VT Detection ratio: 1 / 47 2364456.dll

墨家小子

https://www.virustotal.com/en/fi ... nalysis/1368962042/

fireold

GD 2014 執行後分三波攔截

*** Process ***

Process: 1556
File name: rundll32.exe
Path: c:\windows\system32\rundll32.exe

Publisher: Microsoft Windows
Creation date: 07/14/09 03:21:29
Modification date: 07/14/09 01:14:31

Started by: explorer.exe
Publisher: Microsoft Windows


*** Actions ***

The program has executed actions in the name of another program.
The program is trying to create a startup item to launch a program automatically at system startup.
The program has created or manipulated an executable file.
The program created a copy of itself.
An executable file was stored in a suspicious location.

sHJyKCYmJ4fAcoJiYnKC0HLycqJysuBycm5ycionxwynQicodHJCJwe3coJycnJygConKCcnJwe4cnJycmJigC4nJyYmJwe5QhavssuQLScI6XJyu3LCcnL6oCcn2mJicqINmnJy5nLCcnKGoCsnCcpycrtywnJy+qAtJycmJicHu3JyYmJycsAqJygmJicI/HJycnJiYtAoJy0nLCcHnXKCcnJyctAqJwv9YuGy4CwnJyYmJwePcnJiYnJy8CwnJycnJgZ3KicHhyonLicqJwqHKycnJiYnB4ctJycmJicHhy4nKCcoJgaXLycoJiYnCKcrGro1ZiorGro1ZionGro1ZioKpy4n1wnHLyfXKSeYcnJrAAA
Rules version: 4.1.0
OS: Windows 6.1 Service Pack 1.0 Build: 7601 - Workstation 32bit OS
dll version: 30732

"C:\Windows\system32\rundll32.exe" "C:\2364456.dll",exp
C:\Windows\Explorer.EXE

--------------------------------------------------------

*** Process ***

Process: 1516
File name: rundll32.exe
Path: c:\progra~2\rundll32.exe

Publisher: Microsoft Windows
Creation date: 05/19/13 11:25:08
Modification date: 05/19/13 11:25:08

Started by: rundll32.exe
Publisher: Microsoft Windows


*** Actions ***

The program has executed actions in the name of another program.
The program is trying to create a startup item to launch a program automatically at system startup.
An executable file was stored in a suspicious location.

sHJyKCYmJ4fAcoJiYnKC0HKycoJykuBycsxyci8npw2nQicnJiZ0cnArJycmJicHqHJyYmJycoAuJycmJicHuUIWf3L7kC0nCOlycvpycisnlwp6cqItJiYn2qApJ2coJ7dy4g3KcnL6cnIrJ5cK2nJyYmJycrArJycmJicHrHKCYmJygtAoJycmJicHnXJycnJiYtAqJwf9YtFy4CwnJyYmJwePcnJiYnJycKdycnCocqJygnKCcLhycmJicnJw2HJyYmJycnD5coJiYnKCcLqioVtjpqKioVtjpnKioVtjppJw6nJya3D8cnJrcnIrJ5cLAA
Rules version: 4.1.0
OS: Windows 6.1 Service Pack 1.0 Build: 7601 - Workstation 32bit OS
dll version: 30732

C:\PROGRA~2\rundll32.exe C:\PROGRA~2\eg4r.dat,FG00
"C:\Windows\system32\rundll32.exe" "C:\2364456.dll",exp

--------------------------------------------------------------------------

*** Process ***

Process: 1652
File name: rundll32.exe
Path: c:\progra~2\rundll32.exe

Publisher: Microsoft Windows
Creation date: 05/19/13 11:25:08
Modification date: 05/19/13 11:25:08

Started by: rundll32.exe
Publisher: Microsoft Windows


*** Actions ***

The program has executed actions in the name of another program.
The program establishes a network connection.
A network connection was established using another programs context.


*** Quarantine ***

The following files were moved into quarantine:

The following registry entries were deleted:


YGLRjMIIKyeHcnIoJgYsJycmJicHLScoJygmBi4nvnJyLSfskCsWzSh5kC4nzHJyLyfaoCcn2mJicqINmnJyLyf3YmKgKif3oCwnzHJyLyfaoC0nJycnJgascoJygmJi4CwnJycnJgaPcnJiYnJycKhygnKCYmJw2HJyYmJycnD5coJiYnKCcLqioVtjpoKioVtjpnLSsV1jtnJw6nLCDMcvJ8xyci8n2nCOcnILAA
Rules version: 4.1.0
OS: Windows 6.1 Service Pack 1.0 Build: 7601 - Workstation 32bit OS
dll version: 30732

C:\PROGRA~2\rundll32.exe C:\PROGRA~2\eg4r.dat,FG03
C:\PROGRA~2\rundll32.exe C:\PROGRA~2\eg4r.dat,FG00

/tiao眼镜鱼

dreams521

QVM27

墨家小子

fireold 发表于 2013-5-19 19:30
GD 2014 執行後分三波攔截

我晕。。。。主防升级了？？？？

fireold

墨家小子 发表于 2013-5-19 19:33
我晕。。。。主防升级了？？？？

還頭一次看到這種狀況…

墨家小子

fireold 发表于 2013-5-19 19:37
還頭一次看到這種狀況…

应该是主防升级了

a445441

gy123

费尔一点都不提示实机双击

墨家小子

gy123 发表于 2013-5-19 21:59
费尔一点都不提示实机双击

你是win8 X64？