sgs10099.exe

promised

Auto post by promised's robot
PM me if having problems
CAT-QuickHeal        Found Nothing
McAfee        Found Nothing
TheHacker        Found Nothing
K7AntiVirus        Found Nothing
VirusBuster        Found Nothing
NOD32        Found Nothing
F-Prot        Found Nothing
Symantec        Found WS.Reputation.1
Norman        Found W32/Agent.VAZB
TrendMicro-HouseCall        Found Nothing
Avast        Found Win32:Malware-gen
eSafe        Found Nothing
ClamAV        Found Nothing
Kaspersky        Found Nothing
BitDefender        Found Trojan.Generic.KD.196385
ViRobot        Found Nothing
Sophos        Found Nothing
Comodo        Found Nothing
F-Secure        Found Trojan.Generic.KD.196385
DrWeb        Found Nothing
VIPRE        Found Trojan.Win32.Generic!BT
AntiVir        Found Nothing
TrendMicro        Found Nothing
McAfee-GW-Edition        Found Nothing
Emsisoft        Found Trojan.SuspectCRC!IK
eTrust-Vet        Found Nothing
Jiangmin        Found Nothing
Antiy-AVL        Found Nothing
Microsoft        Found Nothing
SUPERAntiSpyware        Found Nothing
Prevx        Found Nothing
GData        Found Trojan.Generic.KD.196385
Commtouch        Found Nothing
AhnLab-V3        Found Malware/Win32.Generic
VBA32        Found Nothing
PCTools        Found Nothing
Rising        Found Nothing
Ikarus        Found Trojan.SuspectCRC
Fortinet        Found Nothing
AVG        Found PSW.OnlineGames3.BHYQ
Panda        Found Generic Trojan
Avast5        Found Win32:Malware-gen

594157544

NOD32  毒霸  安全





PS:这个文件在4月20日已被提交？！

594157544

2011-05-06 18:23:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\sgs10099[1].exe\sgs10099[1].exe加载库文件C:\WINDOWS\system32\winspool.drv C:\WINDOWS\system32\winspool.drv
2011-05-06 18:23:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\sgs10099[1].exe\sgs10099[1].exe加载库文件C:\WINDOWS\system32\winspool.drv C:\WINDOWS\system32\winspool.drv
2011-05-06 18:23:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\sgs10099[1].exe\sgs10099[1].exe加载库文件C:\WINDOWS\system32\oledlg.dll C:\WINDOWS\system32\oledlg.dll
2011-05-06 18:23:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\sgs10099[1].exe\sgs10099[1].exe加载库文件C:\WINDOWS\system32\imm32.dll C:\WINDOWS\system32\imm32.dll
2011-05-06 18:23:16 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\sgs10099[1].exe\sgs10099[1].exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
2011-05-06 18:23:17 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\sgs10099[1].exe\sgs10099[1].exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll
2011-05-06 18:23:17 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\sgs10099[1].exe\sgs10099[1].exe加载库文件C:\WINDOWS\system32\uxtheme.dll C:\WINDOWS\system32\uxtheme.dll
2011-05-06 18:23:17 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\sgs10099[1].exe\sgs10099[1].exe加载库文件D:\Program Files\KSafe\ksfmon.dll D:\Program Files\KSafe\ksfmon.dll
2011-05-06 18:23:17 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\sgs10099[1].exe\sgs10099[1].exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\kwsui.dll C:\Program Files\Common Files\Kingsoft\kiscommon\kwsui.dll
2011-05-06 18:23:17 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\sgs10099[1].exe\sgs10099[1].exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\kswebshield.dll C:\Program Files\Common Files\Kingsoft\kiscommon\kswebshield.dll
2011-05-06 18:23:17 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\sgs10099[1].exe\sgs10099[1].exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
2011-05-06 18:23:17 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\sgs10099[1].exe\sgs10099[1].exe加载库文件C:\WINDOWS\system32\MSCTF.dll C:\WINDOWS\system32\MSCTF.dll
2011-05-06 18:23:17 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\sgs10099[1].exe\sgs10099[1].exe加载库文件C:\WINDOWS\system32\MSCTFIME.IME C:\WINDOWS\system32\MSCTFIME.IME
2011-05-06 18:23:17 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\sgs10099[1].exe\sgs10099[1].exe发送消息C:\Program Files\Common Files\Kingsoft\kiscommon\ksandbox.exe C:\Program Files\Common Files\Kingsoft\kiscommon\ksandbox.exe
2011-05-06 18:23:17 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\sgs10099[1].exe\sgs10099[1].exe发送消息C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\ctfmon.exe
2011-05-06 18:23:17 C:\Documents and Settings\CSIOSI\桌面\试验文件夹\sgs10099[1].exe\sgs10099[1].exe发送消息C:\WINDOWS\explorer.exe C:\WINDOWS\explorer.exe

hj5abc

退出

xwhmm

miss

爱在雨中停

TO ESS   上报   http://samples.nod32tw.com/index ... b3067c83a335a8065dd

aaaaoooo

过金山卫士和360SD。

XE-cj

卡巴                                                               

留侯

文件加了殼，大蜘蛛clean：
sgs10099[1].exe packed by ZLIB
sgs10099[1].exe - archive BINARYRES
sgs10099[1].exe/data001 packed by ZLIB
sgs10099[1].exe/data001 - archive BINARYRES
已上報！

s8706042

已上报趋势~
未侦测到威胁~