QQ2009chs.exe

尤金卡巴斯基

http://take.58s3.cn/soft/QQ2009chs.exe

http://www.virustotal.com/zh-cn/analisis/1d59ef9388060159e0dbe722e6e917b9f0079c1150c20507706b8560878c3bf4-1246702234

Hello,

New malicious software was found in the attached file. Its detection will be included in the next update.
Thank you for your help.
Trojan.Win32.Agent2.kve

Regards, Tatarinov Ivan
Virus Analyst

10/1, 1st Volokolamsky Proezd, Moscow, 123060, Russia
Tel./Fax: + 7 (495) 797 8700
http://www.kaspersky.com http://www.viruslist.com

[ 本帖最后由 尤金卡巴斯基 于 2009-7-5 17:18 编辑 ]

dreams521

to mpav

[ 本帖最后由 dreams521 于 2009-7-4 18:12 编辑 ]

xyao

杀生成物

人品至上

红伞的表现：
数据访问被拒绝！
警告：病毒或有害程序已发现的HTTP数据

红心王子

2009-7-4        19:00:52        1246705252        SYSTEM        1464        Sign of "Win32:Rootkit-gen [Rtk]" has been found in "http://bbs.kafan.cn/attachment.php?aid=574075&k=667aa95e75309a89581a64e0e81b925b&t=1246705147\QQ2009chs.exe" file.

sam.to

URL TO KL

schumi小粉

2009-07-04 21:16:22        文件保护(创建文件)     操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\QQ2009chs\QQ2009chs.exe
文件路径:C:\Sandbox\Administrator\DefaultBox\drive\C\hVINxCJelOsc.dll
2009-07-04 21:16:21        应用程序保护(修改其它进程内存)     操作:阻止
进程路径:C:\WINDOWS\explorer.exe
目标进程:C:\Documents and Settings\Administrator\桌面\新建文件夹\QQ2009chs\QQ2009chs.exe

BING126

to McAfee

z2665

QQ2009chs.rar > RAR > QQ2009chs.exe - Win32/Agent.PTD 特洛伊木马

allinwonderi

QQ2009chs.exe : INFECTED with W32/Malware (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Filename: C:\analyzer\scan\QQ2009chs.exe.
    * Sandbox name: W32/Malware.
    * Signature name: NO_VIRUS.
    * Compressed: YES.
    * TLS hooks: NO.
    * Executable type: Application.
    * Executable file structure: OK.
    * Filetype: PE_I386.

[ General information ]
    * Decompressing UPX3.
    * Drops files in %WINSYS% folder.
    * Creating several executable files on hard-drive.
    * File length:        37644 bytes.
    * MD5 hash: a553ab2710bd486cd00b552a15a34f59.

[ Changes to filesystem ]
    * Creates file C:\WINDOWS\QNfZlpxKHBYgzWF.dll.
    * Creates file C:\WINDOWS\SYSTEM32\rIqWkEMdtiALgK.dll.
    * Deletes file C:\WINDOWS\QNfZlpxKHBYgzWF.dll.
    * Deletes file QNfZlpxKHBYgzWF.dll.

[ Changes to registry ]
    * Accesses Registry key "HKLM\SOFTWARE\360Safe\safemon".
    * Creates key "HKLM\System\CurrentControlSet\Services\ufad-dns60".
    * Sets value "I"="" in key "HKLM\System\CurrentControlSet\Services\ufad-dns60".
    * Sets value "DisplayName"="VMware DNS Service" in key "HKLM\System\CurrentControlSet\Services\ufad-dns60".
    * Accesses Registry key "HKLM\SYSTEM\CurrentControlSet\Services\ufad-dns60".
    * Sets value "Description"="DNS service for virtual networks" in key "HKLM\System\CurrentControlSet\Services\ufad-dns60".
    * Creates key "HKLM\System\CurrentControlSet\Services\ufad-dns60\Parameters".
    * Sets value "ServiceDll"="C:\WINDOWS\SYSTEM32\rIqWkEMdtiALgK.dll" in key "HKLM\System\CurrentControlSet\Services\ufad-dns60\Parameters".
    * Accesses Registry key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost".

[ Process/window information ]
    * Checks if privilege "SeDebugPrivilege" is available.
    * Enables privilege SeDebugPrivilege.
    * Creates service "ufad-dns60 (VMware DNS Service)" as "%SystemRoot%\System32\svchost.exe -k ufad-dns60".

[ Signature Scanning ]
    * C:\WINDOWS\QNfZlpxKHBYgzWF.dll (25088 bytes) : no signature detection.
    * C:\WINDOWS\SYSTEM32\rIqWkEMdtiALgK.dll (25088 bytes) : no signature detection.