不知道是什么！大家扫扫看~~~

jpzy

刚才上网的时候出现了一次orz.exe应用程序错误~！
我肯定没运行这个东东，所以搜索了一下~~~在local settings\temp目录找到的~~~

sbbdms

Kaspersky miss~??

TO KL

[ 本帖最后由 sbbdms 于 2008-6-6 14:33 编辑 ]

HC303

红伞没反应，上报。

25038330

orz.exe

7.58 KB

UNDER ANALYSIS

sbbdms

估计不是什么好东西

反病毒引擎	版本	最后更新	扫描结果
AhnLab-V3	2008.5.30.1	2008.06.05	-
AntiVir	7.8.0.26	2008.06.06	-
Authentium	5.1.0.4	2008.06.05	W32/Heuristic-CSU!Eldorado
Avast	4.8.1195.0	2008.06.06	-
AVG	7.5.0.516	2008.06.05	-
BitDefender	7.2	2008.06.06	-
CAT-QuickHeal	9.50	2008.06.05	(Suspicious) - DNAScan
ClamAV	0.92.1	2008.06.06	PUA.Packed.UPack-2
DrWeb	4.44.0.09170	2008.06.05	-
eSafe	7.0.15.0	2008.06.05	Suspicious File
eTrust-Vet	31.6.5849	2008.06.05	-
Ewido	4.0	2008.06.05	-
F-Prot	4.4.4.56	2008.06.05	W32/Heuristic-CSU!Eldorado
F-Secure	6.70.13260.0	2008.06.05	W32/Suspicious_U.gen
Fortinet	3.14.0.0	2008.06.06	-
GData	2.0.7306.1023	2008.06.06	-
Ikarus	T3.1.1.26.0	2008.06.06	-
Kaspersky	7.0.0.125	2008.06.06	-
McAfee	5311	2008.06.05	-
Microsoft	1.3604	2008.06.06	-
NOD32v2	3162	2008.06.05	-
Norman	5.80.02	2008.06.05	-
Panda	9.0.0.4	2008.06.05	Suspicious file
Prevx1	V2	2008.06.06	-
Rising	20.47.40.00	2008.06.06	-
Sophos	4.30.0	2008.06.06	Mal/Packer
Sunbelt	3.0.1145.1	2008.06.05	VIPRE.Suspicious
Symantec	10	2008.06.06	-
TheHacker	6.2.92.337	2008.06.06	W32/Behav-Heuristic-060
VBA32	3.12.6.7	2008.06.05	-
VirusBuster	4.3.26:9	2008.06.05	Packed/Upack
Webwasher-Gateway	6.6.2	2008.06.06	Win32.Malware.gen (suspicious)

TO KL

小邪邪

这个orz.exe出现在我的local settings\temp里很多次了，肯定不是好东西
上毒网之后的产物

风野胤

这个见过的
flash漏洞。。。。。

a369258147

sbbdms

Hello,

orz.exed - Trojan-Downloader.Win32.Agent.sac

New malicious software was found in this file. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

dbpe

orz.exe

以前分析过


在windows下生成****temp  里面全是 *.bmp   其实是exe

运行然后.................

HC303

红伞不杀。
The file 'orz.exe' has been determined to be 'DAMAGED FILE (UNKNOWN)'. In particular this means that this file is damaged and not working properly. We could not find any malicious content. However the heuristic detection module may still detect this particular file even though it is damaged. In that case we will not adjust and remove detection for this damaged file.