nexauthp.exe

显示全部楼层 · 发表于 2010-8-11 17:40:39

此文件隐藏于C:\Windows\SysWOW64

File information

File Name :	nexauthp.exe
File Size :	5120 byte
File Type :	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 :	5f58237902c62e45104e6407720e691a
SHA1 :	7be8081db32e66051fc3a4d422f8cd69c474f384

Scanner results

Scanner results :	42% Scanner(s) (15/36) found malware!
Time :	2010/08/11 18:55:35 (EST)

Scanner	Engine Ver	Sig Ver	Sig Date	Scan result	Time
a-squared	5.0.0.18	20100811050659	2010-08-11	Win32.SuspectCrc!IK	0.506
AhnLab V3	2010.08.07.00	2010.08.07	2010-08-07	Win-Trojan/Agent.8192.Z	1.551
AntiVir	8.2.4.34	7.10.10.144	2010-08-10	TR/Gendal.5120.V	0.308
Antiy	2.0.18	20100810.4923669	2010-08-10	-	0.030
Arcavir	2009	201006281601	2010-06-28	-	0.005
Authentium	5.1.1	201008110228	2010-08-11	-	1.461
AVAST!	4.7.4	100810-1	2010-08-10	-	0.004
AVG	8.5.793	271.1.1/3063	2010-08-11	-	0.243
BitDefender	7.90123.6144968	7.33299	2010-08-11	Trojan.Generic.4160375	4.583
ClamAV	0.96.1	11527	2010-08-11	-	0.008
Comodo	4.0	5708	2010-08-10	UnclassifiedMalware	2.219
CP Secure	1.3.0.5	2010.08.11	2010-08-11	-	0.002
Dr.Web	5.0.2.3300	2010.08.11	2010-08-11	-	8.982
F-Prot	4.4.4.56	20100810	2010-08-10	-	1.394
F-Secure	7.02.73807	2010.08.11.01	2010-08-11	-	0.157
Fortinet	4.1.143	12.234	2010-08-10	W32/Dx.SXM!tr	0.687
GData	21.653/21.248	20100810	2010-08-10	-	12.867
Ikarus	T3.	2010.08.11.76468	2010-08-11	Win32.SuspectCrc	4.801
JiangMin	13.0.900	2010.08.10	2010-08-10	TrojanDropper.Microjoin.anl	2.051
Kaspersky	5.5.10	2010.08.11	2010-08-11	-	0.109
KingSoft	2009.2.5.15	2010.8.11.11	2010-08-11	-	0.763
McAfee	5400.1158	6070	2010-08-10	Generic.dx!sxm	18.024
Microsoft	1.6004	2010.08.11	2010-08-11	-	8.866
Norman	6.05.11	6.05.00	2010-08-11	-	6.015
nProtect	20100808.01	8813262	2010-08-08	Trojan/W32.Agent.5120.CU	9.785
Panda	9.05.01	2010.08.08	2010-08-08	Generic Trojan	5.371
Quick Heal	11.00	2010.08.11	2010-08-11	TrojanDropper.Microjoin.hfg	2.422
Rising	20.0	22.60.02.01	2010-08-11	-	1.688
Sophos	3.10.0	4.56	2010-08-11	-	4.282
Sunbelt	3.9.2432.2	6710	2010-08-09	Trojan.Win32.Generic!BT	19.074
Symantec	1.3.0.24	20100810.002	2010-08-10	Trojan.Gen	0.087
The Hacker	6.5.2.1	v00342	2010-08-10	-	0.384
Trend Micro	9.120-1004	7.376.03	2010-08-10	-	0.034
VBA32	3.12.14.0	20100810.0802	2010-08-10	Trojan-Dropper.Win32.Microjoin.hfg	3.062
ViRobot	20100810	2010.08.10	2010-08-10	-	1.005
VirusBuster	4.5.11.10	10.127.50/2027477	2010-08-10	-	2.346

■Heuristic/Suspicious ■Exact

显示全部楼层 · 发表于 2010-8-11 17:43:50

显示全部楼层 · 发表于 2010-8-11 17:45:21

生成一个批处理程序，代码如下...

@Echo Off
START exauthp2.dll
Echo
Echo
Echo
Echo
Echo
Echo
Echo
Echo
Echo
Echo
Echo
Echo
Echo
Echo
Echo
Echo
Echo
Echo
Echo
Echo
Echo
Echo
Echo

然后...

显示全部楼层 · 发表于 2010-8-11 17:46:27

360sd
C:\Documents and Settings\Administrator\桌面\nexauthp.zip=>nexauthp.exe 可疑木马(Trojan.Generic.4160375) 已删除

显示全部楼层 · 发表于 2010-8-11 18:24:16

to kaspersky lab

显示全部楼层 · 发表于 2010-8-11 18:28:42

FS
Trojan.Generic.4160375

显示全部楼层 · 发表于 2010-8-12 06:39:34

to eset

http://samples.nod32.com.sg/inde ... e45104e6407720e691a

显示全部楼层 · 发表于 2010-8-12 07:12:17

瑞星文件监控

显示全部楼层 · 发表于 2010-8-12 08:00:44

回复 1楼 wenbin 的帖子

卡巴说不是病毒
Hello,

78810173_269739222_nexauthp.exe_

No malicious code was found in this file.

78810173_269739223_tempsys.exe_ - Trojan-Ransom.Win32.PinkBlocker.cja

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

显示全部楼层 · 发表于 2010-8-12 09:41:05

filseclab D:\下载\nexauthp.zip>>nexauthp.exe TrojanDrop.Agent.cck.yxgo 木马还未处理

[病毒样本] nexauthp.exe