软件区下的迷你qq，kv报毒 [MD5: 35F343]

一派胡言

不过玩起来好有意思。


[ 本帖最后由 一派胡言 于 2007-6-18 17:58 编辑 ]

taihuxian

Virus: Win32:Trojan-gen. {Other}

Virus found while downloading Web content.

Address: bbs.kafan.cn

金剑

误报

hj5abc

误报吗??NOD32报的已知?

Time Module Object Name Threat Action User Information
2007-6-18 19:01:51 AMON file F:\MiniQQ2[1].2\MiniQQ2.2.exe Win32/PSW.QQPass.NAW trojan quarantined - deleted  Event occurred on a newly created file. The file was moved to quarantine. You may close this window.

1688388728

病毒: Win32:Trojan-gen. {Other}
文件: MiniQQ2.2[1].rar
目录: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\VM1NGYS8
进程: GreenBrowser.exe

l784588

avast报 Win32:QQPass-FJ [Trj]

卡江东N

卡巴6不报,AVG报木马.
到底是什么?

mhj144007

Sandbox Submit a File Report

-

--------------------------------------------------------------------------------

ID 215539
Comment None
Flag 1

Analysis Summary:

Analysis Date 2/26/2007 12:30:30 PM
Sandbox Version 1.115
Filename 35f343a3d7e72496ffa789f13321f04b.exe

Technical Details:

Analysis Number 1
Parent ID 0
Process ID 612
Filename c:\temp\35f343a3d7e72496ffa789f13321f04b.exe
Filesize 71168 bytes
MD5 35f343a3d7e72496ffa789f13321f04b
Start Reason AnalysisTarget
Termination Reason Timeout
Start Time 00:00.328
Stop Time 01:00.344
Detection Suspicious - could be infected with an unknown virus (Authentium Command Antivirus - EngVer: 4.92.123.35 - SigVer: 20070111 35)
Infected - Trojan.PWS.QQPass.IW (BitDefender Antivirus - EngVer: 7.0.0.2311 - SigVer: 7.10873)
Trojan - Trojan-PWS.QQPass.IW (CounterSpy - EngVer: 2.1.628.0 - SigVer: 469)
- (Microsoft Malware Protection - EngVer: 1.1.1904.0 - SigVer: Thu Jan 11 14:31:06 2007)
Virus - Trojan Horse (Norton AntiVirus - EngVer: 20061.3.0.12 - SigVer: 20070110 16:48:12)

DLL-Handling Loaded DLLs
c:\temp\35f343a3d7e72496ffa789f13321f04b.exe
C:\WINDOWS\System32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\USER32.DLL
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\RPCRT4.dll
C:\WINDOWS\system32\OLEAUT32.DLL
C:\WINDOWS\system32\MSVCRT.DLL
C:\WINDOWS\system32\OLE32.DLL
C:\WINDOWS\System32\WINMM.DLL
C:\WINDOWS\system32\SHELL32.DLL
C:\WINDOWS\system32\SHLWAPI.dll
C:\WINDOWS\System32\WSOCK32.DLL
C:\WINDOWS\System32\WS2_32.dll
C:\WINDOWS\System32\WS2HELP.dll
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1612_x-ww_7c379b08\
C:\WINDOWS\system32\comctl32.dll
C:\WINDOWS\System32\pstorec.dll
C:\WINDOWS\System32\ATL.DLL
C:\WINDOWS\System32\Wship6.dll
C:\WINDOWS\System32\iphlpapi.dll
C:\WINDOWS\System32\Secur32.dll
KERNEL32.DLL
USER32.DLL
ADVAPI32.DLL
OLEAUT32.DLL
WINMM.DLL
SHELL32.DLL
WSOCK32.DLL
c:\temp\35f343a3d7e72496ffa789f13321f04b.ENU
c:\temp\35f343a3d7e72496ffa789f13321f04b.EN


Filesystem New Files
\Device\RasAcd

Chronological order
Create/Open File: \Device\RasAcd (OPEN_ALWAYS)


Registry  
Service Management Open Service Manager - Name: "SCM"

Network Activity DNS Lookup
Host Name IP Address
sz.tencent.com 219.133.49.171
UDP Connections


Analysis Number 2
Parent ID 0
Process ID 708
Filename  
Filesize -1 bytes
MD5  
Start Reason SCM
Termination Reason Unknown
Start Time 00:02.953
Stop Time 00:00.000

Analysis Number 3
Parent ID 0
Process ID 708
Filename  
Filesize -1 bytes
MD5  
Start Reason SCM
Termination Reason Unknown
Start Time 00:03.032
Stop Time 00:00.000

yksoar

卡巴6没报``蜘蛛(07.4.30病毒库)报毒`

randyr

红伞P，不报。上报。
AVG antispyware: