pokemon.exe——个性的swizzor

显示全部楼层 · 发表于 2009-7-14 20:59:14

from China swizzor lover

显示全部楼层 · 发表于 2009-7-14 21:02:48

Begin scan in 'C:\Documents and Settings\Administrator\桌面\pokemon.rar'
C:\Documents and Settings\Administrator\桌面\pokemon.rar
  [0] Archive type: RAR
[NOTE]    A backup was created as '4ac78257.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
--> pokemon.exe
   [DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan

显示全部楼层 · 发表于 2009-7-14 21:05:18

mse miss,to

显示全部楼层 · 发表于 2009-7-14 21:06:34

Virus: Win32:Swizzor [Trj] (Engine B)

Virus found while downloading Web content.

Address: bbs.kafan.cn

显示全部楼层 · 发表于 2009-7-14 21:08:33

2009-07-14 21:08:42 应用程序保护(运行应用程序) 操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\pokemon\pokemon.exe
文件路径:D:\Program Files\Maxthon2\Maxthon.exe
2009-07-14 21:08:42 应用程序保护(修改其它进程内存) 操作:阻止
进程路径:C:\WINDOWS\explorer.exe
目标进程:C:\Documents and Settings\Administrator\桌面\新建文件夹\pokemon\pokemon.exe

显示全部楼层 · 发表于 2009-7-14 21:09:53

江民：Trojan/Obfuscated.Gen.b

显示全部楼层 · 发表于 2009-7-14 21:15:16

F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.4.4
Virus signature file from: 2009-7-13, 1:08

Scan name: [Custom Scan]
Path to scan: C:\Test\pokemon\pokemon.exe

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2009-7-14, 21:14:51
---------------------------------------------------------------------

[Found possible virus] <W32/Swizzor-based.2!Maximus> C:\Test\pokemon\pokemon.exe
[Failed to disinfect] pokemon.exe
[Quarantined] C:\Test\pokemon\pokemon.exe

---------------------------------------------------------------------
Scan ended: 2009-7-14, 21:14:52
Duration: 0:00:01

Scan result:

Scanned files:    1
Infected objects:    1
Disinfected objects:    0
Quarantined files:    1
---------------------------------------------------------------------

显示全部楼层 · 发表于 2009-7-14 21:16:23

[ General information ]
* File length: 344064 bytes.
* MD5 hash: 07326c740a1fb4a70f69f4f84ab07777.

[ Changes to registry ]
* Accesses Registry key "HKCR\InternetExplorer.Application".
* Accesses Registry key "HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}".

[ Process/window information ]
* Creates a mutex .
* Attempts to open CLSID {148BD52A-A2AB-11CE-B11F-00AA00530503}.
* Creates process "IEXPLORE.EXE".
* Modifies memory in process "IEXPLORE.EXE".
* Creates a thread in process IEXPLORE.EXE.
* Creates an event called he0038FDB0.

显示全部楼层 · 发表于 2009-7-14 22:14:29

DR.WEB
pokemon.exe - infected with Trojan.Swizzor.based

显示全部楼层 · 发表于 2009-7-14 22:28:44

[病毒样本] pokemon.exe——个性的swizzor

本帖子中包含更多资源

F-PROT 4.4.4

本帖子中包含更多资源