spoolsv32.exe[md5:72685c]

mofunzone

File:           spoolsv32.exe
Status:        
INFECTED/MALWARE
MD5:         72685cc8f3285f54e3750ffed7c15ad9
Packers detected:        
PE_PATCH.UPX, UPX
Bit9 reports:         Low threat detected (more info)
Scanner results
Scan taken on 20 Jun 2007 23:34:49 (GMT)
A-Squared        
Found nothing
AntiVir        
Found TR/BHO.64512.B
ArcaVir        
Found nothing
Avast        
Found Win32:Agent-HNE
AVG Antivirus        
Found Clicker.FNV
BitDefender        
Found Trojan.Clicker.Agent.NJ
ClamAV        
Found Trojan.Clicker-208
Dr.Web        
Found nothing
F-Prot Antivirus        
Found W32/Trojan.AFZR
F-Secure Anti-Virus        
Found Trojan-Clicker.Win32.Agent.hz
Fortinet        
Found Adware/Agent
Kaspersky Anti-Virus        
Found Trojan-Clicker.Win32.Agent.hz
NOD32        
Found nothing
Norman Virus Control        
Found W32/Agent.BPMA
Panda Antivirus        
Found nothing
Rising Antivirus        
Found nothing
VirusBuster        
Found nothing
VBA32        
Found Trojan-Clicker.Win32.Agent.hz

红心王子

斧头监控拦截

绅博周幸

Win32:Agent-HNE [Trj]

a256886572008

運行spoolsv32.exe，發現下列行為，被EQ-Secure RC2攔截！
--------------------
2007-06-21 08:16:28    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\spoolsv32\spoolsv32.exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-21 08:16:28    创建文件      操作:阻止
进程路径:D:\桌面\virus\spoolsv32\spoolsv32.exe
文件路径:D:\桌面\virus\spoolsv32\62101628.dll
规则:所有程序规则->2.1.5组：限制部份高危格式文件和文件夹的操作->*.dll


2007-06-21 08:16:28    创建文件      操作:阻止
进程路径:D:\桌面\virus\spoolsv32\spoolsv32.exe
文件路径:D:\桌面\virus\spoolsv32\del.bat
规则:所有程序规则->2.1.5组：限制部份高危格式文件和文件夹的操作->*.bat

--------------
1.他會在他旁邊產生
   62101628.dll
   del.bat

1688388728

病毒: Trojan-Clicker.Win32.Agent.hz
文件: spoolsv32[1].rar
目录: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TEWQ801G
进程: GreenBrowser.exe

风野胤

看到M版我就做好了上报的准备
哈哈

xiaosdsd

卡巴可杀

tracydk

yashoo

傻猪猪米走鸡

low thread的东西不知道什么时候能进库……