gen!R
NOD32	3648	2008.11.28	a variant of Win32/Adware.Virtumonde.NDI
Norman	5.80.02	2008.11.28	-
Panda	9.0.0.4	2008.11.28	-
PCTools	4.4.2.0	2008.11.27	-
Prevx1	V2	2008.11.28	-
Rising	21.05.42.00	2008.11.28	-
SecureWeb-Gateway	6.7.6	2008.11.28	Trojan.Vundo.fxr.84
Sophos	4.36.0	2008.11.28	-
Sunbelt	3.1.1832.2	2008.11.27	-
Symantec	10	2008.11.28	Packed.Generic.201
TheHacker	6.3.1.1.166	2008.11.28	-
TrendMicro	8.700.0.1004	2008.11.28	PAK_Generic.001
VBA32	3.12.8.9	2008.11.28	-
ViRobot	2008.11.28.1491	2008.11.28	-
VirusBuster	4.5.11.0	2008.11.27	-

Additional information
File size: 37888 bytes
MD5...: 394ce94ae80941b3676eebcc76668561

**Синауридзе Александр** · 30.11.2008, 06:22

Файл DUpL.exe получен 2008.11.30 01:17:20 (CET)

AhnLab-V3 2008.11.28.2 2008.11.29 -
AntiVir 7.9.0.36 2008.11.29 -
Authentium 5.1.0.4 2008.11.29 -
Avast 4.8.1281.0 2008.11.29 -
AVG 8.0.0.199 2008.11.29 -
BitDefender 7.2 2008.11.30 Trojan.Generic.694784
CAT-QuickHeal 10.00 2008.11.29 -
ClamAV 0.94.1 2008.11.29 -
DrWeb 4.44.0.09170 2008.11.29 -
eSafe 7.0.17.0 2008.11.27 Suspicious File
eTrust-Vet 31.6.6234 2008.11.28 -
Ewido 4.0 2008.11.29 -
F-Prot 4.4.4.56 2008.11.29 W32/Malware.D.dam!Eldorado
F-Secure 8.0.14332.0 2008.11.29 -
Fortinet 3.117.0.0 2008.11.29 -
GData 19 2008.11.30 Trojan.Generic.694784
Ikarus T3.1.1.45.0 2008.11.29 -
K7AntiVirus 7.10.538 2008.11.29 -
Kaspersky 7.0.0.125 2008.11.30 -
McAfee 5449 2008.11.29 -
McAfee+Artemis 5449 2008.11.29 -
Microsoft 1.4104 2008.11.30 VirTool:Win32/Obfuscator.BO
NOD32 3650 2008.11.28 -
Norman 5.80.02 2008.11.28 -
Panda 9.0.0.4 2008.11.29 -
PCTools 4.4.2.0 2008.11.29 -
Prevx1 V2 2008.11.30 -
Rising 21.05.52.00 2008.11.29 -
SecureWeb-Gateway 6.7.6 2008.11.29 Win32.Malware.dam (suspicious)
Sophos 4.36.0 2008.11.29 -
Sunbelt 3.1.1832.2 2008.11.27 VIPRE.Suspicious
Symantec 10 2008.11.30 -
TheHacker 6.3.1.1.169 2008.11.29 -
TrendMicro 8.700.0.1004 2008.11.28 -
VBA32 3.12.8.9 2008.11.29 -
ViRobot 2008.11.29.1492 2008.11.29 -
VirusBuster 4.5.11.0 2008.11.29 -

Дополнительная информация
File size: 12081 bytes
MD5...: 0bffe2fb6a7f610fae8914a09bcd2987
SHA1..: 4a656493a7d0b3f5c3c920ffe58bbc309cbba3d9
SHA256: 53785632a8650bc766b606ca540c7f97a50d8187de5239233a 0e5089271961e4
SHA512: 91bdb0623927bbec83e536cd36b8245e4faafc423f78460c74 0864d98a6c774d
0b535d01546b853b496de83c6ac4d4972cb5d678a9f2fcc40e 932bfcd1d519cd

ssdeep: 192:xQRwiZPCP3xGFFkNugr9fUWcTTuU7vWjZqprZvMb6R+Acg MFSLFBmA:W103x
NuQ8WOTR7OIh6gbLj

PEiD..: -
TrID..: File type identification
Win16/32 Executable Delphi generic (34.0%)
Generic Win/DOS Executable (32.9%)
DOS Executable Generic (32.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4090a0
timedatestamp.....: 0x47ec6ca2 (Fri Mar 28 03:57:22 200

machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.rdata 0x1000 0x1c41 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.data 0x3000 0x4fce 0x2200 7.97 ea7fd029f38a484f214183b938deeffb
.data_ 0x8000 0x1000 0xa00 7.90 88931dcced08016e4ef86ca25f7716e1
.icode 0x9000 0x350 0x400 0.00 d41d8cd98f00b204e9800998ecf8427e
.icode 0xa000 0x2f3 0x400 0.00 d41d8cd98f00b204e9800998ecf8427e

( 0 imports )

( 0 exports )

CWSandbox info: <a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=0bffe2fb6a7f610fae8914a09bcd2987' target='_blank'>http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=0bffe2fb6a7f610fae8914a09bcd2987</a>

Добавлено через 4 минуты

Файл sxkW.exe получен 2008.11.30 01:30:35 (CET)

AhnLab-V3 2008.11.28.2 2008.11.29 -
AntiVir 7.9.0.36 2008.11.29 TR/Crypt.XPACK.Gen
Authentium 5.1.0.4 2008.11.30 -
Avast 4.8.1281.0 2008.11.29 -
AVG 8.0.0.199 2008.11.29 Win32/Heur
BitDefender 7.2 2008.11.30 -
CAT-QuickHeal 10.00 2008.11.29 -
ClamAV 0.94.1 2008.11.29 -
DrWeb 4.44.0.09170 2008.11.29 -
eSafe 7.0.17.0 2008.11.27 Suspicious File
eTrust-Vet 31.6.6234 2008.11.28 -
Ewido 4.0 2008.11.29 -
F-Prot 4.4.4.56 2008.11.29 -
F-Secure 8.0.14332.0 2008.11.29 -
Fortinet 3.117.0.0 2008.11.29 -
GData 19 2008.11.30 -
Ikarus T3.1.1.45.0 2008.11.29 -
K7AntiVirus 7.10.538 2008.11.29 -
Kaspersky 7.0.0.125 2008.11.30 -
McAfee 5449 2008.11.29 -
McAfee+Artemis 5449 2008.11.29 -
Microsoft 1.4104 2008.11.30 VirTool:Win32/Obfuscator.BO
NOD32 3650 2008.11.28 -
Norman 5.80.02 2008.11.28 -
Panda 9.0.0.4 2008.11.29 -
PCTools 4.4.2.0 2008.11.29 -
Prevx1 V2 2008.11.30 -
Rising 21.05.52.00 2008.11.29 -
SecureWeb-Gateway 6.7.6 2008.11.29 Trojan.Crypt.XPACK.Gen
Sophos 4.36.0 2008.11.29 Mal/EncPk-DB
Sunbelt 3.1.1832.2 2008.11.27 -
Symantec 10 2008.11.30 -
TheHacker 6.3.1.1.169 2008.11.29 -
TrendMicro 8.700.0.1004 2008.11.28 -
VBA32 3.12.8.9 2008.11.29 suspected of Malware-Cryptor.Win32.General.3
ViRobot 2008.11.29.1492 2008.11.29 -
VirusBuster 4.5.11.0 2008.11.29 -

Дополнительная информация
File size: 14208 bytes
MD5...: f356940144bbc710d7e57cbf2af36157
SHA1..: 36baafce982c7cfa0ca7617f3909d537936a10b6
SHA256: c64ddc5e2a7ddb9064cd8819db102db117ec57130ebe985315 798b4101017599
SHA512: 1092fd043a1e6e52371a0ca19545f481fda144369cfc8433b0 7f8a8d968851e5
57bb10cac2e6b6b4418c3a5978b3d247671ecd0af5aef59024 df830b66ad1ed7

ssdeep: 384:KcUIcPPOZdRxe2ri1nqAiiMs3t4S2LTNLy:KcUIU+HrGii H367LR

PEiD..: -
TrID..: File type identification
Win16/32 Executable Delphi generic (34.0%)
Generic Win/DOS Executable (32.9%)
DOS Executable Generic (32.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4090dc
timedatestamp.....: 0x47c10656 (Sun Feb 24 05:53:26 200

machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.code 0x1000 0x1b24 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.share 0x3000 0x47db 0x2200 7.93 de390b5b79bc2344f57f0a4bea25aebb
.rsrc 0x8000 0x1000 0xa00 7.60 005b62737adabeac198f7d9663c09c29
.masm 0x9000 0x392 0x400 7.21 f469f31688506a1d5934baeddf0a428b
.data_ 0xa000 0x363 0x400 4.77 80b5ab88155861b55a37a077c8c6df10

( 1 imports )
> user32.dll: GrayStringA, LoadKeyboardLayoutW, EnumDisplaySettingsExW, SetWindowsHookExA, CreateDialogIndirectParamA

( 0 exports )

CWSandbox info: <a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=f356940144bbc710d7e57cbf2af36157' target='_blank'>http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=f356940144bbc710d7e57cbf2af36157</a>

Добавлено через 2 часа 48 минут

Здравствуйте,

sxkW.exe_ - Email-Worm.Win32.Zhelatin.aia

Детектирование файла будет добавлено в следующее обновление.

Пожалуйста, при ответе включайте переписку целиком.
Ответ актуален для последних баз с источников обновлений.

>From: sinauridze[antispam]rambler.ru
>Sent: Nov 30 2008 3:45AM
>To: "New Virus" <[email protected]>
>Subject:
>
>Здравствуйте!
>
> Отправляю Вам файл для анализа. Заранее спасибо за ответ.
> --
> Александр Синауридзе.
>
С уважением, Михаил Кусачев
Вирусный аналитик

**Shu_b** · 01.12.2008, 17:06

итого

**Shu_b** · 01.12.2008, 17:48

File nttest.sys received on 12.01.2008 15:38:12 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.12.1.3	2008.12.01	-
AntiVir	7.9.0.36	2008.12.01	-
Authentium	5.1.0.4	2008.12.01	-
Avast	4.8.1281.0	2008.12.01	-
AVG	8.0.0.199	2008.12.01	-
BitDefender	7.2	2008.12.01	-
CAT-QuickHeal	10.00	2008.12.01	-
ClamAV	0.94.1	2008.12.01	-
DrWeb	4.44.0.09170	2008.12.01	-
eSafe	7.0.17.0	2008.11.30	-
eTrust-Vet	31.6.6234	2008.11.28	-
Ewido	4.0	2008.12.01	-
F-Prot	4.4.4.56	2008.11.30	-
F-Secure	8.0.14332.0	2008.12.01	-
Fortinet	3.117.0.0	2008.11.30	-
GData	19	2008.12.01	-
Ikarus	T3.1.1.45.0	2008.12.01	-
K7AntiVirus	7.10.539	2008.12.01	-
Kaspersky	7.0.0.125	2008.12.01	-
McAfee	5450	2008.11.30	-
McAfee+Artemis	5450	2008.11.30	-
Microsoft	1.4104	2008.12.01	-
NOD32	3653	2008.12.01	Win32/SpamTool.Agent.NBF
Norman	5.80.02	2008.12.01	-
Panda	9.0.0.4	2008.12.01	-
PCTools	4.4.2.0	2008.12.01	-
Prevx1	V2	2008.12.01	-
Rising	21.06.02.00	2008.12.01	-
SecureWeb-Gateway	6.7.6	2008.12.01	-
Sophos	4.36.0	2008.12.01	-
Sunbelt	3.1.1832.2	2008.12.01	-
Symantec	10	2008.12.01	-
TheHacker	6.3.1.1.169	2008.11.29	-
TrendMicro	8.700.0.1004	2008.12.01	-
VBA32	3.12.8.9	2008.12.01	-
ViRobot	2008.12.1.1494	2008.12.01	-
VirusBuster	4.5.11.0	2008.11.30	-

Additional information
File size: 33280 bytes
MD5...: ff07e4d14fcef9dabd1685ddf67d0974

**Shu_b** · 02.12.2008, 11:26

File explorer.ex_ received on 12.02.2008 07:38:15 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.12.2.0	2008.12.02	-
AntiVir	7.9.0.36	2008.12.01	-
Authentium	5.1.0.4	2008.12.02	-
Avast	4.8.1281.0	2008.12.01	-
AVG	8.0.0.199	2008.12.02	Win32/Small.DO
BitDefender	7.2	2008.12.02	Trojan.Inject.HP
CAT-QuickHeal	10.00	2008.12.02	-
ClamAV	0.94.1	2008.12.02	-
DrWeb	4.44.0.09170	2008.12.02	-
eSafe	7.0.17.0	2008.11.30	-
eTrust-Vet	31.6.6238	2008.12.02	-
Ewido	4.0	2008.12.01	-
F-Prot	4.4.4.56	2008.12.01	-
F-Secure	8.0.14332.0	2008.12.02	W32/Afgan.C
Fortinet	3.117.0.0	2008.12.02	-
GData	19	2008.12.02	Trojan.Inject.HP
Ikarus	T3.1.1.45.0	2008.12.02	-
K7AntiVirus	7.10.539	2008.12.01	-
Kaspersky	7.0.0.125	2008.12.02	Heur.Infector
McAfee	5451	2008.12.01	-
McAfee+Artemis	5451	2008.12.01	-
Microsoft	1.4104	2008.12.02	-
NOD32	3656	2008.12.02	a variant of Win32/Afgan
Norman	5.80.02	2008.12.01	W32/Afgan.C
Panda	9.0.0.4	2008.12.02	-
PCTools	4.4.2.0	2008.12.01	-
Prevx1	V2	2008.12.02	-
Rising	21.06.10.00	2008.12.02	-
SecureWeb-Gateway	6.7.6	2008.12.01	Win32.Malware.gen!84 (suspicious)
Sophos	4.36.0	2008.12.02	-
Sunbelt	3.1.1832.2	2008.12.01	-
Symantec	10	2008.12.02	-
TheHacker	6.3.1.2.171	2008.12.02	-
TrendMicro	8.700.0.1004	2008.12.02	-
VBA32	3.12.8.9	2008.12.01	-
ViRobot	2008.12.2.1495	2008.12.02	-
VirusBuster	4.5.11.0	2008.12.01	-

Additional information
File size: 1056768 bytes
MD5...: bdefbce8919f5b8dffe487942140fa11

Добавлено через 59 минут

File ethxttap.sys ethsqcxl.sys received on 12.02.2008 09:13:38 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.12.2.0	2008.12.02	-
AntiVir	7.9.0.36	2008.12.02	TR/Rootkit.Gen
Authentium	5.1.0.4	2008.12.02	-
Avast	4.8.1281.0	2008.12.01	-
AVG	8.0.0.199	2008.12.02	Win32/Rustock.G
BitDefender	7.2	2008.12.02	-
CAT-QuickHeal	10.00	2008.12.02	-
ClamAV	0.94.1	2008.12.02	-
DrWeb	4.44.0.09170	2008.12.02	-
eSafe	7.0.17.0	2008.11.30	-
eTrust-Vet	31.6.6238	2008.12.02	-
Ewido	4.0	2008.12.01	-
F-Prot	4.4.4.56	2008.12.01	-
F-Secure	8.0.14332.0	2008.12.02	-
Fortinet	3.117.0.0	2008.12.02	-
GData	19	2008.12.02	-
Ikarus	T3.1.1.45.0	2008.12.02	-
K7AntiVirus	7.10.539	2008.12.01	-
Kaspersky	7.0.0.125	2008.12.02	-
McAfee	5451	2008.12.01	-
McAfee+Artemis	5451	2008.12.01	-
Microsoft	1.4104	2008.12.02	Spammer:Win32/Rlsloup.B
NOD32	3656	2008.12.02	-
Norman	5.80.02	2008.12.01	-
Panda	9.0.0.4	2008.12.02	-
PCTools	4.4.2.0	2008.12.01	-
Prevx1	V2	2008.12.02	-
Rising	21.06.10.00	2008.12.02	-
SecureWeb-Gateway	6.7.6	2008.12.02	Trojan.Rootkit.Gen
Sophos	4.36.0	2008.12.02	-
Sunbelt	3.1.1832.2	2008.12.01	-
Symantec	10	2008.12.02	-
TheHacker	6.3.1.2.171	2008.12.02	-
TrendMicro	8.700.0.1004	2008.12.02	-
VBA32	3.12.8.9	2008.12.01	-
ViRobot	2008.12.2.1495	2008.12.02	-
VirusBuster	4.5.11.0	2008.12.01	-

Additional information
File size: 135232 bytes
MD5...: 2690ad3b314f9e94d47356171889af67

**Hanson** · 02.12.2008, 13:48

Файл avz00003.dta(vmnetx86.sys) получен 2008.12.02 09:13:08 (CET)
Текущий статус:закончено
Результат: 5/37 (13.52%)

Антивирус Версия Обновление Результат
AhnLab-V3 2008.12.2.0 2008.12.02 -
AntiVir 7.9.0.36 2008.12.02 -
Authentium 5.1.0.4 2008.12.02 -
Avast 4.8.1281.0 2008.12.01 -
AVG 8.0.0.199 2008.12.02 -
BitDefender 7.2 2008.12.02 -
CAT-QuickHeal 10.00 2008.12.02 -
ClamAV 0.94.1 2008.12.02 -
DrWeb 4.44.0.09170 2008.12.02 -
eSafe 7.0.17.0 2008.11.30 -
eTrust-Vet 31.6.6238 2008.12.02 -
Ewido 4.0 2008.12.01 -
F-Prot 4.4.4.56 2008.12.01 -
F-Secure 8.0.14332.0 2008.12.02 -
Fortinet 3.117.0.0 2008.12.02 suspicious
GData 19 2008.12.02 -
Ikarus T3.1.1.45.0 2008.12.02 -
K7AntiVirus 7.10.539 2008.12.01 -
Kaspersky 7.0.0.125 2008.12.02 -
McAfee 5451 2008.12.01 -
McAfee+Artemis 5451 2008.12.01 Generic!Artemis
Microsoft 1.4104 2008.12.02 -
NOD32 3656 2008.12.02 -
Norman 5.80.02 2008.12.01 -
Panda 9.0.0.4 2008.12.02 -
PCTools 4.4.2.0 2008.12.01 -
Prevx1 V2 2008.12.02 -
Rising 21.06.10.00 2008.12.02 RootKit.Win32.Undef.nb
SecureWeb-Gateway 6.7.6 2008.12.02 -
Sophos 4.36.0 2008.12.02 -
Sunbelt 3.1.1832.2 2008.12.01 Trojan.DDoS.SITC
Symantec 10 2008.12.02 -
TheHacker 6.3.1.2.171 2008.12.02 -
TrendMicro 8.700.0.1004 2008.12.02 -
VBA32 3.12.8.9 2008.12.01 Trojan.Win32.DDosBot
ViRobot 2008.12.2.1495 2008.12.02 -
VirusBuster 4.5.11.0 2008.12.01 -

ответ Каспера, через 2 часа после отправки файла

Здравствуйте,

avz00003.dta - Rootkit.Win32.KernelBot.dn

Детектирование файла будет добавлено в следующее обновление.

др веб ответил через 4 часа,

Trojan.NtRootKit.2400

больше никто пока неответил

**Shu_b** · 02.12.2008, 16:15

File Microsoft Common\wuauclt.exe received on 12.02.2008 12:41:26 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.12.2.2	2008.12.02	-
AntiVir	7.9.0.36	2008.12.02	-
Authentium	5.1.0.4	2008.12.02	-
Avast	4.8.1281.0	2008.12.01	-
AVG	8.0.0.199	2008.12.02	Win32/Heur
BitDefender	7.2	2008.12.02	Trojan.Generic.1023521
CAT-QuickHeal	10.00	2008.12.02	(Suspicious) - DNAScan
ClamAV	0.94.1	2008.12.02	-
DrWeb	4.44.0.09170	2008.12.02	-
eSafe	7.0.17.0	2008.11.30	Suspicious File
eTrust-Vet	31.6.6238	2008.12.02	-
Ewido	4.0	2008.12.01	-
F-Prot	4.4.4.56	2008.12.01	-
Fortinet	3.117.0.0	2008.12.02	-
GData	19	2008.12.02	Trojan.Generic.1023521
Ikarus	T3.1.1.45.0	2008.12.02	-
K7AntiVirus	7.10.539	2008.12.01	-
Kaspersky	7.0.0.125	2008.12.02	-
McAfee	5451	2008.12.01	New Malware.ix
McAfee+Artemis	5451	2008.12.01	New Malware.ix
Microsoft	1.4104	2008.12.02	-
NOD32	3657	2008.12.02	-
Norman	5.80.02	2008.12.01	-
Panda	9.0.0.4	2008.12.02	-
PCTools	4.4.2.0	2008.12.01	-
Rising	21.06.12.00	2008.12.02	-
SecureWeb-Gateway	6.7.6	2008.12.02	Virus.Win32.FileInfector.gen (suspicious)
Sophos	4.36.0	2008.12.02	Mal/EncPk-FC
Sunbelt	3.1.1832.2	2008.12.01	-
Symantec	10	2008.12.02	-
TheHacker	6.3.1.2.171	2008.12.02	-
TrendMicro	8.700.0.1004	2008.12.02	-
VBA32	3.12.8.9	2008.12.01	suspected of Malware-Cryptor.Win32.General.3
ViRobot	2008.12.2.1496	2008.12.02	-
VirusBuster	4.5.11.0	2008.12.01	-

Additional information
File size: 24576 bytes
MD5...: 23801a0d48390720d217adba2fe6f9fc

Добавлено через 50 минут

File kdmpq.exe received on 12.02.2008 13:24:41 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.12.2.2	2008.12.02	-
AntiVir	7.9.0.36	2008.12.02	-
Authentium	5.1.0.4	2008.12.02	W32/Sinowal-based!Maximus
Avast	4.8.1281.0	2008.12.01	Win32:FaDrop
AVG	8.0.0.199	2008.12.02	-
BitDefender	7.2	2008.12.02	-
CAT-QuickHeal	10.00	2008.12.02	(Suspicious) - DNAScan
ClamAV	0.94.1	2008.12.02	-
DrWeb	4.44.0.09170	2008.12.02	-
eSafe	7.0.17.0	2008.11.30	Suspicious File
eTrust-Vet	31.6.6238	2008.12.02	-
Ewido	4.0	2008.12.01	-
F-Prot	4.4.4.56	2008.12.01	W32/Sinowal-based!Maximus
F-Secure	8.0.14332.0	2008.12.02	Suspicious:W32/Malware!Gemini
Fortinet	3.117.0.0	2008.12.02	-
GData	19	2008.12.02	Win32:FaDrop
Ikarus	T3.1.1.45.0	2008.12.02	-
K7AntiVirus	7.10.539	2008.12.01	-
Kaspersky	7.0.0.125	2008.12.02	-
McAfee	5451	2008.12.01	-
McAfee+Artemis	5451	2008.12.01	-
Microsoft	1.4104	2008.12.02	Trojan:Win32/Alureon.gen
NOD32	3657	2008.12.02	a variant of Win32/Kryptik.BT
Norman	5.80.02	2008.12.01	-
Panda	9.0.0.4	2008.12.02	-
PCTools	4.4.2.0	2008.12.01	-
Prevx1	V2	2008.12.02	-
Rising	21.06.12.00	2008.12.02	-
SecureWeb-Gateway	6.7.6	2008.12.02	-
Sophos	4.36.0	2008.12.02	-
Sunbelt	3.1.1832.2	2008.12.01	-
Symantec	10	2008.12.02	-
TheHacker	6.3.1.2.171	2008.12.02	-
TrendMicro	8.700.0.1004	2008.12.02	-
VBA32	3.12.8.9	2008.12.01	-
ViRobot	2008.12.2.1496	2008.12.02	-
VirusBuster	4.5.11.0	2008.12.01	-

Additional information
File size: 76800 bytes
MD5...: 41b8e54b145f0b509870b2c91756d5b7

Добавлено через 32 минуты

File autorun.inf\sgucjl.exe received on 12.02.2008 14:02:45 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.12.2.2	2008.12.02	-
AntiVir	7.9.0.36	2008.12.02	-
Authentium	5.1.0.4	2008.12.02	-
Avast	4.8.1281.0	2008.12.01	Win32:Trojan-gen {Other}
AVG	8.0.0.199	2008.12.02	-
BitDefender	7.2	2008.12.02	-
CAT-QuickHeal	10.00	2008.12.02	-
ClamAV	0.94.1	2008.12.02	-
DrWeb	4.44.0.09170	2008.12.02	-
eSafe	7.0.17.0	2008.11.30	Suspicious File
eTrust-Vet	31.6.6238	2008.12.02	-
Ewido	4.0	2008.12.01	-
F-Prot	4.4.4.56	2008.12.01	-
F-Secure	8.0.14332.0	2008.12.02	-
Fortinet	3.117.0.0	2008.12.02	-
GData	19	2008.12.02	Win32:Trojan-gen {Other}
Ikarus	T3.1.1.45.0	2008.12.02	-
K7AntiVirus	7.10.539	2008.12.01	-
Kaspersky	7.0.0.125	2008.12.02	-
McAfee	5451	2008.12.01	-
McAfee+Artemis	5451	2008.12.01	-
Microsoft	1.4104	2008.12.02	-
NOD32	3657	2008.12.02	Win32/Packed.Autoit.Gen
Norman	5.80.02	2008.12.01	-
Panda	9.0.0.4	2008.12.02	-
PCTools	4.4.2.0	2008.12.02	-
Prevx1	V2	2008.12.02	-
Rising	21.06.12.00	2008.12.02	-
SecureWeb-Gateway	6.7.6	2008.12.02	-
Sophos	4.36.0	2008.12.02	-
Sunbelt	3.1.1832.2	2008.12.01	-
Symantec	10	2008.12.02	-
TheHacker	6.3.1.2.171	2008.12.02	-
TrendMicro	8.700.0.1004	2008.12.02	-
VBA32	3.12.8.9	2008.12.01	-
ViRobot	2008.12.2.1496	2008.12.02	-
VirusBuster	4.5.11.0	2008.12.01	-

Additional information
File size: 484488 bytes
MD5...: 11ba1cec8e6f3c7a6d064f0c53bc4510

Добавлено через 5 минут

File kavo0.dll received on 12.02.2008 14:06:32 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.12.2.2	2008.12.02	-
AntiVir	7.9.0.36	2008.12.02	-
Authentium	5.1.0.4	2008.12.02	-
Avast	4.8.1281.0	2008.12.01	-
AVG	8.0.0.199	2008.12.02	Win32/Heur
BitDefender	7.2	2008.12.02	-
CAT-QuickHeal	10.00	2008.12.02	-
ClamAV	0.94.1	2008.12.02	-
DrWeb	4.44.0.09170	2008.12.02	-
eSafe	7.0.17.0	2008.11.30	Suspicious File
eTrust-Vet	31.6.6238	2008.12.02	-
Ewido	4.0	2008.12.02	-
F-Prot	4.4.4.56	2008.12.01	-
F-Secure	8.0.14332.0	2008.12.02	-
Fortinet	3.117.0.0	2008.12.02	-
GData	19	2008.12.02	Packer.Malware.NSAnti.1
Ikarus	T3.1.1.45.0	2008.12.02	-
K7AntiVirus	7.10.539	2008.12.01	-
Kaspersky	7.0.0.125	2008.12.02	-
McAfee	5451	2008.12.01	-
McAfee+Artemis	5451	2008.12.01	Generic!Artemis
Microsoft	1.4104	2008.12.02	PWS:Win32/Frethog.D
NOD32	3657	2008.12.02	-
Norman	5.80.02	2008.12.01	-
Panda	9.0.0.4	2008.12.02	Suspicious file
PCTools	4.4.2.0	2008.12.02	-
Prevx1	V2	2008.12.02	-
Rising	21.06.12.00	2008.12.02	-
SecureWeb-Gateway	6.7.6	2008.12.02	Virus.Win32.FileInfector.gen!84 (suspicious)
Sophos	4.36.0	2008.12.02	Troj/Virtum-Gen
Sunbelt	3.1.1832.2	2008.12.01	-
Symantec	10	2008.12.02	-
TheHacker	6.3.1.2.171	2008.12.02	-
TrendMicro	8.700.0.1004	2008.12.02	-
VBA32	3.12.8.9	2008.12.01	-
ViRobot	2008.12.2.1496	2008.12.02	-
VirusBuster	4.5.11.0	2008.12.01	-

Additional information
File size: 147456 bytes
MD5...: e3cefe9cf6bf9400fec3912a24dfae7b

File autorun.inf \eeqt.exe received on 12.02.2008 14:06:45 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.12.2.2	2008.12.02	-
AntiVir	7.9.0.36	2008.12.02	-
Authentium	5.1.0.4	2008.12.02	-
Avast	4.8.1281.0	2008.12.01	-
AVG	8.0.0.199	2008.12.02	PSW.OnlineGames_r.K
BitDefender	7.2	2008.12.02	-
CAT-QuickHeal	10.00	2008.12.02	(Suspicious) - DNAScan
ClamAV	0.94.1	2008.12.02	-
DrWeb	4.44.0.09170	2008.12.02	-
eSafe	7.0.17.0	2008.11.30	Suspicious File
eTrust-Vet	31.6.6238	2008.12.02	-
Ewido	4.0	2008.12.02	-
F-Prot	4.4.4.56	2008.12.01	-
Fortinet	3.117.0.0	2008.12.02	-
GData	19	2008.12.02	Packer.Malware.NSAnti.1
Ikarus	T3.1.1.45.0	2008.12.02	-
K7AntiVirus	7.10.539	2008.12.01	-
Kaspersky	7.0.0.125	2008.12.02	-
McAfee	5451	2008.12.01	New Malware.bx
McAfee+Artemis	5451	2008.12.01	New Malware.bx
Microsoft	1.4104	2008.12.02	PWS:Win32/Frethog.AJ
NOD32	3657	2008.12.02	-
Norman	5.80.02	2008.12.01	-
Panda	9.0.0.4	2008.12.02	-
PCTools	4.4.2.0	2008.12.02	-
Prevx1	V2	2008.12.02	-
Rising	21.06.12.00	2008.12.02	-
SecureWeb-Gateway	6.7.6	2008.12.02	Trojan.Crypt.LooksLike.XPACK
Sophos	4.36.0	2008.12.02	-
Sunbelt	3.1.1832.2	2008.12.01	-
Symantec	10	2008.12.02	-
TheHacker	6.3.1.2.171	2008.12.02	-
TrendMicro	8.700.0.1004	2008.12.02	-
VBA32	3.12.8.9	2008.12.01	-
ViRobot	2008.12.2.1496	2008.12.02	-
VirusBuster	4.5.11.0	2008.12.01	-

Additional information
File size: 109788 bytes
MD5...: fc7f4c670fad604211bf890a70365d6b

**Shu_b** · 05.12.2008, 16:00

File \Temp\init.exe received on 12.05.2008 12:01:28 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.12.5.0	2008.12.05	-
AntiVir	7.9.0.41	2008.12.05	-
Authentium	5.1.0.4	2008.12.05	-
Avast	4.8.1281.0	2008.12.04	Win32:Fabot
AVG	8.0.0.199	2008.12.05	-
BitDefender	7.2	2008.12.05	-
CAT-QuickHeal	10.00	2008.12.05	(Suspicious) - DNAScan
ClamAV	0.94.1	2008.12.05	-
Comodo	682	2008.12.04	-
DrWeb	4.44.0.09170	2008.12.05	-
eSafe	7.0.17.0	2008.12.04	-
eTrust-Vet	31.6.6243	2008.12.04	-
Ewido	4.0	2008.12.04	-
F-Prot	4.4.4.56	2008.12.04	-
F-Secure	8.0.14332.0	2008.12.05	-
Fortinet	3.117.0.0	2008.12.05	-
GData	19	2008.12.05	Win32:Fabot
Ikarus	T3.1.1.45.0	2008.12.05	-
K7AntiVirus	7.10.543	2008.12.04	-
Kaspersky	7.0.0.125	2008.12.05	-
McAfee	5454	2008.12.04	-
McAfee+Artemis	5454	2008.12.04	-
Microsoft	1.4205	2008.12.05	-
NOD32	3666	2008.12.05	-
Norman	5.80.02	2008.12.04	-
Panda	9.0.0.4	2008.12.04	-
PCTools	4.4.2.0	2008.12.04	-
Prevx1	V2	2008.12.05	-
Rising	21.06.42.00	2008.12.05	-
SecureWeb-Gateway	6.7.6	2008.12.05	-
Sophos	4.36.0	2008.12.05	-
Sunbelt	3.1.1832.2	2008.12.01	-
Symantec	10	2008.12.05	-
TheHacker	6.3.1.2.176	2008.12.05	-
TrendMicro	8.700.0.1004	2008.12.05	-
VBA32	3.12.8.10	2008.12.05	-
ViRobot	2008.12.5.1502	2008.12.05	-
VirusBuster	4.5.11.0	2008.12.04	-

Additional information
File size: 36864 bytes
MD5...: 592ee0ae2fce5633e5b37186453e79b1

Добавлено через 1 минуту

File services.exe received on 12.05.2008 12:04:15 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.12.5.0	2008.12.05	-
AntiVir	7.9.0.41	2008.12.05	TR/Drop.SQH.31
Authentium	5.1.0.4	2008.12.05	-
Avast	4.8.1281.0	2008.12.04	Win32:Fabot
AVG	8.0.0.199	2008.12.05	-
BitDefender	7.2	2008.12.05	Trojan.Dropper.SQH
CAT-QuickHeal	10.00	2008.12.05	(Suspicious) - DNAScan
ClamAV	0.94.1	2008.12.05	-
Comodo	682	2008.12.04	-
DrWeb	4.44.0.09170	2008.12.05	-
eSafe	7.0.17.0	2008.12.04	-
eTrust-Vet	31.6.6243	2008.12.04	-
Ewido	4.0	2008.12.04	-
F-Prot	4.4.4.56	2008.12.04	-
F-Secure	8.0.14332.0	2008.12.05	-
Fortinet	3.117.0.0	2008.12.05	-
GData	19	2008.12.05	Trojan.Dropper.SQH
Ikarus	T3.1.1.45.0	2008.12.05	-
K7AntiVirus	7.10.543	2008.12.04	-
Kaspersky	7.0.0.125	2008.12.05	-
McAfee	5454	2008.12.04	-
McAfee+Artemis	5454	2008.12.04	-
Microsoft	1.4205	2008.12.05	-
NOD32	3666	2008.12.05	-
Norman	5.80.02	2008.12.04	-
Panda	9.0.0.4	2008.12.04	-
PCTools	4.4.2.0	2008.12.04	-
Prevx1	V2	2008.12.05	-
Rising	21.06.42.00	2008.12.05	-
SecureWeb-Gateway	6.7.6	2008.12.05	Trojan.Drop.SQH.31
Sophos	4.36.0	2008.12.05	-
Sunbelt	3.1.1832.2	2008.12.01	-
Symantec	10	2008.12.05	-
TheHacker	6.3.1.2.176	2008.12.05	-
TrendMicro	8.700.0.1004	2008.12.05	-
VBA32	3.12.8.10	2008.12.05	-
ViRobot	2008.12.5.1502	2008.12.05	-
VirusBuster	4.5.11.0	2008.12.04	-

Additional information
File size: 43008 bytes
MD5...: dc03a966df53d8bba045895a11a18957

Добавлено через 1 час 52 минуты

File runsql.exe svzip.exe received on 12.05.2008 13:49:29 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.12.5.0	2008.12.05	-
AntiVir	7.9.0.41	2008.12.05	TR/Dropper.Gen
Authentium	5.1.0.4	2008.12.05	-
Avast	4.8.1281.0	2008.12.04	Win32:Lighty-I
AVG	8.0.0.199	2008.12.05	Win32/Heur
BitDefender	7.2	2008.12.05	-
CAT-QuickHeal	10.00	2008.12.05	-
ClamAV	0.94.1	2008.12.05	-
Comodo	682	2008.12.04	-
DrWeb	4.44.0.09170	2008.12.05	-
eSafe	7.0.17.0	2008.12.04	-
eTrust-Vet	31.6.6243	2008.12.04	-
Ewido	4.0	2008.12.05	-
F-Prot	4.4.4.56	2008.12.04	-
F-Secure	8.0.14332.0	2008.12.05	-
Fortinet	3.117.0.0	2008.12.05	-
GData	19	2008.12.05	Win32:Lighty-I
Ikarus	T3.1.1.45.0	2008.12.05	-
K7AntiVirus	7.10.543	2008.12.04	-
Kaspersky	7.0.0.125	2008.12.05	-
McAfee	5454	2008.12.04	Olmarik
McAfee+Artemis	5454	2008.12.04	Olmarik
Microsoft	1.4205	2008.12.05	TrojanDownloader:Win32/Renos.FJ
NOD32	3666	2008.12.05	a variant of Win32/Kryptik.CM
Norman	5.80.02	2008.12.05	-
Panda	9.0.0.4	2008.12.05	-
PCTools	4.4.2.0	2008.12.05	-
Prevx1	V2	2008.12.05	Cloaked Malware
Rising	21.06.43.00	2008.12.05	-
SecureWeb-Gateway	6.7.6	2008.12.05	Trojan.Dropper.Gen
Sophos	4.36.0	2008.12.05	-
Sunbelt	3.1.1832.2	2008.12.01	-
Symantec	10	2008.12.05	Trojan.Fakeavalert
TheHacker	6.3.1.2.176	2008.12.05	-
TrendMicro	8.700.0.1004	2008.12.05	-
VBA32	3.12.8.10	2008.12.05	-
ViRobot	2008.12.5.1502	2008.12.05	-
VirusBuster	4.5.11.0	2008.12.04	Trojan.FakeAlert.Gen!Pac.3

Additional information
File size: 279040 bytes
MD5...: 979c3771126466704cc8ca49bb8bd4ec

**Groft** · 07.12.2008, 23:21

Файл tmp1.tmp получен 2008.12.07 21:13:51 (CET)
Текущий статус: закончено
Результат: 9/38 (23.69%)
Форматированные
Печать результатов

Код:

Антивирус	Версия	Обновление	Результат
AhnLab-V3	2008.12.6.0	2008.12.06	-
AntiVir	7.9.0.42	2008.12.07	-
Authentium	5.1.0.4	2008.12.06	-
Avast	4.8.1281.0	2008.12.06	Win32:Trojan-gen {Other}
AVG	8.0.0.199	2008.12.06	Downloader.Generic7.AXDR
BitDefender	7.2	2008.12.07	Trojan.Downloader.ConHook.BK
CAT-QuickHeal	10.00	2008.12.06	TrojanDownloader.Cavitate.e
ClamAV	0.94.1	2008.12.07	-
Comodo	698	2008.12.06	-
DrWeb	4.44.0.09170	2008.12.07	-
eSafe	7.0.17.0	2008.12.07	-
eTrust-Vet	31.6.6246	2008.12.05	-
Ewido	4.0	2008.12.07	-
F-Prot	4.4.4.56	2008.12.04	-
F-Secure	8.0.14332.0	2008.12.07	-
Fortinet	3.117.0.0	2008.12.07	-
GData	19	2008.12.07	Trojan.Downloader.ConHook.BK
Ikarus	T3.1.1.45.0	2008.12.07	Trojan-Downloader.Win32.Injecter
K7AntiVirus	7.10.547	2008.12.06	-
Kaspersky	7.0.0.125	2008.12.07	-
McAfee	5456	2008.12.06	-
McAfee+Artemis	5456	2008.12.06	-
Microsoft	1.4205	2008.12.07	TrojanDownloader:Win32/Cavitate.gen!E
NOD32	3668	2008.12.06	probably a variant of Win32/TrojanDownloader.Agent.NXY
Norman	5.80.02	2008.12.05	-
Panda	9.0.0.4	2008.12.07	-
PCTools	4.4.2.0	2008.12.06	-
Prevx1	V2	2008.12.07	-
Rising	21.06.62.00	2008.12.07	-
SecureWeb-Gateway	6.7.6	2008.12.07	-
Sophos	4.36.0	2008.12.07	-
Sunbelt	3.1.1832.2	2008.12.01	-
Symantec	10	2008.12.07	-
TheHacker	6.3.1.2.179	2008.12.06	-
TrendMicro	8.700.0.1004	2008.12.05	-
VBA32	3.12.8.10	2008.12.07	suspected of Downloader.Small.48
ViRobot	2008.12.6.1504	2008.12.06	-
VirusBuster	4.5.11.0	2008.12.05	-

Дополнительная информация
File size: 34304 bytes
MD5...: d7688fb077e20b86aa73754a52521038
http://www.virustotal.com/ru/analisi...817575ac7b18ce

**ISO** · 08.12.2008, 19:57

Очередной порноинформер
File glwlib.dll received on 12.08.2008 16:31:07 (CET)
Result: 7/38 (18.43%)

Код:

Antivirus             Version             Last Update             Result                 AhnLab-V32008.12.6.02008.12.06-
AntiVir7.9.0.422008.12.08-
Authentium5.1.0.42008.12.08-
Avast4.8.1281.02008.12.08Win32:Hexzone-U
AVG8.0.0.1992008.12.07Adload_r.FF
BitDefender7.22008.12.07-
CAT-QuickHeal10.002008.12.08-
ClamAV0.94.12008.12.07-
Comodo7082008.12.08-
DrWeb4.44.0.091702008.12.07Trojan.Blackmailer.origine
Safe7.0.17.02008.12.08-
eTrust-
Vet31.6.62462008.12.05-
Ewido4.02008.12.07-
F-Prot4.4.4.562008.12.04-
F-Secure8.0.14332.02008.12.08Trojan-Ransom.Win32.Hexzone.giz
Fortinet3.117.0.02008.12.07-
GData192008.12.07Win32:Hexzone-U
IkarusT3.1.1.45.02008.12.08Trojan-Ransom.Win32.Hexzone
K7AntiVirus7.10.5482008.12.08-
Kaspersky7.0.0.1252008.12.07Trojan-Ransom.Win32.Hexzone.giz
McAfee54562008.12.06-
McAfee+Artemis54562008.12.06-
Microsoft1.42052008.12.08-
NOD3236702008.12.08-
Norman5.80.022008.12.05-
Panda9.0.0.42008.12.07-
PCTools4.4.2.02008.12.08-
Prevx1V22008.12.08-
Rising21.06.62.002008.12.07-
SecureWeb-
Gateway6.7.62008.12.08-
Sophos4.36.02008.12.07-
Sunbelt3.1.1832.22008.12.01-
Symantec102008.12.07-
TheHacker6.3.1.2.1792008.12.06-
TrendMicro8.700.0.10042008.12.08-
VBA323.12.8.102008.12.07-
ViRobot2008.12.6.15042008.12.06-
VirusBuster4.5.11.02008.12.08-

File conmgr.exe received on 12.09.2008 05:44:27 (CET)
Result: 16/38 (42.11%)

Код:

Antivirus  	Version  	Last Update  	Result
AhnLab-V3	2008.12.8.1	2008.12.09	-
AntiVir	7.9.0.43	2008.12.08	TR/Crypt.XPACK.Gen
Authentium	5.1.0.4	2008.12.08	-
Avast	4.8.1281.0	2008.12.08	Win32:Trojan-gen {Other}
AVG	8.0.0.199	2008.12.08	-
BitDefender	7.2	2008.12.09	Packer.Krunchy.B
CAT-QuickHeal	10.00	2008.12.09	(Suspicious) - DNAScan
ClamAV	0.94.1	2008.12.09	-
Comodo	711	2008.12.08	-
DrWeb	4.44.0.09170	2008.12.09	-
eSafe	7.0.17.0	2008.12.08	-
eTrust-Vet	31.6.6246	2008.12.05	-
Ewido	4.0	2008.12.08	-
F-Prot	4.4.4.56	2008.12.08	-
F-Secure	8.0.14332.0	2008.12.09	W32/Packed_Krunchy.A
Fortinet	3.117.0.0	2008.12.09	PossibleThreat
GData	19	2008.12.09	Packer.Krunchy.B
Ikarus	T3.1.1.45.0	2008.12.08	Packer.Krunchy.B
K7AntiVirus	7.10.548	2008.12.08	Trojan.Win32.Malware.1
Kaspersky	7.0.0.125	2008.12.09	-
McAfee	5458	2008.12.08	Generic.dx
McAfee+Artemis	5458	2008.12.09	Generic.dx
Microsoft	1.4205	2008.12.09	-
NOD32	3674	2008.12.09	-
Norman	5.80.02	2008.12.08	W32/Packed_Krunchy.A
Panda	9.0.0.4	2008.12.08	Generic Trojan
PCTools	4.4.2.0	2008.12.08	-
Prevx1	V2	2008.12.09	-
Rising	21.07.02.00	2008.12.08	-
SecureWeb-Gateway	6.7.6	2008.12.09	Trojan.Crypt.XPACK.Gen
Sophos	4.36.0	2008.12.09	Mal/Generic-A
Sunbelt	3.1.1832.2	2008.12.01	VIPRE.Suspicious
Symantec	10	2008.12.09	-
TheHacker	6.3.1.2.180	2008.12.09	-
TrendMicro	8.700.0.1004	2008.12.08	-
VBA32	3.12.8.10	2008.12.09	-
ViRobot	2008.12.9.1507	2008.12.09	-
VirusBuster	4.5.11.0	2008.12.08	-

**ALEX(XX)** · 09.12.2008, 11:04

File rxzwug.exe received on 12.09.2008 08:29:07 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.12.8.1	2008.12.09	-
AntiVir	7.9.0.43	2008.12.08	TR/Autoit.FN
Authentium	5.1.0.4	2008.12.08	-
Avast	4.8.1281.0	2008.12.08	Win32:Trojan-gen {Other}
AVG	8.0.0.199	2008.12.08	-
BitDefender	7.2	2008.12.09	Trojan.Generic.1175909
CAT-QuickHeal	10.00	2008.12.09	Trojan.Agent.arqp
ClamAV	0.94.1	2008.12.09	Worm.Autorun-1793
Comodo	713	2008.12.09	-
DrWeb	4.44.0.09170	2008.12.09	-
eSafe	7.0.17.0	2008.12.08	Suspicious File
eTrust-Vet	31.6.6246	2008.12.05	-
Ewido	4.0	2008.12.08	-
F-Prot	4.4.4.56	2008.12.08	-
F-Secure	8.0.14332.0	2008.12.09	Trojan.Win32.Autoit.fn
Fortinet	3.117.0.0	2008.12.09	-
GData	19	2008.12.09	Trojan.Generic.1175909
Ikarus	T3.1.1.45.0	2008.12.08	Trojan.Win32.Autoit.dt
K7AntiVirus	7.10.548	2008.12.08	-
Kaspersky	7.0.0.125	2008.12.09	Trojan.Win32.Autoit.fn
McAfee	5458	2008.12.08	W32/Autorun.worm.zf.gen
McAfee+Artemis	5458	2008.12.09	W32/Autorun.worm.zf.gen
Microsoft	1.4205	2008.12.09	Worm:AutoIt/Renocide.gen!A
NOD32	3675	2008.12.09	Win32/Packed.Autoit.Gen
Norman	5.80.02	2008.12.08	W32/Agent.JIIR
Panda	9.0.0.4	2008.12.08	W32/Autoit.AB
PCTools	4.4.2.0	2008.12.08	-
Prevx1	V2	2008.12.09	-
Rising	21.07.02.00	2008.12.08	-
SecureWeb-Gateway	6.7.6	2008.12.09	Trojan.Autoit.FN
Sophos	4.36.0	2008.12.09	Sus/Behav-1011
Sunbelt	3.1.1832.2	2008.12.01	-
Symantec	10	2008.12.09	-
TheHacker	6.3.1.2.180	2008.12.09	Trojan/Autoit.gs
TrendMicro	8.700.0.1004	2008.12.09	-
VBA32	3.12.8.10	2008.12.09	-
ViRobot	2008.12.9.1507	2008.12.09	-
VirusBuster	4.5.11.0	2008.12.08	-

Additional information
File size: 420320 bytes
MD5...: 0a41d1c04d74329667594d85b054542f
SHA1..: 1b4b46d5804812f3a921e06a4179bd46e05e586a
SHA256: 4bcfb65ca251580266878b92a1c4c01063e765bc5ded930fa19d7c3dc053c577
SHA512: 88f041a876d13ae04e24e3960e8947eeb898f4c3e59cfabcf1a9efc2f79f9d80<BR>ce6554009b497f7c88318c8ab0977f0aaacd28ccf95ff19c6a6598313aa894a5<BR>
ssdeep: 12288:mnNhuBoY8SorxgmA+nlvVluyVsMDCTHEs9K:mPatCg7EP8yqMDOkgK<BR>
PEiD..: -
TrID..: File type identification<BR>UPX compressed Win32 Executable (39.5%)<BR>Win32 EXE Yoda's Crypter (34.3%)<BR>Win32 Executable Generic (11.0%)<BR>Win32 Dynamic Link Library (generic) (9.8%)<BR>Generic Win/DOS Executable (2.5%)
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x490490<BR>timedatestamp.....: 0x4850e379 (Thu Jun 12 08:51:05 2008)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 3 sections )<BR>name        viradd    virsiz   rawdsiz  ntrpy  md5<BR>UPX0        0x1000   0x58000       0x0   0.00  d41d8cd98f00b204e9800998ecf8427e<BR>UPX1       0x59000   0x38000   0x37800   7.93  c8cb0c68e090a662ba2868cc32095c1b<BR>.rsrc      0x91000    0x1000     0x600   3.31  d013d2373cc18dfe81eb1acfaa18d88b<BR><BR>( 13 imports )  <BR>&gt; KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess<BR>&gt; ADVAPI32.dll: RegCloseKey<BR>&gt; COMCTL32.dll: ImageList_Create<BR>&gt; comdlg32.dll: GetSaveFileNameW<BR>&gt; GDI32.dll: LineTo<BR>&gt; MPR.dll: WNetUseConnectionW<BR>&gt; ole32.dll: CoInitialize<BR>&gt; OLEAUT32.dll: -<BR>&gt; SHELL32.dll: DragFinish<BR>&gt; USER32.dll: GetDC<BR>&gt; VERSION.dll: VerQueryValueW<BR>&gt; WINMM.dll: timeGetTime<BR>&gt; WSOCK32.dll: -<BR><BR>( 0 exports ) <BR>
packers (Kaspersky): PE_Patch.UPX, UPX
packers (F-Prot): UPX

Добавлено через 7 минут

Файл autorun.inf получен 2008.12.09 08:59:40 (CET)

Код:

Антивирус	Версия	Обновление	Результат
AhnLab-V3	2008.12.8.1	2008.12.09	-
AntiVir	7.9.0.43	2008.12.09	-
Authentium	5.1.0.4	2008.12.08	-
Avast	4.8.1281.0	2008.12.08	-
AVG	8.0.0.199	2008.12.08	Worm/AutoRun
BitDefender	7.2	2008.12.09	-
CAT-QuickHeal	10.00	2008.12.09	-
ClamAV	0.94.1	2008.12.09	Worm.Autorun-1792
Comodo	713	2008.12.09	-
DrWeb	4.44.0.09170	2008.12.09	-
eSafe	7.0.17.0	2008.12.08	-
eTrust-Vet	31.6.6246	2008.12.05	INF/SillyAutorun
Ewido	4.0	2008.12.08	-
F-Prot	4.4.4.56	2008.12.08	-
F-Secure	8.0.14332.0	2008.12.09	BAT/AutoRun.AE
Fortinet	3.117.0.0	2008.12.09	-
GData	19	2008.12.09	-
Ikarus	T3.1.1.45.0	2008.12.08	-
K7AntiVirus	7.10.548	2008.12.08	-
Kaspersky	7.0.0.125	2008.12.09	-
McAfee	5458	2008.12.08	-
McAfee+Artemis	5458	2008.12.09	-
Microsoft	1.4205	2008.12.09	-
NOD32	3675	2008.12.09	INF/Autorun.gen
Norman	5.80.02	2008.12.08	BAT/AutoRun.AE
Panda	9.0.0.4	2008.12.08	-
PCTools	4.4.2.0	2008.12.08	-
Prevx1	V2	2008.12.09	-
Rising	21.07.02.00	2008.12.08	-
SecureWeb-Gateway	6.7.6	2008.12.09	-
Sophos	4.36.0	2008.12.09	W32/Yahlov-A
Sunbelt	3.1.1832.2	2008.12.01	INF.Autorun (v)
Symantec	10	2008.12.09	-
TheHacker	6.3.1.2.180	2008.12.09	-
TrendMicro	8.700.0.1004	2008.12.09	Mal_Otorun1
VBA32	3.12.8.10	2008.12.09	-
ViRobot	2008.12.9.1507	2008.12.09	-
VirusBuster	4.5.11.0	2008.12.08	INF.Autorun.Gen

Дополнительная информация
File size: 329 bytes
MD5...: 75f1ea0c347a2181a360a9304678379c
SHA1..: 24bcea875b855efcaf7d17b8b794506cd1ad9140
SHA256: 7be18c48eb4bcb971925d33d98804acd233d507950044a037bfebfd32757ae76
SHA512: 72c49d94e3d7c2a7ab8cc7556b18c7dac4636934d182d61f132f97cabef75fdf<BR>2dd92b30eda731db98895c366ddf8db2cdde149088fdb4cc4e60098dd5e81ff8<BR>
ssdeep: 6:ic5hu37Kxg7oQq0TMvc3WA8ziQDG243Dqea8XWVLXJZJggTwZew7n:i2uLKm7P<BR>Mvc3WA8zfGDKLlggcQw7<BR>
PEiD..: -
TrID..: File type identification<BR>Unknown!
PEInfo: -

**Shu_b** · 10.12.2008, 16:55

File ntos.exe received on 12.10.2008 12:28:27 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.12.10.2	2008.12.10	-
AntiVir	7.9.0.43	2008.12.10	-
Authentium	5.1.0.4	2008.12.10	-
Avast	4.8.1281.0	2008.12.10	Win32:Lighty-J
AVG	8.0.0.199	2008.12.09	SHeur2.FKG
BitDefender	7.2	2008.12.10	Packer.Malware.Lighty.E
CAT-QuickHeal	10.00	2008.12.10	-
ClamAV	0.94.1	2008.12.10	-
Comodo	718	2008.12.10	-
DrWeb	4.44.0.09170	2008.12.10	-
eSafe	7.0.17.0	2008.12.09	Suspicious File
eTrust-Vet	31.6.6253	2008.12.10	-
Ewido	4.0	2008.12.09	-
F-Prot	4.4.4.56	2008.12.10	-
F-Secure	8.0.14332.0	2008.12.10	-
Fortinet	3.117.0.0	2008.12.10	-
GData	19	2008.12.10	Packer.Malware.Lighty.E
Ikarus	T3.1.1.45.0	2008.12.10	Packer.Malware.Lighty
K7AntiVirus	7.10.549	2008.12.09	-
Kaspersky	7.0.0.125	2008.12.10	-
McAfee	5459	2008.12.09	-
McAfee+Artemis	5459	2008.12.09	-
Microsoft	1.4205	2008.12.10	TrojanSpy:Win32/Zbot.gen!C
NOD32	3681	2008.12.10	-
Norman	5.80.02	2008.12.09	-
Panda	9.0.0.4	2008.12.09	-
PCTools	4.4.2.0	2008.12.09	-
Prevx1	V2	2008.12.10	-
Rising	21.07.22.00	2008.12.10	-
SecureWeb-Gateway	6.7.6	2008.12.10	-
Sophos	4.36.0	2008.12.10	Mal/EncPk-EQ
Sunbelt	3.2.1801.2	2008.12.10	-
Symantec	10	2008.12.10	Trojan.Fakeavalert
TheHacker	6.3.1.2.182	2008.12.10	-
TrendMicro	8.700.0.1004	2008.12.10	-
VBA32	3.12.8.10	2008.12.09	-
ViRobot	2008.12.10.1511	2008.12.10	-
VirusBuster	4.5.11.0	2008.12.09	-

Additional information
File size: 177664 bytes
MD5...: faa00352c59d47f98ddfb742f563480d

Добавлено через 16 минут

File twext.exe received on 12.10.2008 12:50:56 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.12.10.2	2008.12.10	-
AntiVir	7.9.0.43	2008.12.10	-
Authentium	5.1.0.4	2008.12.10	-
Avast	4.8.1281.0	2008.12.10	Win32:Zbot-AVH
AVG	8.0.0.199	2008.12.10	-
BitDefender	7.2	2008.12.10	-
CAT-QuickHeal	10.00	2008.12.10	-
ClamAV	0.94.1	2008.12.10	-
Comodo	718	2008.12.10	-
DrWeb	4.44.0.09170	2008.12.10	Trojan.PWS.Panda.31
eSafe	7.0.17.0	2008.12.09	-
eTrust-Vet	31.6.6252	2008.12.09	-
Ewido	4.0	2008.12.09	-
F-Prot	4.4.4.56	2008.12.10	-
F-Secure	8.0.14332.0	2008.12.10	Trojan-Spy.Win32.Zbot.hrc
Fortinet	3.117.0.0	2008.12.10	-
GData	19	2008.12.10	Win32:Zbot-AVH
Ikarus	T3.1.1.45.0	2008.12.10	Trojan-Spy.Win32.Zbot
K7AntiVirus	7.10.549	2008.12.09	-
Kaspersky	7.0.0.125	2008.12.10	Trojan-Spy.Win32.Zbot.hrc
McAfee	5459	2008.12.09	-
McAfee+Artemis	5459	2008.12.09	Generic!Artemis
Microsoft	1.4205	2008.12.10	-
NOD32	3681	2008.12.10	-
Norman	5.80.02	2008.12.09	W32/Malware.EQSW
Panda	9.0.0.4	2008.12.09	-
PCTools	4.4.2.0	2008.12.10	-
Prevx1	V2	2008.12.10	-
Rising	21.07.22.00	2008.12.10	-
SecureWeb-Gateway	6.7.6	2008.12.10	-
Sophos	4.36.0	2008.12.10	-
Sunbelt	3.2.1801.2	2008.12.10	-
Symantec	10	2008.12.10	-
TheHacker	6.3.1.2.182	2008.12.10	-
TrendMicro	8.700.0.1004	2008.12.10	-
VBA32	3.12.8.10	2008.12.09	Trojan-Spy.Win32.Zbot.hme
ViRobot	2008.12.10.1511	2008.12.10	-
VirusBuster	4.5.11.0	2008.12.09	-

Additional information
File size: 588288 bytes
MD5...: 6c6802f0928c25ec068fc8cf33c4c9ba

Добавлено через 1 час 28 минут

File msqpdxmqltoity.sys received on 12.10.2008 13:47:55 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.12.10.2	2008.12.10	-
AntiVir	7.9.0.43	2008.12.10	-
Authentium	5.1.0.4	2008.12.10	-
Avast	4.8.1281.0	2008.12.10	-
AVG	8.0.0.199	2008.12.10	-
BitDefender	7.2	2008.12.10	-
CAT-QuickHeal	10.00	2008.12.10	-
ClamAV	0.94.1	2008.12.10	-
Comodo	718	2008.12.10	-
DrWeb	4.44.0.09170	2008.12.10	-
eSafe	7.0.17.0	2008.12.09	Suspicious File
eTrust-Vet	31.6.6253	2008.12.10	-
Ewido	4.0	2008.12.10	-
F-Prot	4.4.4.56	2008.12.10	-
F-Secure	8.0.14332.0	2008.12.10	-
Fortinet	3.117.0.0	2008.12.10	-
GData	19	2008.12.10	-
Ikarus	T3.1.1.45.0	2008.12.10	-
K7AntiVirus	7.10.549	2008.12.09	-
Kaspersky	7.0.0.125	2008.12.10	-
McAfee	5459	2008.12.09	-
McAfee+Artemis	5459	2008.12.09	-
Microsoft	1.4205	2008.12.10	-
NOD32	3681	2008.12.10	-
Norman	5.80.02	2008.12.09	-
Panda	9.0.0.4	2008.12.09	-
PCTools	4.4.2.0	2008.12.10	-
Prevx1	V2	2008.12.10	Malicious Software
Rising	21.07.22.00	2008.12.10	-
SecureWeb-Gateway	6.7.6	2008.12.10	-
Sophos	4.36.0	2008.12.10	-
Sunbelt	3.2.1801.2	2008.12.10	-
Symantec	10	2008.12.10	-
TheHacker	6.3.1.2.182	2008.12.10	-
TrendMicro	8.700.0.1004	2008.12.10	-
VBA32	3.12.8.10	2008.12.09	-
ViRobot	2008.12.10.1511	2008.12.10	-
VirusBuster	4.5.11.0	2008.12.09	-

Additional information
File size: 62464 bytes
MD5...: 7d0c76addaa22a5cb5b3407d5a78b211

Добавлено через 32 минуты

File nttest.sys received on 12.10.2008 14:49:14 (CET)

Код:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.12.10.2	2008.12.10	-
AntiVir	7.9.0.43	2008.12.10	TR/Spy.Agent.sad
Authentium	5.1.0.4	2008.12.10	-
Avast	4.8.1281.0	2008.12.10	Win32:Rootkit-gen
AVG	8.0.0.199	2008.12.10	-
BitDefender	7.2	2008.12.10	-
CAT-QuickHeal	10.00	2008.12.10	-
ClamAV	0.94.1	2008.12.10	-
Comodo	718	2008.12.10	-
DrWeb	4.44.0.09170	2008.12.10	-
eSafe	7.0.17.0	2008.12.10	-
eTrust-Vet	31.6.6253	2008.12.10	-
Ewido	4.0	2008.12.10	-
F-Prot	4.4.4.56	2008.12.10	-
Fortinet	3.117.0.0	2008.12.10	-
GData	19	2008.12.10	Win32:Rootkit-gen
Ikarus	T3.1.1.45.0	2008.12.10	-
K7AntiVirus	7.10.550	2008.12.10	-
Kaspersky	7.0.0.125	2008.12.10	Rootkit.Win32.Agent.fiy
McAfee	5459	2008.12.09	-
McAfee+Artemis	5459	2008.12.09	-
Microsoft	1.4205	2008.12.10	-
NOD32	3681	2008.12.10	-
Norman	5.80.02	2008.12.10	-
Panda	9.0.0.4	2008.12.09	-
PCTools	4.4.2.0	2008.12.10	-
Prevx1	V2	2008.12.10	-
Rising	21.07.22.00	2008.12.10	-
SecureWeb-Gateway	6.7.6	2008.12.10	Trojan.Spy.Agent.sad
Sophos	4.36.0	2008.12.10	-
Sunbelt	3.2.1801.2	2008.12.10	-
Symantec	10	2008.12.10	-
TheHacker	6.3.1.2.182	2008.12.10	-
TrendMicro	8.700.0.1004	2008.12.10	-
VBA32	3.12.8.10	2008.12.09	-
ViRobot	2008.12.10.1511	2008.12.10	-
VirusBuster	4.5.11.0	2008.12.09	-

Additional information
File size: 33792 bytes
MD5...: ecaa2fbb9a7ea227cce882ffe31351b4

**PavelA** · 10.12.2008, 18:07

Тема:http://virusinfo.info/showthread.php?t=35469

Src=\??\C:\WINDOWS\system32\drivers\ethvfbgq.sys

Файл bcqr00004.dta получен 2008.12.10 16:01:05 (CET)

Код:

Антивирус Версия Обновление Результат 
AhnLab-V3 2008.12.10.2 2008.12.10 Win-Trojan/Agent.137792 
AntiVir 7.9.0.43 2008.12.10 TR/Rootkit.Gen 
Authentium 5.1.0.4 2008.12.10 - 
Avast 4.8.1281.0 2008.12.10 - 
AVG 8.0.0.199 2008.12.10 Win32/Rustock.G 
BitDefender 7.2 2008.12.10 - 
CAT-QuickHeal 10.00 2008.12.10 Rootkit.Agent.epv 
ClamAV 0.94.1 2008.12.10 - 
Comodo 718 2008.12.10 - 
DrWeb 4.44.0.09170 2008.12.10 - 
eSafe 7.0.17.0 2008.12.10 - 
eTrust-Vet 31.6.6253 2008.12.10 - 
Ewido 4.0 2008.12.10 - 
F-Prot 4.4.4.56 2008.12.10 - 
F-Secure 8.0.14332.0 2008.12.10 - 
Fortinet 3.117.0.0 2008.12.10 - 
GData 19 2008.12.10 - 
Ikarus T3.1.1.45.0 2008.12.10 - 
K7AntiVirus 7.10.550 2008.12.10 - 
Kaspersky 7.0.0.125 2008.12.10 - 
McAfee 5459 2008.12.09 - 
McAfee+Artemis 5459 
Microsoft 1.4205 2008.12.10 Spammer:Win32/Rlsloup.B 
NOD32 3682 2008.12.10 - 
Norman 5.80.02 2008.12.10 - 
Panda 9.0.0.4 2008.12.09 - 
PCTools 4.4.2.0 2008.12.10 - 
Prevx1 V2 2008.12.10 - 
Rising 21.07.22.00 2008.12.10 - 
SecureWeb-Gateway 6.7.6 2008.12.10 Trojan.Rootkit.Gen 
Sophos 4.36.0 2008.12.10 - 
Sunbelt 3.2.1801.2 2008.12.10 - 
Symantec 10 2008.12.10 - 
TheHacker 6.3.1.2.182 2008.12.10 - 
TrendMicro 8.700.0.1004 2008.12.10 - 
VBA32 3.12.8.10 2008.12.09 Rootkit.Win32.Agent.epv 
ViRobot 2008.12.10.1511 2008.12.10 Trojan.Win32.RT-Agent.137792 
VirusBuster 4.5.11.0 2008.12.10

Фалса или действительно Русток пожаловал в "Помогите!"

**Синауридзе Александр** · 11.12.2008, 21:33

Файл angel.exe получен 2008.12.11 19:21:58 (CET)

AhnLab-V3 2008.12.12.0 2008.12.11 -
AntiVir 7.9.0.43 2008.12.11 -
Authentium 5.1.0.4 2008.12.11 -
Avast 4.8.1281.0 2008.12.10 -
AVG 8.0.0.199 2008.12.11 -
BitDefender 7.2 2008.12.11 -
CAT-QuickHeal 10.00 2008.12.11 -
ClamAV 0.94.1 2008.12.11 -
Comodo 733 2008.12.11 -
DrWeb 4.44.0.09170 2008.12.11 BackDoor.Zany.17
eSafe 7.0.17.0 2008.12.11 -
eTrust-Vet 31.6.6256 2008.12.11 -
Ewido 4.0 2008.12.11 -
F-Prot 4.4.4.56 2008.12.11 -
F-Secure 8.0.14332.0 2008.12.11 Trojan:W32/Reggol.A
Fortinet 3.117.0.0 2008.12.11 -
GData 19 2008.12.11 -
Ikarus T3.1.1.45.0 2008.12.11 -
K7AntiVirus 7.10.551 2008.12.11 -
Kaspersky 7.0.0.125 2008.12.11 -
McAfee 5460 2008.12.10 -
McAfee+Artemis 5460 2008.12.10 Generic!Artemis
Microsoft 1.4205 2008.12.10 -
NOD32 3684 2008.12.11 -
Norman 5.80.02 2008.12.11 -
Panda 9.0.0.4 2008.12.11 -
PCTools 4.4.2.0 2008.12.11 -
Prevx1 V2 2008.12.11 -
Rising 21.07.32.00 2008.12.11 -
SecureWeb-Gateway 6.7.6 2008.12.11 -
Sophos 4.36.0 2008.12.11 -
Sunbelt 3.2.1801.2 2008.12.11 -
Symantec 10 2008.12.11 -
TheHacker 6.3.1.2.183 2008.12.11 -
TrendMicro 8.700.0.1004 2008.12.11 -
VBA32 3.12.8.10 2008.12.11 BackDoor.Zany.17
ViRobot 2008.12.11.1513 2008.12.11 -
VirusBuster 4.5.11.0 2008.12.11 -

Дополнительная информация
File size: 747008 bytes
MD5...: c0a16d7987903267becffbf82f82a99b

**AlexGOMEL** · 15.12.2008, 13:25

Файл AVZ00002.DTA получен 2008.09.22 06:21:59 (CET)

moderated by Shu_b: Сентябрьское исследование неинтересно.

**ISO** · 15.12.2008, 14:05

File adsldpcx.exe received on 12.15.2008 11:33:52 (CET)

Код:

AhnLab-V3	2008.12.12.2	2008.12.15	-
AntiVir	7.9.0.45	2008.12.15	-
Authentium	5.1.0.4	2008.12.14	-
Avast	4.8.1281.0	2008.12.14	-
AVG	8.0.0.199	2008.12.14	-
BitDefender	7.2	2008.12.15	-
CAT-QuickHeal	10.00	2008.12.15	-
ClamAV	0.94.1	2008.12.15	-
Comodo	754	2008.12.14	-
DrWeb	4.44.0.09170	2008.12.15	-
eSafe	7.0.17.0	2008.12.14	Suspicious File
eTrust-Vet	31.6.6258	2008.12.12	-
Ewido	4.0	2008.12.14	-
F-Prot	4.4.4.56	2008.12.14	-
F-Secure	8.0.14332.0	2008.12.15	-
Fortinet	3.117.0.0	2008.12.14	-
GData	19	2008.12.15	-
Ikarus	T3.1.1.45.0	2008.12.15	Trojan-Clicker.Win32.Klik
K7AntiVirus	7.10.553	2008.12.13	-
Kaspersky	7.0.0.125	2008.12.15	-
McAfee	5464	2008.12.14	Generic FakeAlert.f
McAfee+Artemis	5464	2008.12.14	Generic FakeAlert.f
Microsoft	1.4205	2008.12.15	VirTool:Win32/Obfuscator.DO
NOD32	3691	2008.12.14	-
Norman	5.80.02	2008.12.12	-
Panda	9.0.0.4	2008.12.14	-
PCTools	4.4.2.0	2008.12.14	-
Prevx1	V2	2008.12.15	Cloaked Malware
Rising	21.08.01.00	2008.12.15	-
SecureWeb-Gateway	6.7.6	2008.12.15	-
Sophos	4.36.0	2008.12.15	Mal/EncPk-EQ
Sunbelt	3.2.1801.2	2008.12.11	-
Symantec	10	2008.12.15	Trojan.Fakeavalert
TheHacker	6.3.1.4.188	2008.12.14	-
TrendMicro	8.700.0.1004	2008.12.15	-
VBA32	3.12.8.10	2008.12.14	-
ViRobot	2008.12.15.1518	2008.12.15	-
VirusBuster	4.5.11.0	2008.12.14	Trojan.FakeAlert.Gen!Pac.3

File wndutl32.dll received on 12.15.2008 11:46:11 (CET)

Код:

Antivirus  	Version  	Last Update  	Result
AhnLab-V3	2008.12.12.2	2008.12.15	-
AntiVir	7.9.0.45	2008.12.15	-
Authentium	5.1.0.4	2008.12.14	-
Avast	4.8.1281.0	2008.12.14	-
AVG	8.0.0.199	2008.12.14	-
BitDefender	7.2	2008.12.15	Packer.Malware.Lighty.F
CAT-QuickHeal	10.00	2008.12.15	-
ClamAV	0.94.1	2008.12.15	-
Comodo	754	2008.12.14	-
DrWeb	4.44.0.09170	2008.12.15	-
eSafe	7.0.17.0	2008.12.14	Suspicious File
eTrust-Vet	31.6.6261	2008.12.15	-
Ewido	4.0	2008.12.14	-
F-Prot	4.4.4.56	2008.12.14	-
F-Secure	8.0.14332.0	2008.12.15	-
Fortinet	3.117.0.0	2008.12.14	-
GData	19	2008.12.15	Packer.Malware.Lighty.F
Ikarus	T3.1.1.45.0	2008.12.15	Trojan-Clicker.Win32.Klik
K7AntiVirus	7.10.553	2008.12.13	-
Kaspersky	7.0.0.125	2008.12.15	-
McAfee	5464	2008.12.14	-
McAfee+Artemis	5464	2008.12.14	-
Microsoft	1.4205	2008.12.15	TrojanDownloader:Win32/Renos
NOD32	3691	2008.12.14	-
Norman	5.80.02	2008.12.12	-
Panda	9.0.0.4	2008.12.14	-
PCTools	4.4.2.0	2008.12.14	-
Prevx1	V2	2008.12.15	Malicious Software
Rising	21.08.01.00	2008.12.15	-
SecureWeb-Gateway	6.7.6	2008.12.15	-
Sophos	4.36.0	2008.12.15	Mal/EncPk-EQ
Sunbelt	3.2.1801.2	2008.12.10	-
Symantec	10	2008.12.15	Trojan.Fakeavalert
TheHacker	6.3.1.4.188	2008.12.14	-
TrendMicro	8.700.0.1004	2008.12.15	-
VBA32	3.12.8.10	2008.12.14	-
ViRobot	2008.12.15.1518	2008.12.15	-
VirusBuster	4.5.11.0	2008.12.14	Trojan.FakeAlert.Gen!Pac.3

File a.exe received on 12.15.2008 11:50:48 (CET)

Код:

AhnLab-V3	2008.12.12.2	2008.12.15	-
AntiVir	7.9.0.45	2008.12.15	TR/Dropper.Gen
Authentium	5.1.0.4	2008.12.14	-
Avast	4.8.1281.0	2008.12.15	-
AVG	8.0.0.199	2008.12.14	-
BitDefender	7.2	2008.12.15	-
CAT-QuickHeal	10.00	2008.12.15	-
ClamAV	0.94.1	2008.12.15	-
Comodo	754	2008.12.14	-
DrWeb	4.44.0.09170	2008.12.15	-
eSafe	7.0.17.0	2008.12.14	Suspicious File
eTrust-Vet	31.6.6261	2008.12.15	-
Ewido	4.0	2008.12.14	-
F-Prot	4.4.4.56	2008.12.14	-
F-Secure	8.0.14332.0	2008.12.15	-
Fortinet	3.117.0.0	2008.12.14	-
GData	19	2008.12.15	-
Ikarus	T3.1.1.45.0	2008.12.15	Trojan-Clicker.Win32.Klik
K7AntiVirus	7.10.553	2008.12.13	-
Kaspersky	7.0.0.125	2008.12.15	-
McAfee	5464	2008.12.14	Generic FakeAlert.f
McAfee+Artemis	5464	2008.12.14	Generic FakeAlert.f
Microsoft	1.4205	2008.12.15	TrojanDropper:Win32/Rooter.B
NOD32	3691	2008.12.14	-
Norman	5.80.02	2008.12.12	-
Panda	9.0.0.4	2008.12.14	-
PCTools	4.4.2.0	2008.12.14	-
Prevx1	V2	2008.12.15	Malicious Software
Rising	21.08.01.00	2008.12.15	-
SecureWeb-Gateway	6.7.6	2008.12.15	Trojan.Dropper.Gen
Sophos	4.36.0	2008.12.15	Mal/EncPk-EQ
Sunbelt	3.2.1801.2	2008.12.10	-
Symantec	10	2008.12.15	Trojan.Fakeavalert
TheHacker	6.3.1.4.188	2008.12.14	-
TrendMicro	8.700.0.1004	2008.12.15	-
VBA32	3.12.8.10	2008.12.14	-
ViRobot	2008.12.15.1518	2008.12.15	-
VirusBuster	4.5.11.0	2008.12.14	-

**PavelA** · 15.12.2008, 16:20

Тема:http://virusinfo.info/showthread.php?t=35666
Ответ из ЛК: smss.exe_ - Trojan-Downloader.Win32.Small.ahfw (свежий)

Файл avz00002.dta получен 2008.12.15 10:22:32 (CET)

Код:

Антивирус Версия Обновление Результат 
AhnLab-V3 2008.12.12.2 2008.12.15 - 
AntiVir 7.9.0.45 2008.12.15 TR/Crypt.XPACK.Gen 
Authentium 5.1.0.4 2008.12.14 W32/Heuristic-210!Eldorado 
Avast 4.8.1281.0 2008.12.14 - 
AVG 8.0.0.199 2008.12.14 Win32/Heur 
BitDefender 7.2 2008.12.15 - 
CAT-QuickHeal 10.00 2008.12.15 - 
ClamAV 0.94.1 2008.12.15 Trojan.Delf-6581 
Comodo 754 2008.12.14 - 
DrWeb 4.44.0.09170 2008.12.15 - 
eSafe 7.0.17.0 2008.12.14 Suspicious File 
eTrust-Vet 31.6.6258 2008.12.12 - 
Ewido 4.0 2008.12.14 - 
F-Prot 4.4.4.56 2008.12.14 W32/Heuristic-210!Eldorado 
F-Secure 8.0.14332.0 2008.12.15 Suspicious:W32/Malware!Gemini 
Fortinet 3.117.0.0 2008.12.14 - 
GData 19 2008.12.15 - 
Ikarus T3.1.1.45.0 2008.12.15 - 
K7AntiVirus 7.10.553 2008.12.13 - 
Kaspersky 7.0.0.125 2008.12.15 - 
McAfee 5464 2008.12.14 New Malware.ac 
McAfee+Artemis 5464 2008.12.14 New Malware.ac 
Microsoft 1.4205 2008.12.15 TrojanDownloader:Win32/VB.EE 
NOD32 3691 2008.12.14 probably unknown NewHeur_PE 
Norman 5.80.02 2008.12.12 - 
Panda 9.0.0.4 2008.12.14 Suspicious file 
PCTools 4.4.2.0 2008.12.14 - 
Prevx1 V2 2008.12.15 Malicious Software 
Rising 21.08.01.00 2008.12.15 - 
SecureWeb-Gateway 6.7.6 2008.12.15 Trojan.Crypt.XPACK.Gen 
Sophos 4.36.0 2008.12.15 Mal/EncPk-EW 
Sunbelt 3.2.1801.2 2008.12.11 - 
Symantec 10 2008.12.15 - 
TheHacker 6.3.1.4.188 2008.12.14 - 
TrendMicro 8.700.0.1004 2008.12.15 - 
VBA32 3.12.8.10 2008.12.14 - 
ViRobot 2008.12.15.1517 2008.12.15 - 
VirusBuster 4.5.11.0 2008.12.14 -

Дополнительная информация
File size: 13312 bytes
MD5...: 64fabb64d37b0fa3d6852b6a2bd9fed1

Исследование антивирусов 7

Опции темы

1

Похожие темы

Исследование антивирусов 6

Исследование антивирусов 5

Исследование антивирусов 4

Исследование антивирусов 3

Исследование антивирусов 2

Метки для этой темы

Ваши права в разделе