worm

a256886572008

2011-09-21 09:47:24   D:\cbro.exe   Sandboxed As   Partially Limited   

2011-09-21 09:47:30   D:\cbro.exe   Modify File   C:\Documents and Settings\Roger\Application Data\svhost.exe   

2011-09-21 09:47:30   D:\cbro.exe   Modify Key   HKUS\S-1-5-21-1004336348-1383384898-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Run\svhost.exe   

2011-09-21 09:47:30   D:\cbro.exe   Access Memory   C:\WINDOWS\explorer.exe   

dalianjhc1986

to eset  cbro

Thank you for your submission.
The detection for this threat will be included in our next signature update.

cbro.exe - Win32/AutoRun.Agent.ADC worm

Regards,

Kwasigroch Tomasz
Senior Malware Researcher
ESET spol. s r.o.

rasis

360 鉴定危险

文件信息
文件名称：D:\DOWNLOAD\cbro.7z
文件大小：
62 Kb
内部名称：
无内部名称
文件签名：
无文件签名信息
文件描述：
经鉴定是一个高风险文件
文件MD5：
f2e2b3fe6a7c11f7b859f6c9e14a4644

saga3721

对explorer或者VM进行应用程序窗口控制，企图修改explorer内存
运行红伞杀TR/Gendal.kdv.361130”[trojan]

郑伟用户

留侯

大蜘蛛clean，已上报！

mxf147

2011-09-21 10:29:16         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         发送消息, 可疑病毒         C:\Program Files\KSafe\KSafeTray.exe 
2011-09-21 10:29:22         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         发送消息         C:\Program Files\KSafe\KSafeTray.exe 
2011-09-21 10:29:22         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         修改文件, 可疑病毒         C:\Documents and Settings\Administrator\Local Settings\Temp\4dga1ls53f5617g60aag0365hdffar.tmp 
2011-09-21 10:29:27         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         创建进程, 可疑病毒         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe 
2011-09-21 10:29:31         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         修改文件, 可疑病毒         \Device\KsecDD 
2011-09-21 10:29:36         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         修改文件         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe 
2011-09-21 10:29:40         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         修改文件         \Device\NamedPipe\lsarpc 
2011-09-21 10:29:40         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData 
2011-09-21 10:29:42         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         修改文件         C:\Documents and Settings\Administrator\Application Data\svhost.exe 
2011-09-21 10:29:47         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Run\svhost.exe 
2011-09-21 10:29:48         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         修改文件         \Device\Tcp 
2011-09-21 10:29:54         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         修改文件         \Device\Ip 
2011-09-21 10:29:55         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         访问内存         C:\WINDOWS\explorer.exe 
2011-09-21 10:29:55         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         DNS/RPC 客户端访问         \RPC Control\DNSResolver 
2011-09-21 10:29:55         C:\WINDOWS\explorer.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\ShellNoRoam\BagMRU\NodeSlots 
2011-09-21 10:29:58         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         修改文件         \Device\NetBT_Tcpip_{47807F3E-07A0-40E9-AC73-DEBC8310EFB6} 
2011-09-21 10:30:01         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         DNS/RPC 客户端访问         \RPC Control\DNSResolver 
2011-09-21 10:30:02         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         修改文件         \Device\Afd\Endpoint 
2011-09-21 10:30:07         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         修改文件         \Device\Afd\Endpoint 
2011-09-21 10:30:08         C:\Documents and Settings\Administrator\桌面\Test\cbro.exe         修改文件         \Device\RasAcd 

qianyuqx

a2 miss

bbs2811125

Virus: Trojan.Generic.KD.361400 (Engine A)

Virus found while downloading content from the web.

Address: bbs.kafan.cn
Status:         Access denied.

wuyongliang

COMODO 和红伞都杀了 我就不试了