setup1.exe [md5:a93b17f]

mofunzone

eset的static行吗？

File:	setup1.exe
Status:	INFECTED/MALWARE
MD5:	a93b17fddb564f90375d1c84abf68180
Packers detected:	-
Scanner results
Scan taken on 22 May 2008 02:39:31 (GMT)
A-Squared	Found  nothing
AntiVir	Found TR/Dldr.Zlob.Gen
ArcaVir	Found  nothing
Avast	Found Win32:Zlob-CBY
AVG Antivirus	Found  nothing
BitDefender	Found  nothing
ClamAV	Found  nothing
CPsecure	Found  nothing
Dr.Web	Found  nothing
F-Prot Antivirus	Found  nothing
F-Secure Anti-Virus	Found  nothing
Fortinet	Found  nothing
Ikarus	Found  nothing
Kaspersky Anti-Virus	Found  nothing
NOD32	Found  nothing
Norman Virus Control	Found  nothing
Panda Antivirus	Found  nothing
Sophos Antivirus	Found  nothing
VirusBuster	Found  nothing
VBA32	Found Downloader.Zlob.3 (probable variant)

star_xing

kav325     0

红心王子

setup1.rar          10.32/10.32KB       100.00%    在线扫描      它是一个“木马”    2008-5-22 11:39:49   2008-5-22 11:40:02

woai_jolin

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

setup1.exe : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: NO_VIRUS
    * Compressed: NO
    * TLS hooks: NO
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * File length:        22016 bytes.
    * MD5 hash: a93b17fddb564f90375d1c84abf68180.

[ Changes to filesystem ]
    * Creates file C:\WINDOWS\TEMP\zfe0.exe.
    * Deletes file C:\WINDOWS\TEMP\\zfe0.exe.
    * Creates file C:\WINDOWS\TEMP\awer0.bat.
    * Deletes file "c:\sample.exe".

[ Changes to registry ]
    * Creates key "HKCU\Software\NetProject".
    * Sets value "Path"="C:\PROGRA~1\NetProject" in key "HKCU\Software\NetProject".
    * Sets value "Removable"="" in key "HKCU\Software\NetProject".
    * Creates key "HKCR\.exe\multimediaControls.chl\CLSID".
    * Sets value ""="{6BF52A52-394A-11D3-B153-00C04F79FAA6}" in key "HKCR\.exe\multimediaControls.chl\CLSID".
    * Accesses Registry key "HKCU\Software\NetProject".
    * Sets value "65400"="X" in key "HKCU\Software\NetProject".
    * Sets value "65401"="Xâ" in key "HKCU\Software\NetProject".
    * Sets value "65402"="ÓAÆ
" in key "HKCU\Software\NetProject".
    * Accesses Registry key "HKCU\Software\Microsoft\Internet Explorer\SearchScopes".

[ Network services ]
    * Connects to "69.50.164.54" on port 80 (TCP).
    * Opens URL: 69.50.164.54/this/is/stereo/music.php?param=0;1112;1371.

[ Process/window information ]
    * Attemps to open C:\WINDOWS\TEMP\awer0.bat NULL.
    * Creates process "CMD.EXE".

[ Signature Scanning ]
    * C:\WINDOWS\TEMP\awer0.bat (111 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

sam.to

已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Zlob.nsa        檔案: C:\Documents and Settings\kato9096\桌面\setup1.rar/setup1.exe

挪威的冬天

金山毒霸 0

Palkia

kv 0

star_xing

入库真快
ACCESS DENIED
The requested URL could not be retrieved

--------------------------------------------------------------------------------

While trying to retrieve the URL: http://bbs.kafan.cn/attachment.p ... 03&t=1211434855

The folowing error was encountered:

The requested object is INFECTED. The following viruses Trojan-Downloader.Win32.Zlob.nsa were found

Please contact your service provider if you feel this is incorrect.



--------------------------------------------------------------------------------

Generated Thu May 22 13:42:53 2008 by 卡巴斯基反病毒软件 7.0

啊弥陀佛

微点砍掉

qwer9909

C:\Documents and Settings\Administrator\桌面\setup1.rar>>setup1.exe        TrojanPSW.GameOL.GEN.dqtx        木马        还未处理