Win32/TrojanDownloader.Delf.BNS

230f4

wjy19800315 发表于 2015-11-18 18:13
密码怎么还要pm啊

除了赛门铁克，其他都入库了

不然我就重开一个帖子了

aboringman

230f4 发表于 2015-11-18 18:05
给你只新的Zbot，赛门铁克应该没入库，密码见PM，试试看吧

NS：

扫描：miss

双击：等了一会，SONAR击杀之

SONAR.Heuristic.120

Filename: polysyllabic.exe
Threat name: SONAR.Heuristic.120
Full Path: Not Available

____________________________

____________________________


On computers as of 
2015-11-18 at 19:00:36

Last Used 
2015-11-18 at 19:00:36

Startup Item 
No

Launched 
Yes

SONAR Protection monitors for suspicious program activity on your computer.


____________________________


polysyllabic.exe Threat name: SONAR.Heuristic.120
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.


____________________________


Source: External Media

Source File:
explorer.exe

File Created:
wrar521sc.exe

File Created:
winrar.exe

File Created:
polysyllabic.exe

____________________________

File Actions

File: c:\documents and settings\administrator\桌面\ polysyllabic.exe Threat Removed
Event: Running process: c:\documents and settings\administrator\桌面\ polysyllabic.exe Terminated
____________________________

System Settings Actions

Event: Process start (Performed by c:\documents and settings\administrator\桌面\polysyllabic.exe, PID:2828) No action taken
(Performed by c:\documents and settings\administrator\桌面\polysyllabic.exe, PID:2828) No action taken
Event: Process start: c:\documents and settings\administrator\桌面\ polysyllabic.exe, PID:4328 (Performed by c:\documents and settings\administrator\桌面\polysyllabic.exe, PID:2828) No action taken
Event: Process start: c:\documents and settings\administrator\桌面\ polysyllabic.exe, PID:2828 (Performed by c:\documents and settings\administrator\桌面\polysyllabic.exe, PID:2828) No action taken
____________________________

Suspicious Actions

Event: Attempt to start a remote thread in a process address space (Performed by c:\documents and settings\administrator\桌面\polysyllabic.exe, PID:2828) No action taken
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

230f4

aboringman 发表于 2015-11-18 19:07
NS：

扫描：miss

很给力

230f4

The analysis of the file / website has been completed:

The file is infected and should be detected as Trojan.Downloader.JSKG with the next update.

File trojandownloader_exe[cf3d1a2951354eb20af49d1d56160f3b] declared INFECTED

Please do not hesitate to contact us should you have any other inquiries in the future.

Have a great day.

Best regards,
Cristina POTERASU
Bitdefender Partner Technical

上报后入库