notepad.exe

solcroft

.

小邪邪

冷冷

皇帝没报　蜘蛛没报

运行后退出
代码看不出什么

电影结束了

扔给TF了。。。
偶这里运行不出来。。。
估计系统问题。。。

电影结束了

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File MD5	Alias
1	[file and pathname of the sample #1]	25,600 bytes	0xBD317975F9DA8CF0C9BB1EE975B4D127	Trojan.Zlob [Symantec]

• The following file was modified:
  • %CommonAppData%\Microsoft\Network\Connections\Pbk\rasphone.pbk

• Note:
  • %CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.

qwer9909

红伞不报。。。

ranguangning

【1】生成一个文件就退出：



【2】文件内容：

[重庆网通]
Encoding=1
Type=5
AutoLogon=0
UseRasCredentials=0
DialParamsUID=164937
Guid=B343AC3BC3EFAD4791182217E9FE502B
BaseProtocol=1
VpnStrategy=0
ExcludedProtocols=3
LcpExtensions=1
DataEncryption=8
SwCompression=1
NegotiateMultilinkAlways=1
SkipNwcWarning=0
SkipDownLevelDialog=0
SkipDoubleDialDialog=0
DialMode=1
DialPercent=75
DialSeconds=120
HangUpPercent=10
HangUpSeconds=120
OverridePref=15
RedialAttempts=3
RedialSeconds=60
IdleDisconnectSeconds=0
RedialOnLinkFailure=1
CallbackMode=0
CustomDialDll=
CustomDialFunc=
CustomRasDialDll=
AuthenticateServer=0
ShareMsFilePrint=0
BindMsNetClient=0
SharedPhoneNumbers=0
GlobalDeviceSettings=0
PrerequisiteEntry=
PrerequisitePbk=
PreferredPort=
PreferredDevice=
PreferredBps=0
PreferredHwFlow=0
PreferredProtocol=0
PreferredCompression=0
PreferredSpeaker=0
PreferredMdmProtocol=0
PreviewUserPw=1
PreviewDomain=0
PreviewPhoneNumber=0
ShowDialingProgress=1
ShowMonitorIconInTaskBar=1
CustomAuthKey=-1
AuthRestrictions=632
TypicalAuth=1
IpPrioritizeRemote=1
IpHeaderCompression=0
IpAddress=0.0.0.0
IpDnsAddress=85.255.114.21
IpDns2Address=85.255.112.134
IpWinsAddress=0.0.0.0
IpWins2Address=0.0.0.0
IpAssign=1
IpNameAssign=2
IpFrameSize=1006
IpDnsFlags=0
IpNBTFlags=0
TcpWindowSize=0
UseFlags=1
IpSecFlags=0
IpDnsSuffix=
NETCOMPONENTS=
ms_server=0
ms_msclient=0
ms_psched=1
MEDIA=rastapi
Port=PPPoE4-0
Device=WAN 微型端口 (PPPOE)
DEVICE=PPPoE
PhoneNumber=
AreaCode=
CountryCode=1
CountryID=1
UseDialingRules=0
Comment=
LastSelectedPhone=0
PromoteAlternates=0
TryNextAlternateOnFail=1

qigang

RS20.47.12未杀！

sam.to

to kl,antivir

不用分析便說:

The file 'notepad.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/DNSChanger.TG. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

[ 本帖最后由 kato9096 于 2008-6-3 20:05 编辑 ]

BING126

McAfee  MISS