avast 0/1

solcroft

很奇怪吗？
不少病毒无法在沙盘里执行的

sam.to

已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.fuv        檔案: C:\Documents and Settings\kato9096\桌面\FILM/FILM ADMIN.exe//PE_Patch

woai_jolin

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

FILM ADMIN.exe : INFECTED with W32/Malware (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: W32/Malware
    * Signature name: NO_VIRUS
    * Compressed: NO
    * TLS hooks: NO
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * File length:       473600 bytes.
    * MD5 hash: c3ff1c56dbc9e6af915750c97f5763ef.

[ Changes to registry ]
    * Accesses Registry key "HKCR\InternetExplorer.Application".
    * Accesses Registry key "HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}".

[ Process/window information ]
    * Creates process "C:\PROGRA~1\INTERN~1\IEXPLORE.EXE".
    * Modifies other process memory.
    * Creates a remote thread.
    * Creates an event called he0038FDBB.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

woai_jolin

2008/2/23 19:20:20        Kernel        File  'G:\v\FILM_ADMIN\u1.exe' was sent to ESET for analysis.

qigang

rising20.32.52挂！