刚找到批量TDSS,质量极高

sam.to

上报

saskecn

小红伞处理结果
Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00355201.




We received the following archive files:



File ID ?Filename Size (Byte) Result
25427790  1.zip 68.67 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID ?Filename Size (Byte) Result
25427791  1.exe  74.5 KB  MALWARE


Please find a detailed report concerning each individual sample below:

?Filename Result
1.exe  MALWARE

The file '1.exe' has been determined to be 'MALWARE'. Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates.


Alternatively you can see the analysis result here:
http://analysis.avira.com/sample ... p;incidentid=355201

An overview of all your submissions can be found here:
http://analysis.avira.com/sample ... OpJrFD0LsDC0fKhrPfX


We recommend to use our upload form for further submissions. In case the result is known it will be shown in realtime to you. Furthermore files which are considered to be false positive suspictions can only be submitted using this method. http://analysis.avira.com/samples/index.php?lang=en

Please note: If you have specific questions please address them to support@avira.com

Kind regards
Avira Virus Lab

---------------------------------------------
Avira GmbH
Lindauer Str. 21, D-88069 Tettnang, Germany
Phone: +49 (0) 7542-500 0
Fax: +49 (0) 7542-525 10
Internet: http://www.avira.com

CEO: Tjark Auerbach
Headquarter: Tettnang
Commercial register: AG Ulm HRB 630992
---------------------------------------------

songdehao

红伞 kl

250662772

2009-8-14 11:32:45    访问网络    允许
进程: c:\documents and settings\administrator\桌面\1.exe
目标: TCP [本机 : 2615] ->  [200.100.4.10 : 80 (http)]


2009-8-14 11:34:42    访问网络    允许
进程: c:\documents and settings\administrator\桌面\1.exe
目标: TCP [本机 : 2616] ->  [78.46.151.178 : 80 (http)]


2009-8-14 11:34:43    创建文件    允许
进程: c:\documents and settings\administrator\桌面\1.exe
目标: F:\temp\UACdafa.tmp


2009-8-14 11:34:43    创建文件    允许
进程: c:\documents and settings\administrator\桌面\1.exe
目标: F:\temp\UACdb0a.tmp


2009-8-14 11:34:43    修改文件    允许
进程: c:\documents and settings\administrator\桌面\1.exe
目标: F:\temp\UACdb0a.tmp


2009-8-14 11:34:43    修改内核对象    阻止
进程: c:\documents and settings\administrator\桌面\1.exe
目标: \KnownDlls\msvcrt.dll


2009-8-14 11:34:43    删除文件    允许
进程: c:\documents and settings\administrator\桌面\1.exe
目标: F:\temp\UACdb0a.tmp


2009-8-14 11:34:43    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\1.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\F:\temp\TEMPOR~1\Content.IE5\index.dat  \??\C:\DOCUME~1\ADMINI~1\Cookies\index.dat  \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\History\History.IE5\index.dat  \??\F:\temp\UACdafa.tmp


2009-8-14 11:35:02    修改文件    允许
进程: c:\documents and settings\administrator\桌面\1.exe
目标: C:\Documents and Settings\Administrator\桌面\1.exe


2009-8-14 11:35:02    创建文件    允许
进程: c:\documents and settings\administrator\桌面\1.exe
目标: F:\temp\UACdb77.tmp


2009-8-14 11:35:02    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\1.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\F:\temp\TEMPOR~1\Content.IE5\index.dat  \??\C:\DOCUME~1\ADMINI~1\Cookies\index.dat  \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\History\History.IE5\index.dat  \??\F:\temp\UACdb77.tmp

popfather

瑞星主防拦截 特征码也查杀

strawman0719

C:\Documents and Settings\Administrator\桌面\1.rar > RAR > 1.exe - Win32/Olmarik.IS 特洛伊木马 - 是已删除对象的一部分

NOD32 轻松