VT Detection ratio: 0 / 46 27KbNCC.exe

墨家小子

https://www.virustotal.com/en/fi ... nalysis/1368188139/

请勿实机运行，运行方式：rundll32.exe "C:\27KbNCC.exe",exp


2013-05-10 20:14:20         C:\Users\FF3\AppData\Local\Temp\27KbNCC.exe         修改文件         C:\ProgramData\qeqejeh.dat

2013-05-10 20:14:17         C:\Users\FF3\AppData\Local\Temp\27KbNCC.exe         Sandbox中运行         Partially Limited

2013-05-10 20:14:09         C:\Users\FF3\AppData\Local\Temp\27KbNCC.exe         修改文件         C:\ProgramData\fzdw0.dat

2013-05-10 20:14:07         C:\Windows\SysWOW64\control.exe         创建进程         C:\Users\FF3\AppData\Local\Temp\27KbNCC.exe

2013-05-10 20:14:02         C:\Users\FF3\AppData\Local\Temp\27KbNCC.exe         Sandbox中运行         Partially Limited

2013-05-10 20:13:24         C:\Program Files (x86)\Java\jre7\bin\java.exe         创建进程         C:\Users\FF3\AppData\Local\Temp\27KbNCC.exe

2013-05-10 20:13:22         C:\Users\FF3\AppData\Local\Temp\27KbNCC.exe         Sandbox中运行         Partially Limited

蓝天二号

360

Flameocean

fireold

GD 2014 雙擊攔截三次

第一次

*** Process ***

Process: 3920
File name: rundll32.exe
Path: c:\progra~2\rundll32.exe

Publisher: Microsoft Windows
Creation date: 05/19/13 23:11:59
Modification date: 05/19/13 23:11:59

Started by: rundll32.exe
Publisher: Microsoft Windows


*** Actions ***

The program has executed actions in the name of another program.
The program is trying to create a startup item to launch a program automatically at system startup.
An executable file was stored in a suspicious location.

YGLh25KJsHLiYmJy4sBygmJicoLQcoJygmJi4HJy+XJyLieHB6dCJycmJnRycCsnJyYmJweocnJiYnJygC4nJyYmJwe5YuHbcpmQLScH6XJy6XLycnL4oCcn3GJicsINmnLSJycvJ4ygKid9oCwnly4nLyeHD9pycmJicnLAKicoJiYnCM5ycmJicnLwKCcnJiYnB3cqJweHKicoJygmBoctJycmJicHly8nKCYmJwinKxq6NWYqKhq6NWYqJxq6NWYqCacuJ5cOxy8nly4nLyeHD+coJ3cMAA
Rules version: 4.1.0
OS: Windows 6.1 Service Pack 1.0 Build: 7601 - Workstation 32bit OS
dll version: 30732

C:\PROGRA~2\rundll32.exe C:\PROGRA~2\qecol9.dat,FG00
"C:\Windows\system32\rundll32.exe" "C:\27KbNCC.exe",exp

第二次

*** Process ***

Process: 5344
File name: rundll32.exe
Path: c:\windows\system32\rundll32.exe

Publisher: Microsoft Windows
Creation date: 07/14/09 03:21:29
Modification date: 07/14/09 01:14:31

Started by: explorer.exe
Publisher: Microsoft Windows


*** Actions ***

The program has executed actions in the name of another program.
The program is trying to create a startup item to launch a program automatically at system startup.
The program establishes a network connection.
A network connection was established using another programs context.
An executable file was stored in a suspicious location.

YGLxwuawcuJiYnLiwHKCYmJygtBysnKScoLgcnKbcnIqJ5cPp0InKHRyQicHt3KCcnJycoAqJygnJycHuHJycnJiYoAuJycmJicHuWLxot+QLScH6XJyq3JyLCeXDnpywi0mJifcoCkn3nJyLCd9oCon3qAsJ7cqJ8dycumgLScnJiYnB6xygmJicoLQKCfHcnIsJgbOcnJiYnJy8CgnJyYmJwd3KicHhyonKycpJwiHLScnJiYnB4cuJycnJyYGly8nKCYmJwinKxq6NWYqKxq6NWYqJxq6NWYqCqcuJ9cHxy8n1ycnmXJy6XCOcnLHAAA
Rules version: 4.1.0
OS: Windows 6.1 Service Pack 1.0 Build: 7601 - Workstation 32bit OS
dll version: 30732

"C:\Windows\system32\rundll32.exe" "C:\27KbNCC.exe",exp
C:\Windows\Explorer.EXE

第三次

*** Process ***

Process: 3548
File name: rundll32.exe
Path: c:\progra~2\rundll32.exe

Publisher: Microsoft Windows
Creation date: 05/19/13 23:11:59
Modification date: 05/19/13 23:11:59

Started by: rundll32.exe
Publisher: Microsoft Windows


*** Actions ***

The program has executed actions in the name of another program.
The program establishes a network connection.
A network connection was established using another programs context.

YGLRjHKIsHLicuJiYsBycmJicnLgcuIoJ9dywgu5YtGMogrpcuIsJ/dywg16csItJiYn3KApJ/dyci8mBqpycg/KcuIsJ/dywg3acnJycmJiwConKCcoJgbOcnJycmJi8CgnJyYmJweHLScnJiYnB5cvJygmJicIpysaujVmKigaujVmKicd2zVmKwenLifOcPxy4iwn93LCDecoJ3cAAA
Rules version: 4.1.0
OS: Windows 6.1 Service Pack 1.0 Build: 7601 - Workstation 32bit OS
dll version: 30732

C:\PROGRA~2\rundll32.exe C:\PROGRA~2\qecol9.dat,FG03
C:\PROGRA~2\rundll32.exe C:\PROGRA~2\qecol9.dat,FG00

skycai

Flameocean 发表于 2013-5-10 20:42

大费尔的动态防御，那是刚刚的~~

墨家小子

skycai 发表于 2013-5-20 08:06
大费尔的动态防御，那是刚刚的~~

误报也包括在内？

skycai

墨家小子 发表于 2013-5-20 09:27
误报也包括在内？

如果把那几个特定类型的误报，比如说某些腾讯游戏扣除。

其实费尔的误报并不那么多。

至少我的使用环境中（破解绿化极少），很安逸。