fire-codec1345.exe [md5:231cddb]

mofunzone

File:	fire-codec1345.exe
Status:	INFECTED/MALWARE
MD5:	231cddb5053762005d3b28fe5dc71766
Packers detected:	-
Scanner results
Scan taken on 24 May 2008 06:09:20 (GMT)
A-Squared	Found  nothing
AntiVir	Found  nothing
ArcaVir	Found  nothing
Avast	Found  nothing
AVG Antivirus	Found DNSChanger.AE
BitDefender	Found  nothing
ClamAV	Found  nothing
CPsecure	Found Troj.W32.DNSChanger.clm
Dr.Web	Found  nothing
F-Prot Antivirus	Found  nothing
F-Secure Anti-Virus	Found  nothing
Fortinet	Found  nothing
Ikarus	Found Virus.Trojan.Win32.DNSChanger.chg
Kaspersky Anti-Virus	Found Trojan.Win32.DNSChanger.dlc
NOD32	Found  nothing
Norman Virus Control	Found Sandbox: W32/Malware;  [ General information ]         * Creating several executable files on hard-drive.     * File length:       167759 bytes. [ Changes to filesystem ]     * Creates directory C:\WINDOWS\TEMP\.     * Creates file C:\WINDOWS\TEMP\nsr8199.tmp.     * Deletes file C:\WINDOWS\TEMP\nsr8199.tmp.     * Creates file C:\WINDOWS\TEMP\nsp8099.tmp.     * Creates directory C:\WINDOWS.     * Creates directory C:\WINDOWS\TEMP.     * Creates file C:\WINDOWS\TEMP\notepad.exe.dat.     * Creates file C:\WINDOWS\TEMP\calc.exe.dat.     * Creates file C:\WINDOWS\TEMP\linux.     * Creates file C:\WINDOWS\TEMP\nsz8099.tmp.     * Deletes file C:\WINDOWS\TEMP\nsz8099.tmp.     * Creates directory C:\WINDOWS\TEMP\nsz8099.tmp.     * Creates file C:\WINDOWS\TEMP\nsz8099.tmp\DcryptDll.dll.     * Creates file C:\WINDOWS\TEMP\notepad.exe.     * Creates file C:\WINDOWS\TEMP\calc.exe. [ Changes to registry ]     * Accesses Registry key "HKCU\Software\PronVideo".     * Accesses Registry key "HKLM\Software\Microsoft\Windows\CurrentVersion". [ Process/window information ]     * Creates process "notepad.exe".     * Creates process "svchost.exe".     * Modifies memory in process svchost.exe.     * Modifies execution flow of process svchost.exe.
Panda Antivirus	Found  nothing
Sophos Antivirus	Found Troj/Zlobar-Fam
VirusBuster	Found  nothing
VBA32	Found  nothing

IllusionWing

Norman的沙盘什么意思？色情拨号器？PornDialer..

qigang

RS20.45.50未杀！

野马

微点
木马名称:未知木马
程序:
D:\DOWNLOADS\FIRE-CODEC1345.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

Nblock

发现未知间谍软件，是否删除？
程序:
E:\FIRE-CODEC1345.EXE
木马程序生成以下文件:
1) C:\LOCAL SETTINGS\TEMP\NSZ30.TMP\DCRYPTDLL.DLL
2) C:\LOCAL SETTINGS\TEMP\NOTEPAD.EXE
3) C:\LOCAL SETTINGS\TEMP\CALC.EXE
是否删除木马程序及其衍生物?

allinwonderi

[Scanning : C:\Documents and Settings\All Users\Documents\Test]


C:\Documents and Settings\All Users\Documents\Test\fire-codec1345.rar<RAR>:fire-codec1345.exe<NSIS>:DcryptDll.dll <- Trojan.Agent.Ki : No action



Scanned objects : 11

Infected objects : 1

allinwonderi

MISS

BING126

McAfee  MISS