xerocodec1374.exe [md5:8696f]

mofunzone

File:	xerocodec1374.exe
Status:	INFECTED/MALWARE
MD5:	8696f45864f3f81d6203b864ee84e615
Packers detected:	-
Bit9 reports:	File not found
Scanner results
Scan taken on 17 Apr 2008 23:58:36 (GMT)
A-Squared	Found  nothing
AntiVir	Found DR/Dldr.DNSChanger.Gen
ArcaVir	Found  nothing
Avast	Found Win32:Trojan-gen {Other}
AVG Antivirus	Found DNSChanger.AA
BitDefender	Found Dropped:Trojan.DNSChanger.SB
ClamAV	Found Trojan.DNSChanger-3046
CPsecure	Found Troj.W32.DNSChanger.ab
Dr.Web	Found  nothing
F-Prot Antivirus	Found  nothing
F-Secure Anti-Virus	Found Trojan-Proxy.Win32.Agent.aab
Fortinet	Found  nothing
Ikarus	Found  nothing
Kaspersky Anti-Virus	Found Trojan-Proxy.Win32.Agent.aab
NOD32	Found  nothing
Norman Virus Control	Found Sandbox: W32/Malware;  [ General information ]         * Creating several executable files on hard-drive.     * File length:       235792 bytes. [ Changes to filesystem ]     * Creates directory C:\WINDOWS\TEMP\.     * Creates file C:\WINDOWS\TEMP\nsr8919.tmp.     * Deletes file C:\WINDOWS\TEMP\nsr8919.tmp.     * Creates file C:\WINDOWS\TEMP\nsx8819.tmp.     * Creates directory C:\WINDOWS.     * Creates directory C:\WINDOWS\TEMP.     * Creates file C:\WINDOWS\TEMP\notepad.exe.dat.     * Creates file C:\WINDOWS\TEMP\calc.exe.dat.     * Creates file C:\WINDOWS\TEMP\freebsd.exe.dat.     * Creates file C:\WINDOWS\TEMP\linux.     * Creates file C:\WINDOWS\TEMP\nsz8819.tmp.     * Deletes file C:\WINDOWS\TEMP\nsz8819.tmp.     * Creates directory C:\WINDOWS\TEMP\nsz8819.tmp.     * Creates file C:\WINDOWS\TEMP\nsz8819.tmp\DcryptDll.dll.     * Creates file C:\WINDOWS\TEMP\notepad.exe.     * Creates file C:\WINDOWS\TEMP\calc.exe.     * Creates file C:\WINDOWS\TEMP\freebsd.exe.     * Creates file C:\WINDOWS\TEMP\nsz8819.tmp\nsExec.dll.     * Creates file C:\WINDOWS\TEMP\nsz8819.tmp\ns8089.tmp. [ Changes to registry ]     * Accesses Registry key "HKCU\Software\VideoPorn".     * Accesses Registry key "HKLM\Software\Microsoft\Windows\CurrentVersion".     * Accesses Registry key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion".     * Accesses Registry key "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters". * Accesses Registry key"HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{047FC01A-7850-4432-B4B9-01C3D2714692}". * Accesses Registry key"HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{047FC01A-7850-4432-B4B9-01C3D2714692}". * Modifies value "NameServer"="85.255.115.61,85.255.112.113" in key"HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{047FC01A-7850-4432-B4B9-01C3D2714692}".
Panda Antivirus	Found  nothing
Sophos Antivirus	Found  nothing
VirusBuster	Found  nothing
VBA32	Found Downloader.Zlob.6, MalwareScope.Trojan.DnsChange.2, MalwareScope.Trojan.DnsChange.3 (probable variant)

天下无毒

红伞 拒绝下载！

挪威的冬天

金山 0

BING126

McAfee  MISS

电影结束了

xerocodec1374.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\xerocodec1374.rar
        Status: 已发现病毒
        病毒: Dropped:Trojan.DNSChanger.SB (BD 引擎)

微点卫士

木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.KAFAN\LOCAL SETTINGS\TEMP\NST7.TMP\DCRYPTDLL.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.KAFAN\LOCAL SETTINGS\TEMP\NST7.TMP\DCRYPTDLL.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.KAFAN\LOCAL SETTINGS\TEMP\NST7.TMP\DCRYPTDLL.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

tytyyyy

拒绝下载