[MD5: C5C969] 看有什么动作

红心王子

微点卫士

金山报一个,费尔报灰鸽子

微点:
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\身份证生成.EXE
木马程序生成以下文件:
是否删除木马程序及其衍生物?

woai_jolin

等待sandbox

woai_jolin

COOL惨了
&#36523 : INFECTED with W32/Downloader (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: W32/Downloader
    * Signature name: NO_VIRUS

[ General information ]
    * Creating several executable files on hard-drive.
    * **Locates window "Windows Security Center [class NULL]" on
desktop.
    * **Locates window "NULL [class NOD32KrnSvcWndClass]" on desktop.
    * **Locates window "Symantec AntiVirus ###### [class NULL]" on
desktop.
    * **Locates window "Symantec AntiVirus [class LANDeskVPC32]" on
desktop.
    * **Locates window "NULL [class TfLockDownMain]" on desktop.
    * **Locates window "ZoneAlarm [class ZAFrameWnd]" on desktop.
    * **Locates window "################ [class Tapplication]" on
desktop.
    * **Locates window "#################### [class #32770]" on
desktop.
    * **Locates window "NULL [class TFireWall_Form]" on desktop.
    * **Locates window "NULL [class Q360SafeMainClass]" on desktop.
    * **Locates window "NULL [class TForm1]" on desktop.
    * Drops files in %WINSYS% folder.
    * File length:       697614 bytes.
    * MD5 hash: c5c969aaa77bbea606bc68db90d8abf6.

[ Changes to filesystem ]
    * Creates directory C:.
    * Creates directory C:\WINDOWS.
    * Creates directory C:\WINDOWS\TEMP.
    * Creates file C:\WINDOWS\TEMP\OPE8999.tmp.
    * Deletes file C:\WINDOWS\TEMP\OPE8999.tmp.
    * Creates file C:\WINDOWS\TEMP\##########.exe.
    * Creates file C:\WINDOWS\TEMP\####3.exe.
    * Creates file C:\WINDOWS\SYSTEM32\DirectX9.dll.
    * Creates directory C:\Program Files\Internet Explorer\PLUGINS.
    * Creates file C:\Program Files\Internet
Explorer\PLUGINS\841479.exe.

[ Network services ]
    * Downloads file from http://qqgood.dns0755.net/down/1.exe as
C:\Program Files\Internet Explorer\PLUGINS\841479.exe.
    * Connects to "qqgood.dns0755.net" on port 80 (TCP).
    * Opens URL: qqgood.dns0755.net/down/1.exe.

[ Security issues ]
    * Starting downloaded file - potential security problem.

[ Process/window information ]
    * Attemps to OPEN C:\WINDOWS\TEMP\##########.exe C:\WINDOWS\TEMP\.
    * Attemps to OPEN C:\WINDOWS\TEMP\####3.exe C:\WINDOWS\TEMP\.
    * Creates a mutex %$#&**(%$#))(*&^%@#.
    * Enumerates running processes.
    * Enumerates running processes several parses....
    * Modifies other process memory.
    * Creates a remote thread.
    * Attemps to Open C:\Program Files\Internet
Explorer\PLUGINS\841479.exe NULL.

[ Signature Scanning ]
    * C:\WINDOWS\SYSTEM32\DirectX9.dll (12288 bytes) : no signature
detection.
    * C:\Program Files\Internet Explorer\PLUGINS\841479.exe (4096
bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information
source only.

kristen2

Archive type: RAR
  --> Éí·ÝÖ¤Éú³É.exe
      [DETECTION] Is the Trojan horse TR/PSW.LdPinch.jm1

woai_jolin

这是一个下载者
ess pass
下载的东西kill

l784588

avast报Win32:Joiner-H [Trj]

tracydk

下载者??

hj5abc

只是干掉了下载的东西..太玄了



[ 本帖最后由 hj5abc 于 2007-7-27 20:49 编辑 ]

woai_jolin

这就是个下载者
还有个人抓得比我还多几个
具体可以看看sandbox的分析