Alvin: 2008年1月

<< 第一页 < 上一页下一页 > 最后一页 >>

2008年1月

從Yahoo Mail壓縮檔病毒看防毒軟體比較

此病毒2008/1/18至今，我做一個小測驗，
看看各防毒廠商應變狀況如何(如下表)。
(沒想到S家大廠居然尚無法偵測... 還跟我說結案了耶... 一慟... )

值得注意的是，32家名單只有46.88%可偵測出來，
這樣的比例和病毒已發佈超過10天的速度相比，
有的似乎慢了許多...

檔案 10_________10_________.zip 接收於 2008.01.30 18:02:40 (CET)
反病毒引擎	版本	最後更新	掃瞄結果</TD< tr>
AhnLab-V3	2008.1.31.10	2008.01.30	-</TD< tr>
AntiVir	7.6.0.59	2008.01.30	DR/Maran.A</TD< tr>
Authentium	4.93.8	2008.01.30	-</TD< tr>
Avast	4.7.1098.0	2008.01.30	-</TD< tr>
AVG	7.5.0.516	2008.01.30	-</TD< tr>
BitDefender	7.2	2008.01.30	-</TD< tr>
CAT-QuickHeal	9.00	2008.01.29	-</TD< tr>
ClamAV	0.91.2	2008.01.30	Worm.Mytob.IS</TD< tr>
DrWeb	4.44.0.09170	2008.01.30	Trojan.PWS.Gamania.origin</TD< tr>
eSafe	7.0.15.0	2008.01.28	-</TD< tr>
eTrust-Vet	31.3.5497	2008.01.30	-</TD< tr>
Ewido	4.0	2008.01.30	-</TD< tr>
FileAdvisor	1	2008.01.30	-</TD< tr>
Fortinet	3.14.0.0	2008.01.30	W32/OnLineGames.PAB!tr.pws</TD< tr>
F-Prot	4.4.2.54	2008.01.29	-</TD< tr>
F-Secure	6.70.13260.0	2008.01.30	Trojan-PSW.Win32.OnLineGames.pab</TD< tr>
Ikarus	T3.1.1.20	2008.01.30	-</TD< tr>
Kaspersky	7.0.0.125	2008.01.30	Trojan-PSW.Win32.OnLineGames.pab</TD< tr>
McAfee	5218	2008.01.29	-</TD< tr>
Microsoft	1.3109	2008.01.28	PWS:Win32/Wowsteal.gen!A</TD< tr>
NOD32v2	2836	2008.01.30	a variant of Win32/PSW.OnLineGames.PLR</TD< tr>
Norman	5.80.02	2008.01.29	W32/Malware</TD< tr>
Panda	9.0.0.4	2008.01.29	Suspicious file</TD< tr>
Prevx1	V2	2008.01.30	-</TD< tr>
Rising	20.29.22.00	2008.01.30	-</TD< tr>
Sophos	4.25.0	2008.01.30	Mal/EncPk-AP</TD< tr>
Sunbelt	2.2.907.0	2008.01.30	-</TD< tr>
Symantec	10	2008.01.30	-</TD< tr>
TheHacker	6.2.9.202	2008.01.30	Trojan/Agent.adv</TD< tr>
VBA32	3.12.2.6	2008.01.29	suspected of Embedded.MalwareScope.Trojan-PSW.Game.14</TD< tr>
VirusBuster	4.3.26:9	2008.01.30	Packed/NSPack</TD< tr>
Webwasher-Gateway	6.6.2	2008.01.30	Trojan.Dropper.PSW.OnLineGa.pab</TD< tr>

附加訊息
File size: 177787 bytes
MD5: 2de2725d001455399793f63f7e31d782
SHA1: 2f5b3dc20d32e949ff48f94713b811335b44998b
PEiD: -
packers: RAR, NSPack
norman sandbox: [ General information ] * IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD). * Creating several executable files on hard-drive. * Accesses executable file from resource section. * File length: 222901 bytes. [ Changes to filesystem ] * Creates directory C:. * Creates directory C:\WINDOWS. * Creates directory C:\WINDOWS\TEMP. * Creates directory C:\WINDOWS\TEMP\RarSFX0. * Creates file C:\WINDOWS\TEMP\RarSFX0\10_ _10_ h.exe. * Creates file C:\WINDOWS\TEMP\RarSFX0\d.exe. * Creates file C:\WINDOWS\TEMP\RarSFX0\10_ _10_ h.txt. * Creates file C:\WINDOWS\TEMP\RarSFX0\2.bat. * Creates file C:\WINDOWS\HELP\F3C74E3FA248.dll. [ Changes to registry ] * Creates key \"HKCU\Software\WinRAR SFX\". * Sets value \"C%%PROGRA~1%WindowsUp\"=\"C:\WINDOWS\TEMP\RarSFX0\" in key \"HKCU\Software\WinRAR SFX\". * Creates key \"HKCR\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\". * Sets value \"\"=\"SSUUDL\" in key \"HKCR\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\". * Creates key \"HKCR\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32\". * Sets value \"\"=\"C:\WINDOWS\HELP\F3C74E3FA248.dll\" in key \"HKCR\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32\". * Sets value \"ThreadingModel\"=\"Apartment\" in key \"HKCR\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32\". [ Network ] * Hooks into Shell explorer. [ Process/window information ] * Attemps to NULL C:\WINDOWS\TEMP\RarSFX0\10_ _10_ h.exe NULL. * Attemps to NULL C:\WINDOWS\TEMP\RarSFX0\d.exe NULL. * Attemps to NULL C:\WINDOWS\TEMP\RarSFX0\10_ _10_ h.txt NULL. * Creates a mutex WSXIHUDS.