explorer32.exe [md5:ed6471]

mofunzone

File:	explorer32.exe
Status:	INFECTED/MALWARE
MD5:	ed6471bd4ba80c2e84054258a7275cfc
Packers detected:	UPX
Bit9 reports:	File not found
Scanner results
Scan taken on 23 Apr 2008 22:21:10 (GMT)
A-Squared	Found  nothing
AntiVir	Found TR/Crypt.XPACK.Gen
ArcaVir	Found  nothing
Avast	Found  nothing
AVG Antivirus	Found  nothing
BitDefender	Found  nothing
ClamAV	Found  nothing
CPsecure	Found  nothing
Dr.Web	Found  nothing
F-Prot Antivirus	Found  nothing
F-Secure Anti-Virus	Found  nothing
Fortinet	Found  nothing
Ikarus	Found  nothing
Kaspersky Anti-Virus	Found  nothing
NOD32	Found probably a variant of Win32/TrojanDownloader.FakeAlert.BP (probable variant)
Norman Virus Control	Found  nothing
Panda Antivirus	Found  nothing
Sophos Antivirus	Found Mal/EncPk-DG
VirusBuster	Found  nothing
VBA32	Found  nothing

挪威的冬天

金山 0

这是啥 鸽子?

我还以为下载器来的

[ 本帖最后由 挪威的冬天 于 2008-4-24 07:23 编辑 ]

change_018

KIS pass

郁冰兰雪

EAV
D:\病毒样本\explorer32.rar > RAR > explorer32.exe - 可能是 Win32/TrojanDownloader.FakeAlert.BP 特洛伊木马 的变种

hyxuzhimin

奇怪 红伞的Webguard没拦截，但是手动扫描报警...

csjhy

kis8.0.0.348没检测出来。。。。

scottxzt

2008-04-24 15:18:31        文件保护(创建文件)     操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\explorer32.exe
文件路径:C:\Documents and Settings\All Users\Application Data\diluforu\nifkfenq.exe

2008-04-24 15:18:31        注册表保护(创建注册表值)     操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\explorer32.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
注册表名称:[Key]
2008-04-24 15:18:31        注册表保护(创建注册表值)     操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\explorer32.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
注册表名称:6hq11Px3C3

sun88990

McAfee found nothing

Nblock

微点发现未知间谍
协议类型:TCP
本地地址:0.0.0.0
本地端口:1339
远端地址:63.219.178.162(美国)
远端端口:80

Palkia

to kl