凝逸浏览器-上毒网-得到的样本

凝逸反毒

凝逸浏览器-上毒网-得到的样本

凝逸浏览器  http://bbs.kafan.cn/thread-564161-1-1.html

用 凝逸浏览器 上毒网 http://down.111cn.cn/down/mb/mb/blue/2009/0617/4691.html
得到的样本

尤金卡巴斯基

To KL

水晶

网盾拦截

尤金卡巴斯基

Hello,

a.exe_ - Trojan-Downloader.Win32.WinAD.z

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

fatezero

红伞 不报
to avira

悠柚

D:\TDDownload\a.rar > RAR > a.exe - 可能是 Win32/TrojanDownloader.Small.ORF 特洛伊木马 的变种

悠柚

Multi Command-Line Scanner 报告
-------------------------------------------------------------------------
D:\TDDownload\a.rar
MD5 Hash: 17CB8A996B32186147215419FBEB8C0E

A-squared -----Nothing
AntiVir V7 -----Nothing
BitDefender ----- Gen:Trojan.Heur.PT.ciW@baJ6ACf
ClamWin -----Nothing
Dr.Web V5 -----Nothing
F-Prot ----- W32/Downloader-Web-based!Maximus  
Mcafee -----Nothing
Panda ----- Suspicious file
Sophos -----Nothing
VBA32 ----- Trojan.Win32.Inject.2

*** 4/10 杀毒引擎在文件中发现病毒 ***
-------------------------------------------------------------------------

任务完成 @ 2009-09-26 星期六 18:41:37.04
注意: 结果可能与GUI版本不同。

winxp0286

C:\Documents and Settings\Administrator\桌面\a.rar > RAR > a.exe - 可能是 Win32/TrojanDownloader.Small.ORF 特洛伊木马 的变种

62590423

程序：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\A.EXE
木马程序生成以下文件：
1) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\USER\CURRENT\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\V8P8Y16S\CNZZ[1].EXE
2) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\USER\CURRENT\LOCAL SETTINGS\TEMP\CNZZ.EXE
3) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\USER\CURRENT\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\GD6CUK9C\MUSIC[1].EXE
4) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\USER\CURRENT\LOCAL SETTINGS\TEMP\MUSIC.EXE
5) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\DRIVE\C\PROGRAM FILES\MICROSOFT OFFICE\SYSTEM\32.EXE
6) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\USER\CURRENT\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\V8P8Y16S\3800[1].EXE
7) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\DRIVE\C\WINDOWS\SYSTEM32\APPMGMTS.DLL
8) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\USER\CURRENT\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\MR49U482\A67[1].EXE
9) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\USER\CURRENT\LOCAL SETTINGS\TEMP\A67.EXE
10) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\USER\CURRENT\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\LCBCBEXJ\CPM[1].EXE
11) C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\USER\CURRENT\LOCAL SETTINGS\TEMP\CPM.EXE
是否删除木马程序及其衍生物?

wcj20236

微点主防果然强大。