[09-19]关于双击*.exe就生成*~.exe(第2版)

endurer　原创

2006-09-19　第2版

2006-09-13　第1版

有位网友的电脑出现了一个奇怪的现象，关于双击*.exe就生成*~.exe，如双击a.exe就生成a~.exe。

并发来了四个文件：setup.exe、setup~.exe、Frozen Throne.exe 和 Frozen Throne~.exe。


2006-09-13  22:33              203,261 setup.exe
2006-09-13  22:37              107,513 setup~.exe

增加95748=0x17604字节


2006-09-13  22:29              370,181 Frozen Throne.exe
2006-09-13  22:28              274,433 Frozen Throne~.exe

增加95748=0x17604字节

1、setup.exe

Rising 报为 Worm.Cnt.a

STATUS: FINISHED

Complete scanning result of "setup.exe", received in VirusTotal at 09.13.2006, 16:54:44 (CET).

Antivirus Version Update Result AntiVir 7.2.0.16 09.13.2006 HEUR/Malware Authentium 4.93.8 09.13.2006 no virus found Avast 4.7.844.0 09.13.2006 no virus found AVG 386 09.12.2006 Downloader.Generic2.OFO BitDefender 7.2 09.13.2006 Trojan.Downloader.Agent.AJY CAT-QuickHeal 8.00 09.13.2006 no virus found ClamAV devel-20060426 09.13.2006 no virus found DrWeb 4.33 09.13.2006 Trojan.DownLoader.12699 eTrust-InoculateIT 23.72.123 09.13.2006 no virus found eTrust-Vet 30.3.3076 09.13.2006 no virus found Ewido 4.0 09.13.2006 Downloader.Delf.awy Fortinet 2.77.0.0 09.13.2006 no virus found F-Prot 3.16f 09.13.2006 no virus found F-Prot4 4.2.1.29 09.13.2006 no virus found Ikarus 0.2.65.0 09.12.2006 no virus found Kaspersky 4.0.2.24 09.13.2006 Trojan-Downloader.Win32.Delf.awy McAfee 4850 09.12.2006 no virus found Microsoft 1.1560 09.13.2006 no virus found NOD32v2 1.1754 09.13.2006 probably unknown NewHeur_PE virus Norman 5.90.23 09.13.2006 W32/DLoader.AVLV Panda 9.0.0.4 09.12.2006 Suspicious file Sophos 4.09.0 09.13.2006 no virus found Symantec 8.0 09.13.2006 Downloader TheHacker 5.9.8.210 09.13.2006 no virus found UNA 1.83 09.11.2006 no virus found VBA32 3.11.1 09.12.2006 no virus found VirusBuster 4.3.7:9 09.13.2006 no virus found

 

Aditional Information File size: 203261 bytes MD5: 745daa5ca7e831936a94c598ec485695 SHA1: aa89187dd286106840d8f125fd99dde4b3a364f3
2、setup~1.exe

STATUS: FINISHED

Complete scanning result of "setup_.exe", received in VirusTotal at 09.13.2006, 17:04:48 (CET).

Antivirus Version Update Result AntiVir 7.2.0.16 09.13.2006 no virus found Authentium 4.93.8 09.13.2006 no virus found Avast 4.7.844.0 09.13.2006 no virus found AVG 386 09.12.2006 no virus found BitDefender 7.2 09.13.2006 no virus found CAT-QuickHeal 8.00 09.13.2006 no virus found ClamAV devel-20060426 09.13.2006 no virus found eTrust-InoculateIT 23.72.123 09.13.2006 no virus found eTrust-Vet 30.3.3076 09.13.2006 no virus found DrWeb 4.33 09.13.2006 no virus found Ewido 4.0 09.13.2006 no virus found Fortinet 2.77.0.0 09.13.2006 suspicious F-Prot 3.16f 09.13.2006 no virus found F-Prot4 4.2.1.29 09.13.2006 no virus found Ikarus 0.2.65.0 09.12.2006 no virus found Kaspersky 4.0.2.24 09.13.2006 no virus found McAfee 4850 09.12.2006 no virus found Microsoft 1.1560 09.13.2006 no virus found NOD32v2 1.1754 09.13.2006 no virus found Norman 5.80.02 09.13.2006 no virus found Panda 9.0.0.4 09.12.2006 no virus found Sophos 4.09.0 09.13.2006 no virus found Symantec 8.0 09.13.2006 no virus found TheHacker 5.9.8.210 09.13.2006 no virus found UNA 1.83 09.11.2006 no virus found VBA32 3.11.1 09.12.2006 no virus found VirusBuster 4.3.7:9 09.13.2006 no virus found

 

Aditional Information File size: 107513 bytes MD5: e4e9e999ab14699cd0277c0c552a2aa8 SHA1: bf2501e95d100595b72401689b3e10093f05da2c

3、Frozen_Throne.exe

Rising 报为 Worm.Cnt.a

STATUS: FINISHED

Complete scanning result of "Frozen_Throne.exe", received in VirusTotal at 09.13.2006, 17:15:37 (CET).

Antivirus Version Update Result AntiVir 7.2.0.16 09.13.2006 HEUR/Malware Authentium 4.93.8 09.13.2006 no virus found Avast 4.7.844.0 09.13.2006 no virus found AVG 386 09.12.2006 Downloader.Generic2.OFO BitDefender 7.2 09.13.2006 Trojan.Downloader.Agent.AJY CAT-QuickHeal 8.00 09.13.2006 no virus found ClamAV devel-20060426 09.13.2006 no virus found DrWeb 4.33 09.13.2006 Trojan.DownLoader.12699 eTrust-InoculateIT 23.72.123 09.13.2006 no virus found eTrust-Vet 30.3.3076 09.13.2006 no virus found Ewido 4.0 09.13.2006 Downloader.Delf.awy Fortinet 2.77.0.0 09.13.2006 suspicious F-Prot 3.16f 09.13.2006 no virus found F-Prot4 4.2.1.29 09.13.2006 no virus found Ikarus 0.2.65.0 09.12.2006 no virus found Kaspersky 4.0.2.24 09.13.2006 Trojan-Downloader.Win32.Delf.awy McAfee 4850 09.12.2006 no virus found Microsoft 1.1560 09.13.2006 no virus found NOD32v2 1.1754 09.13.2006 probably unknown NewHeur_PE virus Norman 5.90.23 09.13.2006 W32/DLoader.AVLV Panda 9.0.0.4 09.12.2006 Suspicious file Sophos 4.09.0 09.13.2006 no virus found Symantec 8.0 09.13.2006 Downloader TheHacker 5.9.8.210 09.13.2006 no virus found UNA 1.83 09.11.2006 no virus found VBA32 3.11.1 09.12.2006 no virus found VirusBuster 4.3.7:9 09.13.2006 no virus found

 

Aditional Information File size: 370181 bytes MD5: 87db7215d1e4d67de45dc297628f847a SHA1: 83522edab281e6791de9fce663a5123d0e55b623



4、Frozen Throne~.exe

STATUS: FINISHED

Complete scanning result of "Frozen_Throne_.exe", received in VirusTotal at 09.13.2006, 16:43:48 (CET).

Antivirus Version Update Result AntiVir 7.2.0.16 09.13.2006 no virus found Authentium 4.93.8 09.13.2006 no virus found Avast 4.7.844.0 09.13.2006 no virus found AVG 386 09.12.2006 no virus found BitDefender 7.2 09.13.2006 no virus found CAT-QuickHeal 8.00 09.13.2006 no virus found ClamAV devel-20060426 09.13.2006 no virus found DrWeb 4.33 09.13.2006 no virus found eTrust-InoculateIT 23.72.123 09.13.2006 no virus found eTrust-Vet 30.3.3076 09.13.2006 no virus found Ewido 4.0 09.13.2006 no virus found Fortinet 2.77.0.0 09.13.2006 no virus found F-Prot 3.16f 09.13.2006 no virus found F-Prot4 4.2.1.29 09.13.2006 no virus found Ikarus 0.2.65.0 09.12.2006 no virus found Kaspersky 4.0.2.24 09.13.2006 no virus found McAfee 4850 09.12.2006 no virus found Microsoft 1.1560 09.13.2006 no virus found NOD32v2 1.1754 09.13.2006 no virus found Norman 5.90.23 09.13.2006 no virus found Panda 9.0.0.4 09.12.2006 no virus found Sophos 4.09.0 09.13.2006 no virus found Symantec 8.0 09.13.2006 no virus found TheHacker 5.9.8.210 09.13.2006 no virus found UNA 1.83 09.11.2006 no virus found VBA32 3.11.1 09.12.2006 Backdoor.Win32.Ciadoor.13 VirusBuster 4.3.7:9 09.13.2006 no virus found

 

Aditional Information File size: 274433 bytes MD5: 5c3d0c4e0696e694654ccd8ce4773e8e SHA1: f9d825469f72c6207133b5902c3715da8f37c0f8