fake AV 真連結[Fake AV Download Site][检测 BY S.A]

a256886572008

1. http://46.161.11.215/index.php?390X=3J0HP3YT68E3S8YP5122EAKC5&7aw5z=xdcPEo9WWwrVEgzV2hZU085Xy4kbDQ7&m6F=fXh7MH0zdyoBSDsldVABUANQBwEqD&dRHH=l05WDZBJSRcXFdOOXB6dxtxA3kFDQoY&4d6L=B4W4836LNHLLOFV54GCB1436564K863611P2Q55TDA4XCF&6hn5=NR&Jfa1=U&0w=6M63B04R0707&0CiF=W5Q17H5X&sxs=AFXUwBQYAtjVwFlJSRQUTIHVXADOUp8BQN1CABkBgQJQ1Y5RA%3D%3D#9

复制代码

----------------------------------
http://camas.comodo.com/cgi-bin/submit?file=a2e99504aa8f55af8031fdaf36c231bc3fe2651fe92ed5e25cce10c9e532eed7

Auto Analysis Verdict
Suspicious

Suspicious Actions Detected
Creates and executes scripts

---------------------------------------

2011-06-12 10:51:06   C:\Documents and Settings\Roger\桌面\VIRUS\pack\pack.exe   Sandboxed As   Partially Limited   

2011-06-12 10:51:10   C:\WINDOWS\system32\taskkill.exe   Sandboxed As   Partially Limited   

2011-06-12 10:51:12   C:\WINDOWS\system32\ping.exe   Sandboxed As   Partially Limited   

2011-06-12 10:51:20   C:\Documents and Settings\Roger\桌面\VIRUS\pack\pack.exe   Modify Key   HKUS\S-1-5-21-1214440339-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\pack   

2011-06-12 10:51:20   C:\WINDOWS\system32\taskkill.exe   Access COM Interface   C:\WINDOWS\system32\svchost.exe   

2011-06-12 10:51:20   C:\WINDOWS\system32\taskkill.exe   Modify File   C:\WINDOWS\system32\wbem\Logs\wbemprox.log   

2011-06-12 10:51:20   C:\WINDOWS\system32\taskkill.exe   Modify File   C:\Documents and Settings\Roger\桌面\VIRUS\pack\pack.exe   

----------------------------------------------------
這網址，病毒收集人可以收藏，常常更新。

pack 系列 fake AV，行為都一樣。

JusT.Like

虽然作者很努力的更新，但G Data 2012 BB 只认行为

*** Actions ***
The program is trying to create a startup item to launch a program automatically at system startup.
The program has created or manipulated an executable file.
The program created a copy of itself.

qq541471559

下载物小a报了、FS报了