Virus:ADWARE/Eorezo.AJ
Date discovered:05/11/2012
Type:Adware/Spyware
In the wild:No
Reported Infections:Low to medium
Distribution Potential:Low
Damage Potential:Low
VDF version:7.11.48.222 - Monday, November 5, 2012
IVDF version:7.11.48.222 - Monday, November 5, 2012

 General Method of propagation:
   • No own spreading routine


Aliases:
   •  Bitdefender: Adware.Eorezo.AJ
   •  Eset: a variant of Win32/Adware.EoRezo.AJ application
   •  Norman: W32/EoRezo.CDO


Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003
   • Windows Vista
   • Windows Server 2008
   • Windows 7

 Files The following files are created:

– Non malicious files:
   • %appdata%\tutoriales100_co_1\tutoriales100_co_1\update.cyl
   • %appdata%\tutoriales100_co_1\tutoriales100_co_1\0.99.5\conf.cyl
   • %temp%\mfi1.tmp
   • %temp%\gch2.tmp
   • %temp%\mfi3.tmp
   • %temp%\gch4.tmp

– Temporary files that might be deleted afterwards:
   • %temp%\mfi3.tmp-shm
   • %temp%\mfi3.tmp-wal

 Miscellaneous Event handler:
It creates the following Event handlers:
   • SetWindowsHook
   • GetKeyState
   • GetAsynckeyState
   • CopyFile
   • CreateProcess
   • CreateFile
   • GetDriveType
   • Process32First
   • FindWindows
   • CreateToolhelp32Snapshot


String:
Furthermore it contains the following strings:
   • multipart/
   • MAIL FROM:
   • RCPT TO:
   • HELO
   • USER
   • PASS
   • LIST
   • TYPE
   • SYST
   • REST
   • PASV
   • PORT
   • RETR
   • CONNECT
   • NOTICE
   • APRT
   • JOIN
   • MODE
   • QUIT
   • MozillaWindowClass

说明添加者： Wensin Lee 打开 2012年11月7日星期三
说明更新者： Wensin Lee 打开 2012年11月7日星期三

反馈 . . . .

© 2013 Avira Operations GmbH & Co. KG. 保留所有权利.

我的帐户

https:// 为了你的安全，此窗口已加密。