VT Detection ratio: 1 / 46 1077361.dll

显示全部楼层 · 发表于 2013-5-19 10:40:59

https://www.virustotal.com/en/fi ... nalysis/1368931101/

Malwarebytes Trojan.FakeMS 20130518

命名真亮

显示全部楼层 · 发表于 2013-5-19 10:41:52

显示全部楼层 · 发表于 2013-5-19 11:16:21

显示全部楼层 · 发表于 2013-5-19 14:11:40

Win32.Heur.KVMF16.hy.(kcloud)

显示全部楼层 · 发表于 2013-5-19 14:26:36

显示全部楼层 · 发表于 2013-5-19 15:30:02

显示全部楼层 · 发表于 2013-5-19 16:09:01

过ESET

显示全部楼层 · 发表于 2013-5-19 19:56:08

G Data

*** Process ***

Process: 5996
File name: rundll32.exe
Path: c:\windows\system32\rundll32.exe

Publisher: Microsoft Windows
Creation date: 07/14/09 03:21:29
Modification date: 07/14/09 01:14:31

Started by: explorer.exe
Publisher: Microsoft Windows

*** Actions ***

The program has executed actions in the name of another program.
The program is trying to create a startup item to launch a program automatically at system startup.
An executable file was stored in a suspicious location.

YGLhKZwPKycsJiYnDCwnKCYmJwgtJysnKScILie3KiencnJqgC4nJyYmJwe5YuEpaw/ZcnKQLifHKyfHcnL6oCcn/GJicsIPmnLyKyfHctIPqnLyC8pycrxyciwnpw+scoJiYnKC0Cgn13JyLCcHj3JyYmJycnCncnJwqHKycpJygnDYcnJiYnJycOhycnJyYmJw+XKCYmJygnC64tE1ZikpGro1ZionHl1jloJw2nKSYmJyknDqcnKOcPxyco5ykiknpw/nKCfZAAA
Rules version: 4.1.0
OS: Windows 6.1 Service Pack 1.0 Build: 7601 - Workstation 32bit OS
dll version: 30732

"C:\Windows\system32\rundll32.exe" "C:\1077361.dll",exp
C:\Windows\Explorer.EXE

显示全部楼层 · 发表于 2013-5-19 20:05:22

G Data 8樓攔截後，重啟電腦出現短暫白屏後，再攔截二次。

*** Process ***

Process: 4448
File name: rundll32.exe
Path: c:\windows\system32\rundll32.exe

Publisher: Microsoft Windows
Creation date: 07/14/09 03:21:29
Modification date: 07/14/09 01:14:31

Started by: explorer.exe
Publisher: Microsoft Windows

*** Actions ***

The program has executed actions in the name of another program.
The program is trying to create a startup item to launch a program automatically at system startup.
An executable file was stored in a suspicious location.

YGLR64LdsHKiYmJyosBygmJicoLQcnJycmJi4HJymnJyLyeHCqdCJyh0ckInB7dygnJycnKAKicoJycnB7hycnJyYmKALicnJiYnB7li0eviDNlycpAuJ6ctJ+dycvigJye7YmJysguacvIoJ+dy0gqqcvIIynJy2nJyLieHD6xygmJicoLQKCfncnIuJgaPcnJiYnJycKdycnCocnJycmJicNhycmJicnJw+XKCYmJygnC60rFdY7aSoqFbY6Zy0rFdY7aCcOpycvxw/HJy/HKiJieHD+coJ9cAAA
Rules version: 4.1.0
OS: Windows 6.1 Service Pack 1.0 Build: 7601 - Workstation 32bit OS
dll version: 30732

"C:\Windows\System32\rundll32.exe" C:\PROGRA~2\eg4r.dat,FG00
C:\Windows\Explorer.EXE

---------------------------------------------------

*** Process ***

Process: 2716
File name: skype.dat
Path: c:\users\abc\appdata\roaming\skype.dat

Publisher: Unknown publisher
Creation date: 02/28/12 12:03:44
Modification date: 11/17/11 05:38:39

Started by: userinit.exe
Publisher: Microsoft Windows

*** Actions ***

The program has executed actions in the name of another program.
The program establishes a network connection.
A network connection was established using another programs context.
An executable file was stored in a suspicious location.

*** Quarantine ***

The following files were moved into quarantine:
C:\Users\abc\AppData\Roaming\skype.dat

The following registry entries were deleted:

YGLhLdkOKydpKyYmJ2kLLCfHYmJycgwtJysmJicLLienKSeXcnJpcCp0ckInJyYGt3JycnJiYpArFt6Su5AuJ6diYnJyCspyciomJienoC0nJyYmJwebcqJiYnKiwConJycnJgbOcnJiYnJycGdycmJicnJwh3JyYmJycnD3cnJiYnJycKhyomJicqJwuHKyYmJysnDYcnJiYnJycPlycicmJid3cLrCsTVmKikXxjVmKyccW2OmgnB7cnJycmJicPtycnJyYmJw7HKCYmJygnD8cnIqJiYnp3COcrIKAA
Rules version: 4.1.0
OS: Windows 6.1 Service Pack 1.0 Build: 7601 - Workstation 32bit OS
dll version: 30732

C:\Users\abc\AppData\Roaming\skype.dat
C:\Windows\system32\userinit.exe

显示全部楼层 · 发表于 2013-5-19 20:16:28

fireold 发表于 2013-5-19 20:05
G Data 8樓攔截後，重啟電腦出現短暫白屏後，再攔截二次。

不错，GD主防提升很大，你再看看之前的那些dll

[可疑文件] VT Detection ratio: 1 / 46 1077361.dll

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源