codecdemo4049.exe [md5:eb48479]

mofunzone

File:	codecdemo4049.exe
Status:	INFECTED/MALWARE
MD5:	eb484791b1a7ec761ce608c1b333583e
Packers detected:	-
Scanner results
Scan taken on 17 May 2008 00:10:41 (GMT)
A-Squared	Found  nothing
AntiVir	Found DR/Dldr.DNSChanger.Gen
ArcaVir	Found  nothing
Avast	Found  nothing
AVG Antivirus	Found DNSChanger.AE
BitDefender	Found Trojan.DNSChanger.SU, Trojan.DNSChanger.SR (probable variant)
ClamAV	Found Trojan.Dropper-6806
CPsecure	Found  nothing
Dr.Web	Found  nothing
F-Prot Antivirus	Found W32/DNSChanger.BA
F-Secure Anti-Virus	Found Trojan.Win32.DNSChanger.clm
Fortinet	Found  nothing
Ikarus	Found Virus.Trojan.Win32.DNSChanger.chg
Kaspersky Anti-Virus	Found Trojan.Win32.DNSChanger.clm
NOD32	Found  nothing
Norman Virus Control	Found Sandbox: Vundo.gen171.dropper;  [ General information ]         * Creating several executable files on hard-drive.     * File length:       234959 bytes. [ Changes to filesystem ]     * Creates directory C:\WINDOWS\TEMP\.     * Creates file C:\WINDOWS\TEMP\nsr8199.tmp.     * Deletes file C:\WINDOWS\TEMP\nsr8199.tmp.     * Creates file C:\WINDOWS\TEMP\nsp0099.tmp.     * Creates directory C:\WINDOWS.     * Creates directory C:\WINDOWS\TEMP.     * Creates file C:\WINDOWS\TEMP\notepad.exe.dat.     * Creates file C:\WINDOWS\TEMP\calc.exe.dat.     * Creates file C:\WINDOWS\TEMP\freebsd.exe.dat.     * Creates file C:\WINDOWS\TEMP\network.exe.dat.     * Creates file C:\WINDOWS\TEMP\linux.     * Creates file C:\WINDOWS\TEMP\nsz8099.tmp.     * Deletes file C:\WINDOWS\TEMP\nsz8099.tmp.     * Creates directory C:\WINDOWS\TEMP\nsz8099.tmp.     * Creates file C:\WINDOWS\TEMP\nsz8099.tmp\dcryptdll.dll.     * Creates file C:\WINDOWS\TEMP\notepad.exe.     * Creates file C:\WINDOWS\TEMP\calc.exe.     * Creates file C:\WINDOWS\TEMP\freebsd.exe.     * Creates file C:\WINDOWS\TEMP\network.exe.     * Creates file C:\WINDOWS\TEMP\nsz8099.tmp\nsExec.dll.     * Creates file C:\WINDOWS\TEMP\nsz8099.tmp\ns8009.tmp. [ Changes to registry ]     * Accesses Registry key "HKCU\Software\4Porn".     * Accesses Registry key "HKLM\Software\Microsoft\Windows\CurrentVersion".     * Accesses Registry key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion". [ Process/window information ]     * Creates process "notepad.exe".     * Creates process "network.exe".     * Creates process "ns8009.tmp"". [ Signature Scanning ]     * C:\WINDOWS\TEMP\notepad.exe.dat (18432 bytes) : no signature detection.     * C:\WINDOWS\TEMP\freebsd.exe.dat (46592 bytes) : no signature detection.     * C:\WINDOWS\TEMP\network.exe.dat (30208 bytes) : no signature detection.     * C:\WINDOWS\TEMP\linux (62 bytes) : no signature detection.
Panda Antivirus	Found  nothing
Sophos Antivirus	Found Troj/Zlobar-Fam
VirusBuster	Found  nothing
VBA32	Found  nothing

spaceplane

NORMAN沙盘。。。

电影结束了

TF

秋叶濛濛

Avira
Contains detection pattern of the dropper DR/Dldr.DNSChanger.Gen

Palkia

C:\Documents and Settings\Administrator\桌面\codecdemo4049.rar>>codecdemo4049.exe        Trojan.DNSChanger.clm.ctjs.arc        木马        还未处理

allinwonderi

[Found Trojan]        <W32/DNSChanger.BA (exact, not disinfectable)>        C:\Documents and Settings\All Users\Documents\Test\codecdemo4049.rar->codecdemo4049.exe

---------------------------------------------------------------------
Scan ended:        2008-5-17, 16:07:59
Duration:        0:00:00

Scan result:

Scanned files:                 6
Infected objects:         1
Disinfected objects:         0
Quarantined files:         0
---------------------------------------------------------------------

allinwonderi

TO AB

BING126

McAfee  MISS

qigang

RS20.44.52未杀！