帮忙翻译一下Norman的SandBox报告

SONGBOWEN

麻烦大家了，帮忙翻译一下吧，我E文不好，看不懂……


Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

&#26700 : INFECTED with W32/Downloader (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: W32/Downloader
    * Signature name: NO_VIRUS

[ General information ]
    * **Locates window "NULL [class Shell_TrayWnd]" on desktop.
    * Drops files in %WINSYS% folder.
    * File length:        98816 bytes.
    * MD5 hash: 14688f47dd8c1a26ce9217456a945b2c.

[ Changes to filesystem ]
    * Creates file C:\windows\system32\install.exe.
    * Creates file C:\WINDOWS\Autorun.inf.
    * Creates file C:\WINDOWS\SYSTEM32\interneter.exe.

[ Changes to registry ]
    * Modifies value "Start Page"="http://alalmn.3322.org" in key "HKCU\Software\Microsoft\Internet Explorer\Main".
    * Creates value "system"="interneter.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".

[ Network services ]
    * Downloads file from http://www.popo321.cn/0/vip.exe as c:\windows\system32\install.exe.
    * Connects to "www.popo321.cn" on port 80 (TCP).
    * Opens URL: www.popo321.cn/0/vip.exe.

[ Security issues ]
    * Starting downloaded file - potential security problem.

[ Process/window information ]
    * Creates an event called .
    * Modifies other process memory.
    * Creates a remote thread.
    * Will automatically restart after boot (I'll be back...).

[ Signature Scanning ]
    * C:\windows\system32\install.exe (4096 bytes) : no signature detection.
    * C:\WINDOWS\Autorun.inf (168 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

qiuchunyang

金山快译不更快，这么长

kasper

感谢向norman提交样本。顾客满意是我们最愿意做的事情。抱着这样的想法，我们开发了Sandbox Solutions 来加快样本分析和解决bug。

Norman Sandbox Solutions使你的机构有机会在自己的环境下迅速分析资料。

请点击以下链接获取相关信息

orman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer     分析
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro    分析（pro）
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter    报告
http://www.norman.com/Product/Sandbox-products/Reporter/


&#26700 : INFECTED with W32/Downloader (Signature: NO_VIRUS)
感染W32/Downloader（特征码：没有发现病毒）

侦测信息
* Sandbox name: W32/Downloader
    * Signature name: NO_VIRUS

大致信息
* **Locates window "NULL [class Shell_TrayWnd]" on desktop.
    * Drops files in %WINSYS% folder.
    * File length:        98816 bytes.
    * MD5 hash: 14688f47dd8c1a26ce9217456a945b2c.

对文件系统的更改
* Creates file C:\windows\system32\install.exe.
    * Creates file C:\WINDOWS\Autorun.inf.
    * Creates file C:\WINDOWS\SYSTEM32\interneter.exe.

对注册表的更改
* Modifies value "Start Page"="http://alalmn.3322.org" in key "HKCU\Software\Microsoft\Internet Explorer\Main".
    * Creates value "system"="interneter.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".

网络服务
* Downloads file from http://www.popo321.cn/0/vip.exe as c:\windows\system32\install.exe.
    * Connects to "www.popo321.cn" on port 80 (TCP).
    * Opens URL: www.popo321.cn/0/vip.exe.

安全事项
* Starting downloaded file - potential security problem.

进程/窗口信息
* Creates an event called .
    * Modifies other process memory.
    * Creates a remote thread.
    * Will automatically restart after boot (I'll be back...).

特征码扫描
* C:\windows\system32\install.exe (4096 bytes) : no signature detection.
    * C:\WINDOWS\Autorun.inf (168 bytes) : no signature detection.



************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

这应该是你的邮箱的提醒，不要回复陌生邮件。

自己翻译的~~~~~~~~~~~~·