FastAntivirus2011.exe

a256886572008

http://camas.comodo.com/cgi-bin/submit?file=f8e4cce6b246aacfa74dc9b8840bed1dc2fa0a279e69d855c307497805d7ee53

‧ Verdict
Auto Analysis Verdict
Suspicious++

‧ Description
Suspicious Actions Detected
Creates autorun records
Deletes self
Disables windows firewall

-----------------------------------------

2011-07-10 19:09:28   C:\Documents and Settings\Roger\桌面\VIRUS\FastAntivirus2011\FastAntivirus2011.exe   Sandboxed As   Partially Limited   

2011-07-10 19:09:34   C:\Documents and Settings\Roger\桌面\VIRUS\FastAntivirus2011\FastAntivirus2011.exe   Install Hook   C:\WINDOWS\system32\DINPUT.dll   

2011-07-10 19:09:40   C:\Documents and Settings\Roger\Local Settings\Application Data\ksw.exe   Sandboxed As   Partially Limited   

2011-07-10 19:09:47   C:\Documents and Settings\Roger\桌面\VIRUS\FastAntivirus2011\FastAntivirus2011.exe   Modify Key   HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall   

2011-07-10 19:09:47   C:\Documents and Settings\Roger\桌面\VIRUS\FastAntivirus2011\FastAntivirus2011.exe   Access Memory   System   

2011-07-10 19:09:47   C:\Documents and Settings\Roger\桌面\VIRUS\FastAntivirus2011\FastAntivirus2011.exe   Modify Key   HKUS\S-1-5-21-1214440339-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe   

2011-07-10 19:09:52   C:\Documents and Settings\Roger\Local Settings\Application Data\ksw.exe   Install Hook   C:\WINDOWS\system32\DINPUT.dll   

2011-07-10 19:09:58   C:\Documents and Settings\Roger\Local Settings\Application Data\ksw.exe   Modify File   C:\Documents and Settings\Roger\桌面\VIRUS\FastAntivirus2011\FastAntivirus2011.exe   

2011-07-10 19:10:03   C:\Documents and Settings\Roger\Local Settings\Application Data\ksw.exe   Access COM Interface   Shell.Explorer.2   

2011-07-10 19:10:10   C:\Documents and Settings\Roger\Local Settings\Application Data\ksw.exe   Modify Key   HKUS\Software\Classes\.exe\   

2011-07-10 19:10:10   C:\Documents and Settings\Roger\Local Settings\Application Data\ksw.exe   DNS/RPC Client Access   \RPC Control\DNSResolver   

2011-07-10 19:10:10   C:\Documents and Settings\Roger\Local Settings\Application Data\ksw.exe   Access COM Interface   {8BC3F05E-D86B-11D0-A075-00C04FB68820}   

2011-07-10 19:10:22   C:\Documents and Settings\Roger\Local Settings\Application Data\ksw.exe   Access COM Interface   {9BA05972-F6A8-11CF-A442-00A0C90A8F39}   

9303110

过金山360.

619875192

to  卡巴

WeeVee

SEP12.1扫描不报，运行样本报 Bloodhound.Sonar.9

a256886572008

9303110 发表于 2011-7-10 19:18
过金山360.

測 360 主防吧

金山雲端，該好好檢討了，一直都不改，只是單純加黑有什麼用

wuyongliang

过AVG扫描 主防  这个东西 冒充杀软 提示你中了一堆病毒 ，

9303110

a256886572008 发表于 2011-7-10 19:25
測 360 主防吧

金山雲端，該好好檢討了，一直都不改，只是單純加黑有什麼用

问一下，我在金山沙盘里运行。360主防可以测得到吗？

9303110

。这蛋疼的。

Palkia

avast!漏

xyc5238207