atofof.exe

显示全部楼层 · 发表于 2010-1-16 19:08:11

。。第二次中了

显示全部楼层 · 发表于 2010-1-16 19:12:11

本帖最后由 z2665 于 2010-1-16 19:13 编辑

Thank you for your submission. Below you can see the current status of the uploaded files.

We received the following archive files:
File ID       Filename       Size (Byte)       Result
25552999       atofof.rar       117.2 KB       OK

A listing of files contained inside archives alongside their results can be found below:
File ID       Filename       Size (Byte)       Result
25553000       atofof.exe       122.5 KB       UNDER ANALYSIS

Please find a detailed report concerning each individual sample below:
Filename       Result
atofof.exe       UNDER ANALYSIS
The file 'atofof.exe' has been determined to be 'UNDER ANALYSIS'.
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.
杀生成物。。

显示全部楼层 · 发表于 2010-1-16 19:16:48

加壳文件，hips没反应，是否有害未知

显示全部楼层 · 发表于 2010-1-16 19:24:47

to mcafee

显示全部楼层 · 发表于 2010-1-16 19:27:30

McAfee Labs - Beaverton
Current Scan Engine Version:5400.1158
Current DAT Version:5862.0000
Thank you for your submission.

Analysis ID: 5740342

File Name          Findings                      Detection                   Type       Extra
--------------------|------------------------------|----------------------------|------------|-----
atofof.exe       |new detection                |fakealert-fq             |Trojan    |yes

Attached is a file for extra detection, which will be included in a future DAT set. We
have detected a virus or trojan that can only be detected and removed with the
attached EXTRA.DAT and current scan engine. The EXTRA.DAT must be used with the
current scan engine, and we highly recommend you update to the most current DAT
release. If you are not seeing this with the product you are using, please speak with
technical support so they can help you determine the cause of this discrepancy.

new detection [atofof.exe]

The file received contains a new virus or trojan. It is recommended that you update
your DAT and engine files and scan your computer again.

To find detailed information about viruses and other malware, please review McAfee
Labs' Virus Information Library:

http://vil.mcafeesecurity.com

You may wish to submit future malware samples to:

https://www.webimmune.net/default.asp

It may be the best option if you are having a problem with gateway scanners stripping
your sample submission.

If you believe your computer is infected, but are unsure which files should be
submitted to McAfee Labs for review, please visit:

http://vil.mcafeesecurity.com/vil/submit-sample.aspx

For other virus-related information, please review McAfee Labs' homepage at:

http://www.mcafee.com/us/threat_center/default.asp

Support ?

Virus Research accepts file-samples for analysis and possible inclusion into AV
signature DAT sets. We are also prepared to answer general virus questions. All
product-related questions and comments can be addressed through technical support and
customer service, including:

* Product installation and update questions
* Product usage questions
* Specific operating system/version questions
* Assistance with detection and cleaning or removal of viruses or trojans

Use the following link to update your DAT and scan engine to the most current version:

http://www.mcafee.com/apps/downloads/security_updates/dat.asp

Use the following links to reach online technical support for McAfee products -

Corporate Customers:

http://www.mcafeesecurity.com/us/support/

Single User/Retail Customers:

http://www.mcafeehelp.com

Note ?

Due to the prevalence of network gateway AV products, it is important that all
submissions be zipped and the zip file password-protected (password - infected). Some
products will reject an email that contains a virus that is not sent in this way. In
addition, often we receive a file that appears not to have been infected, to find
later that the file was infected when it left the sender, and was cleaned somewhere
along the line.

Regards,

McAfee Labs

显示全部楼层 · 发表于 2010-1-16 19:49:26

特洛伊

显示全部楼层 · 发表于 2010-1-16 20:37:49

本帖最后由牧羊老汉于 2010-1-16 20:39 编辑

加壳文件，hips没反应，是否有害未知
ray1106 发表于 2010-1-16 19:16

atofof.exe (事件： 4)
启动其它进程 F:\atofof\atofof.exe
修改 hklm\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\atofof    被拒绝: Explorer_Run
创建  C:\WINDOWS\SYSTEM32\AOTBHMRWEJ.DLL 被拒绝: SystemDll
终止进程  F:\atofof\atofof.exe

显示全部楼层 · 发表于 2010-1-16 21:12:40

报壳。

显示全部楼层 · 发表于 2010-1-16 21:56:54

本帖最后由 fatezero 于 2010-1-16 22:06 编辑

Hello,

atofof.exe_ - Trojan.Win32.Tdss.avkl

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Packed.Win32.TDSS.aa

显示全部楼层 · 发表于 2010-1-17 08:54:40

回复 5# saskecn

还有人上报mcafee阿，少见...

[病毒样本] atofof.exe

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源