金山安全

绅博周幸

【乱】

搞错了 编辑掉

样本属于安装程序 鸟语不懂 不乱装

dalianjhc1986

to eset

saga3721

31877925         vnc.exe         726.04 KB         KNOWN CLEAN

Mr.Tong

360 pass

jayavira

elg显示使用人数不少呢，clean

留侯

大蜘蛛报告为风险程序：
vnc.exe - archive INNO SETUP
vnc.exe/{app}\winvnc4.exe contains a potentially dangerous software Program.RemoteAdmin
vnc.exe/{app}\vncconfig.exe contains a potentially dangerous software Program.RemoteAdmin
vnc.exe/{app}\wm_hooks.dll contains a potentially dangerous software Program.RemoteAdmin
vnc.exe/{app}\vncviewer.exe contains a potentially dangerous software Program.RemoteAdmin

hddu

2011-09-20 13:47:07    运行应用程序      操作:允许
进程路径:F:\virus\vnc\vnc.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
命令行:/SL4 $801DA F:\virus\vnc\vnc.exe 511279 50688
触发规则:所有程序规则->其它程序设置->*\Temp\*


2011-09-20 13:47:33    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Program Files\RealVNC
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*


2011-09-20 13:47:34    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Program Files\RealVNC\VNC4
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*\*


2011-09-20 13:47:35    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Program Files\RealVNC\VNC4\unins000.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe


2011-09-20 13:47:35    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Program Files\RealVNC\VNC4\unins000.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe


2011-09-20 13:47:37    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Program Files\RealVNC\VNC4\winvnc4.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe


2011-09-20 13:47:38    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Program Files\RealVNC\VNC4\winvnc4.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe


2011-09-20 13:47:38    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Program Files\RealVNC\VNC4\vncconfig.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe


2011-09-20 13:47:39    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Program Files\RealVNC\VNC4\vncconfig.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe


2011-09-20 13:47:39    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Program Files\RealVNC\VNC4\wm_hooks.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll


2011-09-20 13:47:39    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Program Files\RealVNC\VNC4\wm_hooks.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll


2011-09-20 13:47:39    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Program Files\RealVNC\VNC4\logmessages.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll


2011-09-20 13:47:40    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Program Files\RealVNC\VNC4\logmessages.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll


2011-09-20 13:47:41    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Program Files\RealVNC\VNC4\vncviewer.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe


2011-09-20 13:47:42    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Program Files\RealVNC\VNC4\vncviewer.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe


2011-09-20 13:47:44    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\RealVNC
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\*


2011-09-20 13:47:44    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\RealVNC\VNC Server 4 (User-Mode)
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\*


2011-09-20 13:47:45    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\RealVNC\VNC Server 4 (User-Mode)\Run VNC Server.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk


2011-09-20 13:47:47    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\RealVNC\VNC Server 4 (User-Mode)\Configure User-Mode Settings.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk


2011-09-20 13:47:48    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\RealVNC\VNC Server 4 (Service-Mode)
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\*


2011-09-20 13:47:49    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\RealVNC\VNC Server 4 (Service-Mode)\Register VNC Service.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk


2011-09-20 13:47:50    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\RealVNC\VNC Server 4 (Service-Mode)\Unregister VNC Service.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk


2011-09-20 13:47:51    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\RealVNC\VNC Server 4 (Service-Mode)\Start VNC Service.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk


2011-09-20 13:47:52    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\RealVNC\VNC Server 4 (Service-Mode)\Stop VNC Service.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk


2011-09-20 13:47:53    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\RealVNC\VNC Server 4 (Service-Mode)\Configure VNC Service.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk


2011-09-20 13:47:54    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\RealVNC\VNC Viewer 4
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\*


2011-09-20 13:47:54    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\RealVNC\VNC Viewer 4\Run VNC Viewer.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk


2011-09-20 13:47:55    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-4UF6R.tmp\is-IS7VR.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\RealVNC\VNC Viewer 4\Run Listening VNC Viewer.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk


2011-09-20 13:47:57    创建注册表值      操作:允许
进程路径:C:\WINDOWS\system32\services.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinVNC4
注册表名称:Start
触发规则:应用程序规则->系统程序->%windir%\system32\services.exe->HKEY_LOCAL_MACHINE\SYSTEM\*controlset*\Services*


2011-09-20 13:47:57    创建注册表值      操作:允许
进程路径:C:\WINDOWS\system32\services.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinVNC4
注册表名称:ImagePath
触发规则:应用程序规则->系统程序->%windir%\system32\services.exe->HKEY_LOCAL_MACHINE\SYSTEM\*controlset*\Services*


2011-09-20 13:47:59    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\services.exe
文件路径:C:\Program Files\RealVNC\VNC4\winvnc4.exe
命令行:-service
触发规则:应用程序规则->系统程序->%windir%\system32\services.exe->%ProgramFiles%\*.exe

-oAo-

360安全

wuyongliang

安装完后 毛豆云KILL 衍生物