調用IE，修改host文件

a256886572008

http://camas.comodo.com/cgi-bin/submit?file=68da295f1938907e2ec2678ab7dacddf030751f24bcb2a0e67eb098e0d10dd1a

Auto Analysis Verdict
Suspicious

Suspicious Actions Detected
Copies self to other locations

-----------------------------------------

2011-06-09 20:48:41   C:\Documents and Settings\Roger\桌面\VIRUS\dire_expless_252\dire_expless_252.exe   Sandboxed As   Partially Limited   

2011-06-09 20:48:45   C:\Program Files\Internet Explorer\iexplore.exe   Sandboxed As   Partially Limited   

2011-06-09 20:48:47   C:\Documents and Settings\Roger\桌面\VIRUS\dire_expless_252\dire_expless_252.exe   Modify File   C:\Documents and Settings\Roger\Application Data\iexplore.exe   

2011-06-09 20:48:47   C:\Program Files\Internet Explorer\iexplore.exe   Modify File   C:\WINDOWS\System32\drivers\etc\hosts   

瓜皮猫

to eset

121940966

双击

will

hj5abc

作案未遂

haol

上報 DrWeb

fatezero

扫描不报

armchan

121940966 发表于 2011-6-9 21:03
双击

毒霸的防护亮了

JusT.Like

G Data 2012 BB Blocked

*** Process ***

Process: 304
File name: dire_expless_252.exe
Path: c:\users\vinsk_lee\desktop\dire_expless_252.exe
Publisher: Unknown publisher
Creation date: 06/09/11 15:13:47
Modification date: 06/09/11 11:44:56
Started by: start.exe
Publisher: SANDBOXIE L.T.D

*** Actions ***

The program has written to files or folders that can be used to endanger the system.
The program is trying to create a startup item to launch a program automatically at system startup.
The program has created or manipulated an executable file.
The program created a copy of itself.

*** Quarantine ***

The following files were moved into quarantine:
C:\Users\Vinsk_Lee\Desktop\dire_expless_252.exe
D:\Applic\Sandbox\Vinsk_Lee\TEST\user\current\AppData\Roaming\iexplore.exe

The following registry entries were deleted:

sanhu35

Roger 又出现了 哈哈