这是什么东东【F6672B】

微点卫士

微点也没反应,是病毒么?

scottxzt

2007-07-14 16:47:13        运行应用程序     操作:允许
进程路径:D:\Documents and Settings\dell\Local Settings\Temp\Rar$EX20.209\runwin.exe
文件路径:D:\Documents and Settings\dell\Local Settings\Temp\nsvBB.tmp\nsBC.tmp
命令行:D:\windows\

tracydk

红伞挂了,上报

woai_jolin

norman的sandbox扫描报告
runwin.exe : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: NO_VIRUS

[ General information ]
    * Creating several executable files on hard-drive.
    * **Locates window "NULL [class #32770]" on desktop.
    * **Locates window "NULL [class SysListView32]" on desktop.
    * File length:        38930 bytes.
    * MD5 hash: f6672b481dfcf38b8655bac6429f68d6.

[ Changes to filesystem ]
    * Creates directory C:\WINDOWS\TEMP.
    * Creates file C:\WINDOWS\TEMP\nsx8999.tmp.
    * Deletes file C:\WINDOWS\TEMP\nsx8999.tmp.
    * Creates file C:\WINDOWS\TEMP\nsy0199.tmp.
    * Deletes file C:\WINDOWS\TEMP\nsy0199.tmp.
    * Creates directory C:\WINDOWS.
    * Creates directory C:\WINDOWS\TEMP\nsy0199.tmp.
    * Creates file C:\WINDOWS\TEMP\nsy0199.tmp\nsExec.dll.
    * Creates file C:\WINDOWS\TEMP\nsy0199.tmp\ns0989.tmp.
    * Deletes file C:\WINDOWS\TEMP\nsy0199.tmp\ns0989.tmp.
    * Deletes file C:\WINDOWS\TEMP\nsy0199.tmp\NSEXEC.DLL.
    * Deletes directory C:\WINDOWS\TEMP\nsy0199.tmp\.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information
source only.

This file is not flagged as malicious by the Norman Sandbox Information
Center. However, we can not guarantee that the file is harmless. If
you still suspect the file to be malicious and if you urgently need to
know for sure, please submit it to your local Norman support department
for manual analysis.

Cloud018

AntivirusVersionLast UpdateResultAhnLab-V32007.7.14.02007.07.14no virus foundAntiVir7.4.0.392007.07.13no virus foundAuthentium4.93.82007.07.13no virus foundAvast4.7.997.02007.07.13Win32:Trojan-gen. {Other}AVG7.5.0.4762007.07.13no virus foundBitDefender7.22007.07.14no virus foundCAT-QuickHeal9.002007.07.14no virus foundClamAVdevel-200704162007.07.14no virus foundDrWeb4.332007.07.14no virus foundeSafe7.0.15.02007.07.10no virus foundeTrust-Vet30.8.37842007.07.14no virus foundEwido4.02007.07.14no virus foundFileAdvisor12007.07.14no virus foundFortinet2.91.0.02007.07.14no virus foundF-Prot4.3.2.482007.07.13no virus foundIkarusT3.1.1.82007.07.14Trojan-DownloaderKaspersky4.0.2.242007.07.14no virus foundMcAfee50742007.07.13no virus foundMicrosoft1.27042007.07.14no virus foundNOD32v223992007.07.14no virus foundNorman5.80.022007.07.13no virus foundPanda9.0.0.42007.07.13Suspicious fileSophos4.19.02007.07.06no virus foundSunbelt2.2.907.02007.07.14no virus foundSymantec102007.07.14no virus foundTheHacker6.1.6.1462007.07.13no virus foundVBA323.12.0.22007.07.13no virus foundVirusBuster4.3.23:92007.07.13no virus foundWebwasher-Gateway6.0.12007.07.14no virus foundAditional informationFile size: 38930 bytesMD5: f6672b481dfcf38b8655bac6429f68d6SHA1: 68f158a427cfaeca6d9671acd147c80749297515packers: BINARYRES

hj5abc

This file is not flagged as malicious by the Norman Sandbox

红心王子

确实有点意思，上报。。。

野马

似乎没长腿啊！

solcroft

woai_jolin

norman的sandbox已经说得很清楚了