file.exe [md5:16c1995]

mofunzone

通杀，收工

File:	file.exe
Status:	OK
MD5:	16c19952eaf5d2fb117b03f1d697d8dd
Packers detected:	-
Bit9 reports:	File not found
Scanner results
Scan taken on 18 Apr 2008 01:13:14 (GMT)
A-Squared	Found  nothing
AntiVir	Found  nothing
ArcaVir	Found  nothing
Avast	Found  nothing
AVG Antivirus	Found  nothing
BitDefender	Found  nothing
ClamAV	Found  nothing
CPsecure	Found  nothing
Dr.Web	Found  nothing
F-Prot Antivirus	Found  nothing
F-Secure Anti-Virus	Found  nothing
Fortinet	Found  nothing
Ikarus	Found  nothing
Kaspersky Anti-Virus	Found  nothing
NOD32	Found  nothing
Norman Virus Control	Found  nothing
Panda Antivirus	Found  nothing
Sophos Antivirus	Found  nothing
VirusBuster	Found  nothing
VBA32	Found  nothing

郁冰兰雪

全都无视！

啊弥陀佛

微点砍掉

gaojun7206

C:\Program Files\Common Files\System\sys_vd4.dat

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C44Ad542-3B2E-ab42-32ba-a11651A36980}\
C:\Documents And Settings\Administrator\Local Settings\Temp\Nsl6.Tmp\NSISdl.dll
C:\Program Files\Common Files\System\tmp.back
访问网络www.dir4you.org   、UDP   192.168.203.2: 53    192.168.203.2: 137
C:\Program Files\Common Files\System\svchost.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\\Common Startup
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell

aerbeisi

[Found downloader]         <W32/Downldr2.BRKX (exact, not disinfectable)>        C:\test\file.rar->file.exe

sam.to

上报卡巴

挪威的冬天

金山 0

ranguangning

【1】进程：
   路径： F:\Users\ranguangning终极管理员帐户\Desktop\file.exe
   PID: 4028
网络信息：
   IP 地址： 193.111.244.21
   信任的区域： 否
   协议： TCP


【2】F:\Program Files\Common Files\System目录下生成svchost.exe   sys_vd4.dat   tmp.back
运行svchost.exe,动作同【1】

【3】F:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup下生成update.exe
运行update.exe,动作同【1】，只是多了两个tmp文件

天下无毒

还是微点强!

Nblock

微点发现未知后门程序