xerocodec4049.exe [md5:9af99f2]

mofunzone

File:	xerocodec4049.exe
Status:	INFECTED/MALWARE
MD5:	9af99f2fc00ee147b07d55b159269d71
Packers detected:	-
Bit9 reports:	File not found
Scanner results
Scan taken on 17 Apr 2008 23:28:57 (GMT)
A-Squared	Found  nothing
AntiVir	Found DR/Dldr.DNSChanger.Gen
ArcaVir	Found  nothing
Avast	Found Win32:Trojan-gen {Other}
AVG Antivirus	Found DNSChanger.AA
BitDefender	Found Dropped:Trojan.Downloader.Zlob.ABOU
ClamAV	Found  nothing
CPsecure	Found  nothing
Dr.Web	Found  nothing
F-Prot Antivirus	Found  nothing
F-Secure Anti-Virus	Found Trojan.Win32.DNSChanger.arn
Fortinet	Found  nothing
Ikarus	Found  nothing
Kaspersky Anti-Virus	Found Trojan.Win32.DNSChanger.arn
NOD32	Found  nothing
Norman Virus Control	Found Sandbox: W32/Malware;  [ General information ]         * Creating several executable files on hard-drive.     * File length:       235511 bytes. [ Changes to filesystem ]     * Creates directory C:\WINDOWS\TEMP\.     * Creates file C:\WINDOWS\TEMP\nsr8919.tmp.     * Deletes file C:\WINDOWS\TEMP\nsr8919.tmp.     * Creates file C:\WINDOWS\TEMP\nsx0819.tmp.     * Creates directory C:\WINDOWS.     * Creates directory C:\WINDOWS\TEMP.     * Creates file C:\WINDOWS\TEMP\notepad.exe.dat.     * Creates file C:\WINDOWS\TEMP\calc.exe.dat.     * Creates file C:\WINDOWS\TEMP\freebsd.exe.dat.     * Creates file C:\WINDOWS\TEMP\linux.     * Creates file C:\WINDOWS\TEMP\nsz8819.tmp.     * Deletes file C:\WINDOWS\TEMP\nsz8819.tmp.     * Creates directory C:\WINDOWS\TEMP\nsz8819.tmp.     * Creates file C:\WINDOWS\TEMP\nsz8819.tmp\dcryptdll.dll.     * Creates file C:\WINDOWS\TEMP\notepad.exe.     * Creates file C:\WINDOWS\TEMP\calc.exe.     * Creates file C:\WINDOWS\TEMP\freebsd.exe.     * Creates file C:\WINDOWS\TEMP\nsz8819.tmp\nsExec.dll.     * Creates file C:\WINDOWS\TEMP\nsz8819.tmp\ns8089.tmp. [ Changes to registry ]     * Accesses Registry key "HKCU\Software\VideoKey".     * Accesses Registry key "HKLM\Software\Microsoft\Windows\CurrentVersion".     * Accesses Registry key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion".     * Accesses Registry key "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters". * Accesses Registry key"HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{047FC01A-7850-4432-B4B9-01C3D2714692}". * Accesses Registry key"HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{047FC01A-7850-4432-B4B9-01C3D2714692}". * Modifies value "NameServer"="85.255.115.61,85.255.112.113" in key"HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{047FC01A-7850-4432-B4B9-01C3D2714692}".
Panda Antivirus	Found  nothing
Sophos Antivirus	Found  nothing
VirusBuster	Found  nothing
VBA32	Found Downloader.Zlob.6, MalwareScope.Trojan.DnsChange.2, MalwareScope.Trojan.DnsChange.3 (probable variant)

aerbeisi

[Found Trojan]         <W32/Trojan2.AIES (exact, not disinfectable)>        C:\test\xerocodec4049.rar->xerocodec4049.exe

挪威的冬天

金山 0

allinwonderi

TO AB

ballakay

Scanning Report
18 April 2008 13:33:37 - 13:33:39
Computer name: PUMA-PC
Scanning type: Scan target
Target: C:\Users\Administrator\Desktop\xerocodec4049.rar


--------------------------------------------------------------------------------

Result: 1 malware found
Trojan.Win32.DNSChanger.arn (virus)
C:\Users\Administrator\Desktop\xerocodec4049.rar\xerocodec4049.exe




--------------------------------------------------------------------------------

Statistics
Scanned:
Files: 2
Not scanned: 0
Result:
Viruses: 1
Spyware: 0
Suspicious items: 0
Riskware: 0
Actions:
Disinfected: 0
Renamed: 0
Deleted: 0
Quarantined: 0
Failed: 0
Boot Sectors:
Scanned: 0
Infected: 0
Suspicious items: 0
Disinfected: 0


--------------------------------------------------------------------------------

Options
Definitions version:
Viruses: 2008-04-18_01
Spyware: 2008-04-18_01
Scanning Engines:
F-Secure AVP: 7.00.171, 2008-04-18
F-Secure Libra: 2.04.04, 2008-04-15
F-Secure Orion: 1.02.38, 2008-04-18
F-Secure Draco: 1.00.35, 2008-04-02
Scanning options:
Scan all files
Scan inside archives
Actions:
Viruses: Quarantine and delete
Spyware: Quarantine and delete

Nblock

微点发现未知木马，是否删除？

程序:
E:\XEROCODEC4049.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NSU13.TMP\DCRYPTDLL.DLL
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\CALC.EXE
3) C:\WINDOWS\SYSTEM32\KDLSV.EXE
4) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NSU13.TMP\NSEXEC.DLL
是否删除木马程序及其衍生物?

BING126

McAfee  MISS