一个整人程序有毒！

lmr

叫振振你的窗口！

附件：

qihuakai

RIS2010报....RIS扫描完的文件报告...上报文件成功！
查询编号：RS20090802215647312436
为查询文件分析结果，请记录此编号。谢谢您的参与！
文件 __________________.rar 接收于 2009.08.02 14:05:41 (UTC)

反病毒引擎	版本	最后更新	扫描结果
a-squared	4.5.0.24	2009.08.02	Virus.Win32.Binder!IK
AhnLab-V3	5.0.0.2	2009.08.01	Win-Trojan/Xema.variant
AntiVir	7.9.0.238	2009.07.31	SPR/Hacktool.F
Antiy-AVL	2.0.3.7	2009.07.31	Packed/Win32.CPEX-based.gen
Authentium	5.1.2.4	2009.08.02	-
Avast	4.8.1335.0	2009.08.01	Win32:Trojan-gen {Other}
AVG	8.5.0.406	2009.08.02	BackDoor.Generic11.VVD
BitDefender	7.2	2009.08.02	Trojan.Generic.2100576
CAT-QuickHeal	10.00	2009.07.30	Trojan.Agent.ATV
ClamAV	0.94.1	2009.08.02	Trojan.Buzus-4355
Comodo	1838	2009.08.02	UnclassifiedMalware
DrWeb	5.0.0.12182	2009.08.02	Trojan.MulDrop.21314
eSafe	7.0.17.0	2009.07.30	Win32.Infostealer.Ga
eTrust-Vet	31.6.6650	2009.08.01	-
F-Prot	4.4.4.56	2009.08.02	-
F-Secure	8.0.14470.0	2009.08.01	Trojan.Win32.Buzus.bpef
Fortinet	3.120.0.0	2009.08.02	PossibleThreat
GData	19	2009.08.02	Trojan.Generic.2100576
Ikarus	T3.1.1.64.0	2009.08.02	Virus.Win32.Binder
Jiangmin	11.0.800	2009.08.02	Trojan/Delf.gnr
K7AntiVirus	7.10.808	2009.08.01	Trojan.Win32.Buzus.bpef
Kaspersky	7.0.0.125	2009.08.02	Trojan.Win32.Buzus.bpef
McAfee	5695	2009.08.01	BackDoor-DVC
McAfee+Artemis	5695	2009.08.01	BackDoor-DVC
McAfee-GW-Edition	6.8.5	2009.08.02	Heuristic.BehavesLike.Exploit.CodeExec.NLOB
Microsoft	1.4903	2009.08.02	-
NOD32	4298	2009.08.02	Win32/TrojanDropper.Delf.NOJ
Norman	6.01.09	2009.07.31	W32/Smalldoor.CPBZ
nProtect	2009.1.8.0	2009.08.02	-
Panda	10.0.0.14	2009.08.02	Trj/CI.A
PCTools	4.4.2.0	2009.08.02	-
Rising	21.40.62.00	2009.08.02	-
Sophos	4.44.0	2009.08.02	Mal/Generic-A
Sunbelt	3.2.1858.2	2009.08.02	Bulk Trojan
Symantec	1.4.4.12	2009.08.02	Infostealer.Gampass
TheHacker	6.3.4.3.375	2009.08.01	Trojan/Buzus.bfsc
TrendMicro	8.950.0.1094	2009.07.31	BKDR_SMALLDOO.LF
VBA32	3.12.10.9	2009.08.02	Trojan.Win32.Buzus.bfsc
ViRobot	2009.7.31.1863	2009.07.31	-
VirusBuster	4.6.5.0	2009.08.02	Trojan.Crypt.ZPACK.BZM
附加信息
File size: 579678 bytes
MD5...: 034f714c5a79ade59971506e5880d333
SHA1..: 3278e4a643b078c3d7baf771d8254f8f2effe1cd
SHA256: 1fbbbb9ed2869fc3b0c7a394b48d8937a4f734c58b3ee204ef6aa84719c4e0d8
ssdeep: 12288:EkQ4PIcBqHybSce3dhPq5nd+qsT1Z7LrA2n:E5QIzHyuhiDyrPn<BR>
PEiD..: -
TrID..: File type identification<BR>RAR Archive (83.3%)<BR>REALbasic Project (16.6%)
PEInfo: -
PDFiD.: -
RDS...: NSRL Reference Data Set<BR>-

http://www.virustotal.com/zh-cn/analisis/1fbbbb9ed2869fc3b0c7a394b48d8937a4f734c58b3ee204ef6aa84719c4e0d8-1249221941

[ 本帖最后由 qihuakai 于 2009-8-2 22:01 编辑 ]

黑衣~魂

DR.WEB
振振你的窗口.exe - infected with Trojan.MulDrop.21314

fatezero

木马程序 Trojan-Spy.Win32.Agent.ayrt

当空皓月

to kv!

XMatence

既然有Virus.Win32.Binder!IK了,我就不说了..

tuzi969

KV__
\\?\d:\internet 临时文件\content.ie5\ghijklmn\振振你的窗口[1].rar->振振你的窗口.exe     trojan/delf.gnr     2009-8-2 22:06:32     已删除

太不厚道了，整人程序弄傻毒阿，呵呵

hddu

2009-08-02 22:09:54    创建文件      操作:阻止并结束进程
进程路径:E:\振振你的窗口\振振你的窗口.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\有得振得睡.exe
触发规则:所有程序规则->Documents and Settings文件夹设置->?:\Documents and Settings\*\Local Settings\Temp\*.exe

lingbo110120

灰鸽子