还是网马

solcroft

http://documentu.info/system32.exe

The EQs

A-Squared	Found nothing
AntiVir	Found nothing
ArcaVir	Found nothing
Avast	Found Win32:LdPinch-AQU
AVG Antivirus	Found nothing
BitDefender	Found nothing
ClamAV	Found nothing
CPsecure	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found nothing
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
Sophos Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

solcroft

所以才故意贴上老鹰的报告

绅博周幸

Thank you for your submission. Below you can see the current status of the uploaded files.


--------------------------------------------------------------------------------


We received the following archive files:



File ID  Filename  Size (Byte) Result
1315960  system32.zip 36.17 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename  Size (Byte) Result
1315693  system32.exe  45.5 KB  UNDER ANALYSIS


Please find a detailed report concerning each individual sample below:

Filename Result
system32.exe  UNDER ANALYSIS

The file 'system32.exe' has been determined to be 'UNDER ANALYSIS'.


--------------------------------------------------------------------------------
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

1688388728

运行后自动隐藏自身.
并要求联网.
描述：
system32.exe

连接：
方向：        出站
协议：                        TCP
远程IP地址：mail.rambler.ru (81.19.66.20)
远程端口：                25
本地端口：                3441

进程信息：
进程名：                system32.exe
进程 ID：                236
程序文件：                D:\病毒库\system32\system32.exe
命令行：               

制造商信息：
制造商：                <unknown>
程序版本：<unknown>
文件版本：                <unknown>




2007-09-21 12:01:24    修改文件      操作:阻止
进程路径:D:\病毒库\system32\system32.exe
文件路径:C:\Documents and Settings\Administrator\Cookies\index.dat
触发规则:黑名单->文件保护->?:\*

king6808

还是没反应

Nblock

微点发现未知邮件蠕虫

danielchen

我的小a没反应。。

浪滔天

卡巴 125

已检测到: 木马程序 Trojan-PSW.Win32.LdPinch.cuy        URL: http://bbs.kafan.cn/attachment.php?aid=130200//system32.exe

[ 本帖最后由 浪滔天 于 2007-9-22 15:29 编辑 ]