新门

moonsilver

文件: C:\Documents and Settings\moonsilver\桌面\NSGQ\server.exe
大小: 166400 字节
修改时间: 2007年10月4日, 09:14:33
MD5: 2DC24EAFE1254FCF82D53ADC3FEA8C6E
SHA1: EEB2E7FA0C1747DE647F886337817DB6E7C04A90
CRC32: 2C05EB1A

The EQs

Scan performed at: 2007-10-4 9:17:50
Scanning Log
NOD32 version 2570 (20071003) NT
Command line: C:\Documents and Settings\Don johnson\桌面\server.rar
Operating memory - is OK

Date: 4.10.2007  Time: 09:17:53
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\server.rar
C:\Documents and Settings\Don johnson\桌面\server.rar ?RAR ?server.exe - probably a variant of Win32/Genetik trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 09:17:54 Total scanning time: 1 sec (00:00:01)

lvjie

微点
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.625\SERVER.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ALL USERS\FAVORITES\NETSERVICE.EXE
是否删除木马程序及其衍生物?

Giggs

Start of the scan: 2007年10月4日  09:21

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\server.rar'
C:\Documents and Settings\Administrator\桌面\server.rar
  [0] Archive type: RAR
  --> server.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      A backup was created as '4776406d.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

jehovah_king

kav7启发报

kkgh

瑞星08主动防御干掉

woai_jolin

server.exe : Not detected by Sandbox (Signature: NO_VIRUS)



[ DetectionInfo ]
   * Sandbox name: NO_MALWARE
   * Signature name: NO_VIRUS

   * Compressed: NO

[ General information ]
   * File length:       166400 bytes.
   * MD5 hash: 2dc24eafe1254fcf82d53adc3fea8c6e.




(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

F-Secure

过咖啡

micetai

antibot拦截

king6808

已删除：木马程序 Trojan.Win32.Delf.ahg        文件: F:\10.4\server.rar/server.exe