1

sam.to

f8e4c41768b0b4d8577f3ec1dcf67fea   KEY.exe2
to kl,ll,mcafee


Hello,


KEY.exe2 - Trojan.Win32.Buzus.cxms

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

--
Best regards, Sergey Prokudin
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



https://www.virustotal.com/anali ... cdb3a800-1262782897

username

类似http://bbs.kafan.cn/thread-622984-1-1.html

2010-1-6 00:57:29    创建文件    允许
进程: d:\emule\key\key.exe
目标: C:\Program Files\Common Files\Microsoft Shared\MSINFO\2010.txt
规则: [应用程序]d:\emule\key\key.exe -> [文件]c:\program files\common files\microsoft shared\msinfo; 2010.txt

2010-1-6 00:57:30    创建新进程    允许
进程: d:\emule\key\key.exe
目标: c:\program files\internet explorer\iexplore.exe
命令行: "C:\program files\internet explorer\IEXPLORE.EXE"
规则: [应用程序]*

2010-1-6 00:57:31    修改其他进程的内存    阻止并结束进程
进程: d:\emule\key\key.exe
目标: c:\program files\internet explorer\iexplore.exe
规则: [应用程序]* -> [目标应用程序]c:\program files\internet explorer\iexplore.exe

sam.to

类似

2010-1-6 00:57:29    创建文件    允许
进程: d:\emule\key\key.exe
目标: C:\Program Files\Co ...
username 发表于 2010-1-6 00:57

    downloader???

kingmuro

过AVG

尤金卡巴斯基

kato用的什么浏览器

username

控制ie在C:\Program Files\Common Files\Microsoft Shared\MSInfo下生成木马
然后安装服务常驻系统
再插ie穿墙上线
大抵上老式远控都是这样
最多把ie或路径换成其它

jason_jiang

microsoft：VirTool:Win32/Injector.gen!E

sam.to

Hello,


KEY.exe2 - Trojan.Win32.Buzus.cxms

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

--
Best regards, Sergey Prokudin
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

onos

MSE报

悠柚

卡巴没更新报Heur