boer 4C633F

Nblock

测测

微点卫士

费尔挂掉了


中文版微点:
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\BOER.EXE
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\BOER.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\E_4\KRNLN.FNR
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\E_4\IEXT.FNR
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\E_4\IEXT2.FNE
4) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\E_4\DP1.FNE
5) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\E_4\EXTMENU.FNE
6) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\E_4\EXMLRPC.FNE
7) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\E_4\ETHREAD.FNE
8) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\E_4\IEXT5.FNE
9) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\E_4\MP3.RUN
是否删除木马程序及其衍生物?

好多东西

woai_jolin

FSCS PASS

一派胡言

江民pass

jyxtay

AVAST!上报中

xxwpk007

卡巴 pass

woai_jolin

去sandbox看看

woai_jolin

BOER.EXE : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
   * Sandbox name: NO_MALWARE
   * Signature name: NO_VIRUS

[ General information ]
   * Decompressing UPX.
   * Creating several executable files on hard-drive.
   * File length:      2284092 bytes.
   * MD5 hash: 4c633f4465a59e14c1eb53fefecfebb1.

[ Changes to filesystem ]
   * Creates directory C:\WINDOWS\TEMP\E_00000004.
   * Creates file C:\WINDOWS\TEMP\E_00000004\krnln.fnr.
   * Creates file C:\WINDOWS\TEMP\E_00000004\iext.fnr.
   * Creates file C:\WINDOWS\TEMP\E_00000004\iext2.fne.
   * Creates file C:\WINDOWS\TEMP\E_00000004\dp1.fne.
   * Creates file C:\WINDOWS\TEMP\E_00000004\ExtMenu.fne.
   * Creates file C:\WINDOWS\TEMP\E_00000004\Exmlrpc.fne.
   * Creates file C:\WINDOWS\TEMP\E_00000004\EThread.fne.
   * Creates file C:\WINDOWS\TEMP\E_00000004\iext5.fne.
   * Creates file C:\WINDOWS\TEMP\E_00000004\mp3.run.
   * Creates directory \boersoft.

[ Changes to system settings ]
   * Creates WindowsHook monitoring cbt activity.

[ Process/window information ]
   * Creates an event called Wait For Buffer Return.

[ Signature Scanning ]
   * C:\WINDOWS\TEMP\E_00000004\krnln.fnr (415744 bytes) : no signature detection.
   * C:\WINDOWS\TEMP\E_00000004\iext.fnr (81920 bytes) : no signature detection.
   * C:\WINDOWS\TEMP\E_00000004\iext2.fne (112640 bytes) : no signature detection.
   * C:\WINDOWS\TEMP\E_00000004\dp1.fne (57344 bytes) : no signature detection.
   * C:\WINDOWS\TEMP\E_00000004\ExtMenu.fne (89088 bytes) : no signature detection.
   * C:\WINDOWS\TEMP\E_00000004\Exmlrpc.fne (34816 bytes) : no signature detection.
   * C:\WINDOWS\TEMP\E_00000004\EThread.fne (16384 bytes) : no signature detection.
   * C:\WINDOWS\TEMP\E_00000004\iext5.fne (130560 bytes) : no signature detection.
   * C:\WINDOWS\TEMP\E_00000004\mp3.run (200704 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.

promised

micropoint应该把E语言放在白名单里

nod pass