【警告】YY軟件園網站發現木馬程式

[DarkSkyline]

FYI.
hxxp://www.52aya.com/

連上網頁之後,IE會自動下載"csrss.exe"檔案,AntiVir PersonalEdition Premium 發現[TR/Delphi.Downloader.Gen]木馬程式~

PS:請大家注意這個網站,沒事的話不要連結,以免中獎~

[qqbeau]

嘿嘿
http://www.pczone.com.tw/vbb3/showthread.php?t=129789

[qqbeau]

password:virus

AntiVir 7.3.0.19 12.18.2006 TR/Delphi.Downloader.Gen
Authentium 4.93.8 12.15.2006 no virus found
Avast 4.7.892.0 12.16.2006 Win32elf-CFS
AVG 386 12.17.2006 no virus found
BitDefender 7.2 12.18.2006 no virus found
CAT-QuickHeal 8.00 12.17.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 12.18.2006 no virus found
DrWeb 4.33 12.18.2006 Trojan.DownLoader.15895
eSafe 7.0.14.0 12.17.2006 suspicious Trojan/Worm
eTrust-InoculateIT 23.73.88 12.18.2006 no virus found
eTrust-Vet 30.3.3254 12.15.2006 no virus found
Ewido 4.0 12.18.2006 no virus found
Fortinet 2.82.0.0 12.18.2006 no virus found
F-Prot 3.16f 12.15.2006 no virus found
F-Prot4 4.2.1.29 12.15.2006 no virus found
Ikarus T3.1.0.26 12.18.2006 no virus found
Kaspersky 4.0.2.24 12.18.2006 no virus found
McAfee 4920 12.15.2006 no virus found
Microsoft 1.1804 12.15.2006 no virus found
NOD32v2 1924 12.15.2006 no virus found
Norman 5.80.02 12.18.2006 no virus found
Panda 9.0.0.4 12.17.2006 Suspicious file
Prevx1 V2 12.18.2006 no virus found
Sophos 4.12.0 12.18.2006 no virus found
Sunbelt 2.2.907.0 11.30.2006 VIPRE.Suspicious
TheHacker 6.0.3.133 12.16.2006 no virus found
UNA 1.83 12.15.2006 no virus found
VBA32 3.11.1 12.18.2006 no virus found
VirusBuster 4.3.19:9 12.17.2006 no virus found


Aditional Information
File size: 192000 bytes
MD5: 20a777c6addbf68a20740f82a1163fa6
SHA1: 9a87a72fcf79f381065eb431f94c9af7ae2f6787
packers: UPX

[harry_chang2003]

已上報給卡巴斯基,NOD32,BD


感覺最近大家發現的病毒卡巴斯基能找到的好少喔!
AntiVir比較多

[star000star]

檔案好像壞了，抓下來都解壓縮失敗。

[qqbeau]

Possible cause: file transfer error??????

换RAR试试

[star000star]

還是不行，因該是我個人的問題吧，不知道哪款防軟偷攔截了，懶得一個一個去查..。

[esjustin]

作者: harry_chang2003

已上報給卡巴斯基,NOD32,BD


感覺最近大家發現的病毒卡巴斯基能找到的好少喔!
AntiVir比較多

AntiVir通常都是報殼而已,不過這樣的確會增加偵測率...

[ㄚ一]

PCC用大陸的特徵碼也很會報殼

[proll]

和ITHOME掛的是一樣的，都是CSRSS.VBS-CSRSS.EXE