VT Detection ratio: 11 / 45 wgsdgsdgdsgsd.exe

firefox3

https://www.virustotal.com/file/ ... nalysis/1357556597/





2013-01-07 18:56:00         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         创建进程         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe

2013-01-07 18:56:26         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         修改文件         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe

2013-01-07 18:56:40         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         修改注册表项         HKUS\SANDBOX_ADMINISTRATOR_LLQ\machine\software\microsoft\Windows\CurrentVersion\Run

2013-01-07 18:56:46         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         修改注册表项         HKUS\SANDBOX_ADMINISTRATOR_LLQ\machine\software\microsoft\Windows\CurrentVersion\Run\sv駂顂t

2013-01-07 18:56:51         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         修改注册表项         HKUS\SANDBOX_ADMINISTRATOR_LLQ\user\current\software\Microsoft\Windows\CurrentVersion\Policies\Attachments

2013-01-07 18:56:53         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         修改注册表项         HKUS\SANDBOX_ADMINISTRATOR_LLQ\user\current\software\Microsoft\Windows\CurrentVersion\Policies\Attachments\SaveZoneInformation

2013-01-07 18:56:55         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         修改注册表项         HKUS\SANDBOX_ADMINISTRATOR_LLQ\user\current\software\Microsoft\Windows\CurrentVersion\Policies\Associations
2013-01-07 18:56:57         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         修改注册表项         HKUS\SANDBOX_ADMINISTRATOR_LLQ\user\current\software\Microsoft\Windows\CurrentVersion\Policies\Associations\LowRiskFileTypes

2013-01-07 18:57:01         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         修改注册表项         HKUS\SANDBOX_ADMINISTRATOR_LLQ\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1601

2013-01-07 18:57:04         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         修改文件         C:\Sandbox\Administrator\LLQ\user\current\Local Settings\Temporary Internet Files\Content.IE5\index.dat

2013-01-07 18:57:05         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         修改文件         C:\Sandbox\Administrator\LLQ\user\current\Cookies\index.dat

2013-01-07 18:57:10         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         修改文件         C:\Sandbox\Administrator\LLQ\user\current\Local Settings\History\History.IE5\index.dat

2013-01-07 18:57:11         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         修改注册表项         HKUS\SANDBOX_ADMINISTRATOR_LLQ\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable

2013-01-07 18:57:13         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         修改注册表项         HKUS\SANDBOX_ADMINISTRATOR_LLQ\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer

2013-01-07 18:57:14         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         修改注册表项         HKUS\SANDBOX_ADMINISTRATOR_LLQ\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

2013-01-07 18:57:16         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         DNS/RPC 客户端访问         \RPC Control\DNSResolver

2013-01-07 18:57:22         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         修改文件         C:\Sandbox\Administrator\LLQ\user\current\IETldCache\index.dat

2013-01-07 18:57:25         C:\Sandbox\Administrator\LLQ\user\current\wgsdgsdgdsgsd.exe         修改注册表项         HKUS\SANDBOX_ADMINISTRATOR_LLQ\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
报告结束

katatlove

阻断

firefox3

katatlove 发表于 2013-1-7 19:13
阻断

这个貌似不对

FXA8

红伞Kill
开始在“F:\Downloads\wgsdgsdgdsgsd.zip”中扫描
F:\Downloads\wgsdgsdgdsgsd.zip
    [0] 存档类型: ZIP
    --> wgsdgsdgdsgsd.exe
        [检测]        是 TR/Tobfy.G.143 特洛伊木马
        [警告]        无法修复存档中的受感染文件！
  [注意]        一个备份被创建为“54ec3ba5.qua”(隔离区)
  [注意]        文件已删除！

蓝天二号

这种东西ESS当仁不让

tomochan

fireold

Kaspersky Internet Security 2013

zst470396853

网站被阻止！
G Data 互联网安全套装 2013已阻止访问此网站。
该站点包含被感染的代码：Trojan.Generic.KD.822258 (引擎A), Win32:Ransom-ADR [Trj] (引擎B)。

hddu

删除安全模式

firefox3

hddu 发表于 2013-1-7 22:23
删除安全模式

下手必须狠