6a5xkofesn.exe [md5:02708]

mofunzone

File:	6a5xkofesn.exe
Status:	INFECTED/MALWARE
MD5:	02708814235e2069da57e5466ba5b13e
Packers detected:	PE_PATCH
Bit9 reports:
Scanner results
Scan taken on 09 May 2008 20:01:15 (GMT)
A-Squared	Found  nothing
AntiVir	Found  nothing
ArcaVir	Found  nothing
Avast	Found  nothing
AVG Antivirus	Found Downloader.Zlob
BitDefender	Found  nothing
ClamAV	Found Trojan.Dropper-4103
CPsecure	Found Troj.Dropper.W32.Small.auj
Dr.Web	Found  nothing
F-Prot Antivirus	Found  nothing
F-Secure Anti-Virus	Found  nothing
Fortinet	Found  nothing
Ikarus	Found  nothing
Kaspersky Anti-Virus	Found  nothing
NOD32	Found  nothing
Norman Virus Control	Found  nothing
Panda Antivirus	Found  nothing
Sophos Antivirus	Found  nothing
VirusBuster	Found  nothing
VBA32	Found  nothing

ldy144028

卡巴斯基8.0 飘了

醉一生爱妍

--------------------------------------------------
***** Installing Hooks *****       
71a270df     RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\WinSock2\Parameters)       
71a27cc4     RegOpenKeyExA (Protocol_Catalog9)       
71a2737e     RegOpenKeyExA (0000000E)       
71a2724d     RegOpenKeyExA (Catalog_Entries)       
71a278ea     RegOpenKeyExA (000000000001)       
71a278ea     RegOpenKeyExA (000000000002)       
71a278ea     RegOpenKeyExA (000000000003)       
71a278ea     RegOpenKeyExA (000000000004)       
71a278ea     RegOpenKeyExA (000000000005)       
71a278ea     RegOpenKeyExA (000000000006)       
71a278ea     RegOpenKeyExA (000000000007)       
71a278ea     RegOpenKeyExA (000000000008)       
71a278ea     RegOpenKeyExA (000000000009)       
71a278ea     RegOpenKeyExA (000000000010)       
71a278ea     RegOpenKeyExA (000000000011)       
71a278ea     RegOpenKeyExA (000000000012)       
71a278ea     RegOpenKeyExA (000000000013)       
71a278ea     RegOpenKeyExA (000000000014)       
71a278ea     RegOpenKeyExA (000000000015)       
71a278ea     RegOpenKeyExA (000000000016)       
71a278ea     RegOpenKeyExA (000000000017)       
71a278ea     RegOpenKeyExA (000000000018)       
71a278ea     RegOpenKeyExA (000000000019)       
71a278ea     RegOpenKeyExA (000000000020)       
71a278ea     RegOpenKeyExA (000000000021)       
71a278ea     RegOpenKeyExA (000000000022)       
71a22623     WaitForSingleObject(794,0)       
71a283c6     RegOpenKeyExA (NameSpace_Catalog5)       
71a2737e     RegOpenKeyExA (00000005)       
71a27f5b     RegOpenKeyExA (Catalog_Entries)       
71a280ef     RegOpenKeyExA (000000000001)       
71a280ef     RegOpenKeyExA (000000000002)       
71a280ef     RegOpenKeyExA (000000000003)       
71a280ef     RegOpenKeyExA (000000000004)       
71a22623     WaitForSingleObject(78c,0)       
71a11afa     RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\Winsock2\Parameters)       
71a11996     GlobalAlloc()       
7c80b689     ExitThread()       
76b13e82     GlobalAlloc()       
76b2aa65     LoadLibraryA(C:\WINDOWS\system32\WINMM.dll)=76b10000       
7c810655     CreateRemoteThread(h=ffffffff, start=76b2aee7)       
5addef89     GetCurrentProcessId()=2908       
66037948     LoadLibraryA(UXTHEME.DLL)=5adc0000       
66037994     GetCurrentProcessId()=2908       
762f1140     GetVersionExA()       
66037ad4     LoadLibraryA(msimg32.dll)=762f0000       
660025d4     RegOpenKeyA (HKCU\SOFTWARE\Stardock\WindowBlinds\WB5.ini\Installed)       
77dcc449     RegOpenKeyExA (HKCU\SOFTWARE\Stardock\WindowBlinds\WB5.ini\Installed)       
666046f2     GetCommandLineA()       
66036dea     LoadLibraryA(G:\WindowBlinds\wbhelp.dll)=66600000       
660025d4     RegOpenKeyA (HKCU\SOFTWARE\Stardock\WindowBlinds\WB5.ini\WBLiteFX)       
77dcc449     RegOpenKeyExA (HKCU\SOFTWARE\Stardock\WindowBlinds\WB5.ini\WBLiteFX)       
66002675     RegOpenKeyA (HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers)       
77dcc449     RegOpenKeyExA (HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers)       
66048ed5     GlobalAlloc()       
66048ee8     GlobalAlloc()       
6605d5be     GetCurrentProcessId()=2908       
7c864b5c     GetCurrentProcessId()=2908       
6602c8f0     ReadProcessMemory(h=ffffffff)       
6602c93a     WriteProcessMemory(h=ffffffff,len=5)       
66035a73     GetCurrentProcessId()=2908       
66035ff7     IsDebuggerPresent()       
6605c305     WriteProcessMemory(h=ffffffff,len=4)       
746826aa     GetVersionExA()       
746830a7     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\Compatibility\6a5xkofesn.exe)       
746830a7     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\SystemShared\)       
7468245b     CreateMutex(CTF.LBES.MutexDefaultS-1-5-21-2236563931-3507974323-2169162241-500)       
7468245b     CreateMutex(CTF.Compart.MutexDefaultS-1-5-21-2236563931-3507974323-2169162241-500)       
7468245b     CreateMutex(CTF.Asm.MutexDefaultS-1-5-21-2236563931-3507974323-2169162241-500)       
7468245b     CreateMutex(CTF.Layouts.MutexDefaultS-1-5-21-2236563931-3507974323-2169162241-500)       
7468245b     CreateMutex(CTF.TMD.MutexDefaultS-1-5-21-2236563931-3507974323-2169162241-500)       
746830a7     RegOpenKeyExA (HKCU\Keyboard Layout\Toggle)       
7468260a     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\)       
74684683     GetCurrentProcessId()=2908       
7468245b     CreateMutex(CTF.TimListCache.FMPDefaultS-1-5-21-2236563931-3507974323-2169162241-500MUTEX.DefaultS-1-5-21-2236563931-3507974323-2169162241-500)       
7469d232     WaitForSingleObject(74c,1388)       
746b556a     GetCurrentProcessId()=2908       
76751238     GetCurrentProcessId()=2908       
66034c9f     LoadLibraryA(SHFOLDER)=76750000       
66034c9f     LoadLibraryA(ole32.dll)=76990000       
77f469fd     WaitForSingleObject(744,0)       
77f58b88     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\6a5xkofesn.exe)       
77f487f7     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{20D04FE0-3AEA-1069-A2D8-08002B30309D})       
77f4896f     RegOpenKeyExA (HKCR\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32)       
66034c9f     LoadLibraryA(SETUPAPI.dll)=76060000       
66034c9f     LoadLibraryA(SHELL32.dll)=7d590000       
77f469fd     WaitForSingleObject(714,0)       
403299     GetCommandLineA()       
405746     CreateFileA(C:\Documents and Settings\Administrator\桌面\6a5xkofesn\6a5xkofesn.exe)       
4031c5     ReadFile()       
40343c     ExitProcess()       
74681d36     GetCurrentProcessId()=2908       
74682056     GetCurrentProcessId()=2908       
6605c153     WriteProcessMemory(h=ffffffff,len=4)       
6602c846     WriteProcessMemory(h=ffffffff,len=5)       
***** Injected Process Terminated *****

sxingbai

楼上用的什么
好像没什么动作呀
误报？

傻猪猪米走鸡

ms有自启动和执行挂钩……

sam.to

7.0.0.125不报,已上报

allinwonderi

TO ArcaVir ,Frisk ,Grisoft, Vccn

qigang

RS20.43.52未杀！

BING126

McAfee  MISS

liuying001

貌似没有什么作为???