66.exe

显示全部楼层 · 发表于 2009-7-10 21:58:30

原帖：http://bbs.kafan.cn/viewthread.php?tid=516455

http://www.virustotal.com/zh-cn/analisis/342d585a8c68cdaad87d99774dab099b6d3c3017cd6f7666b456d4410db598fc-1247234004

To KL

显示全部楼层 · 发表于 2009-7-10 22:19:18

[ General information ]
* File length: 14848 bytes.
* MD5 hash: 023ede0c0e7dd96ac95db6294426502f.

[ Changes to filesystem ]
* Creates file C:\WINDOWS\TEMP\TempLog.bat.
* Deletes file "C:\sample.exe".
* Deletes file "C:\WINDOWS\TEMP\TempLog.bat".

[ Process/window information ]
* Attempts to access service "AppMgmt".
* Attempts to access service "Ntmssvc".
* Attempts to access service "Rasauto".
* Attempts to access service "BITS".
* Attempts to access service "WmdmPmSN".
* Attempts to access service "Browser".
* Attempts to access service "ERSvc".
* Attemps to open C:\WINDOWS\TEMP\TempLog.bat NULL.
* Creates process "CMD.EXE".

显示全部楼层 · 发表于 2009-7-10 22:20:47

rs 2009可以杀

显示全部楼层 · 发表于 2009-7-10 22:21:51

TO LL,顺路上报KL

显示全部楼层 · 发表于 2009-7-10 22:22:03

红伞杀杀杀

显示全部楼层 · 发表于 2009-7-10 22:22:48

McAfee 已自动阻止并隔离计算机上感染病毒的文件。您可以在 SecurityCenter 的“恢复”窗格中恢复隔离的文件。

关于此特洛伊木马程序
已检测到: Artemis!023EDE0C0E7D (特洛伊木马程序)
隔离来源: C:\Documents and Settings\Administrator\Local Settings\Temp\EXFESqKP.rar.part

2009-07-10 22:27:06 应用程序保护(运行应用程序)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\66\66.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c ""C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TempLog.bat" "
2009-07-10 22:27:05 文件保护(修改文件)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\66\66.exe
文件路径:C:\Sandbox\Administrator\DefaultBox\user\current\Local Settings\Temp\TempLog.bat
2009-07-10 22:27:05 文件保护(创建文件)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\66\66.exe
文件路径:C:\Sandbox\Administrator\DefaultBox\drive\C\WINDOWS\system32\MsPMSNSv.dll
2009-07-10 22:27:05 文件保护(创建文件)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\66\66.exe
文件路径:C:\Sandbox\Administrator\DefaultBox\drive\C\WINDOWS\system32\qmgr.dll
2009-07-10 22:27:05 文件保护(创建文件)    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\66\66.exe
文件路径:C:\Sandbox\Administrator\DefaultBox\drive\C\WINDOWS\system32\rasauto.dll
2009-07-10 22:27:05 应用程序保护(修改其它进程内存)    操作:阻止
进程路径:C:\WINDOWS\explorer.exe
目标进程:C:\Documents and Settings\Administrator\桌面\新建文件夹\66\66.exe

[ 本帖最后由 schumi小粉于 2009-7-10 22:27 编辑 ]

显示全部楼层 · 发表于 2009-7-10 23:31:19

瑞星2010
可疑：Unknown

显示全部楼层 · 发表于 2009-7-11 00:45:19

Hello,

New malicious software was found in the attached file. Its detection will be included in the next update.
Thank you for your help.
Trojan-Dropper.Win32.Agent.avqm

显示全部楼层 · 发表于 2009-7-11 01:40:37

IKARUS - T3SCAN V1.32.10.0 (WIN32)
      T3 V1.01.64
      Copyright (c) 2006 - 2009 by Ikarus Software.
      All rights reserved.

Signature-database from 10.7.2009 16:01:21 (Build: 73012)

e:\66.exe - Signature 'Win32.SuspectCrc' found

      1 File scanned
      (0 Archives with 0 files)
      1 Signature found
      0 Suspect code-parts found
      Used time: 0:01.328

显示全部楼层 · 发表于 2009-7-11 08:43:33

a virus or unwanted program 'TR/Spy.Gen' [trojan] was found.

[病毒样本] 66.exe

本帖子中包含更多资源

回复 1楼尤金卡巴斯基的帖子

[病毒样本] 66.exe

本帖子中包含更多资源

回复 1楼 尤金卡巴斯基 的帖子

回复 1楼尤金卡巴斯基的帖子