worm 1x(kaba特征码免杀）

幸福的猪猪

kaba miss，to kill ！

Palkia

金山 0

aerbeisi

date/time: 2009-6-8 16:18:29
filename: TDDownload.zip
filesize: 27.28 KB
virusname: Packed.Win32.Klone
suggestion: Save & Delete
signatureId: 894573

tun

难得看 Norman 的沙箱有反应
484 ms C:\Scan\TDDownload.zip : TDDownload/c.exe
Virus W32/Suspicious_N.gen
[ General information ]
    * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
    * **Locates window "NULL [class Notepad]" on desktop.
    * Creating several executable files on hard-drive.
    * File length:        30720 bytes.

[ Changes to filesystem ]
    * Creates file C:\Sherry.dll.
    * Creates file C:\WINDOWS\system32\drivers\AsyncMac.sys.
    * Deletes file C:\WINDOWS\system32\drivers\AsyncMac.sys.
    * Deletes file C:\Sherry.dll.
    * Creates file C:\WINDOWS\TEMP\dll8919.tmp.

[ Changes to registry ]
    * Accesses Registry key "HKCU\Software\Microsoft\Notepad".
    * Accesses Registry key "HKLM\SYSTEM\CurrentControlSet\Services\AsyncMac".
    * Accesses Registry key "HKLM\SYSTEM\CurrentControlSet\Services".
    * Creates key "HKLM\System\CurrentControlSet\Services\VxD\AsyncMac".

[ Process/window information ]
    * Creates process "notepad.exe".
    * Creates a mutex qq935623508.
    * Checks if privilege "SeDebugPrivilege" is available.
    * Enables privilege SeDebugPrivilege.
    * Enumerates running processes.
    * Enumerates running processes several parses....
    * Attemps to open rundll32.exe C:\Sherry.dll,RSDK.
    * Creates process "rundll32.exe".
    * Uses rundll32.exe to run function "RSDK" in library "C:\Sherry.dll".

einnawy

费尔 Trojan.Xsnuzk.qifs

黑衣~魂

DR.WEB
URL is blocked. Malicious program is detected
Malicious program detected
Trojan.KillProc.1565

kingsheet

卡巴不报

webweb

卡巴是免杀了  貌似弄得其他杀软 倒是很认得了。。

悠柚

mpav Worm.Win32.Autorun.tbq

BING126

to McAfee