威力强大，高质量！！！

释然的心

双击

360技师

蓝天二号 发表于 2012-4-10 21:06 连360隔离沙箱都进不了。。

没发现这玩意儿反沙箱啊?

蝉鸣时

Clean.

蓝天二号

360技师 发表于 2012-4-10 21:08
没发现这玩意儿反沙箱啊?

手动在沙箱中运行指定文件都不行。。

tgzw1680

实机表示双击没动作

360技师

那你试其他的沙箱?

jack827

实机表示双击没动作+1

留侯

大蜘蛛Clean

lbb9432

Norton miss

留侯

原帖那个copy.exe文件有问题，大蜘蛛：
copy.exe infected by Trojan.Virtumod.10622

大蜘蛛对此病毒的定义是：
Trojan.Virtumod.10622
Virus description was added:        2011-11-07
Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
[<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{0E0LD2F2-61XB-4R11-E5OR-LB6N62D18F27}] 'StubPath' = ''
Malicious functions:
Executes the following:
%WINDIR%\explorer.exe
<SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\1234567890[1].functions
%APPDATA%\Microsoft\Windows\_RxyVE.xtr
%APPDATA%\Microsoft\Windows\_RxyVE.dat
%APPDATA%\Microsoft\Windows\_RxyVE.cfg
<SYSTEM32>\run32.exe
Sets the 'hidden' attribute to the following files:
%APPDATA%\Microsoft\Windows\_RxyVE.dat
%APPDATA%\Microsoft\Windows\_RxyVE.cfg
Deletes itself.
Network activity:
Connects to:
'1w#.#yndns.tv':80
'localhost':1035
TCP:
HTTP GET requests:
1w#.#yndns.tv/1234567890.functions
UDP:
DNS ASK 1w#.#yndns.tv
'<Private IP address>':1036
Miscellaneous:
Searches for the following windows:
ClassName: 'Shell_TrayWnd' WindowName: ''

详见：http://vms.drweb.com/virus/?i=1576784

从里面可见注入：
%WINDIR%\explorer.exe
<SYSTEM32>\svchost.exe
个人偏向于svchost.exe，也就是本样本是无毒的，只是被注入而已。