VT Detection ratio: 2 / 46 4720825.exe

显示全部楼层 · 发表于 2013-5-20 23:45:02

https://www.virustotal.com/en/fi ... nalysis/1369064583/

显示全部楼层 · 发表于 2013-5-20 23:45:20

显示全部楼层 · 发表于 2013-5-21 03:32:57

显示全部楼层 · 发表于 2013-5-21 07:04:39

G Data

*** Process ***

Process: 4000
File name: 3080458.exe
Path: c:\users\blue\appdata\local\temp\3080458.exe

Publisher: Unknown publisher
Creation date: 05/20/13 23:00:32
Modification date: 05/20/13 23:00:32

Started by: 4720825.exe
Publisher: Unknown publisher

*** Actions ***

A packer was run on the program file, possibly to conceal malicious content.
The program has changed values in the system registry that can be used to endanger the system.

*** Quarantine ***

The following files were moved into quarantine:
C:\Users\blue\AppData\Local\Temp\3080458.exe
C:\Users\blue\Desktop\4720825\4720825.exe

The following registry entries were deleted:
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe

YGLRrIINLCcnJiYnBy4n+XKCJyfncCp0skInKnRycCsnKycqJwfHcqJyomJigConKyYqJwe4cnJiYnJygCwnKicqJgaJcnJiYnJykCsWzSoKyXJykC4nJyYmJwfKcnJiYnJycKdycnD3cnJycmJicLrikV1jtoKCYVhjtnLikV1jtnJw/HJyYmJycnCOcsIAAA
Rules version: 4.1.0
OS: Windows 6.2 Service Pack 0.0 Build: 9200 - Workstation 32bit OS
dll version: 30732

"C:\Users\blue\AppData\Local\Temp\3080458.exe"
"C:\Users\blue\Desktop\4720825\4720825.exe"

显示全部楼层 · 发表于 2013-5-21 10:51:50

过诺顿，自删除！

[可疑文件] VT Detection ratio: 2 / 46 4720825.exe

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源