xKqhJ.exe

a256886572008

http://camas.comodo.com/cgi-bin/submit?file=47768a9d308a0b704de8f3ce21fca2d103175abc6ec745a2705117c333481a7f

‧ Verdict
Auto Analysis Verdict
Suspicious+

‧ Description
Suspicious Actions Detected
Copies self to other locations
Creates autorun records
Injects code into other processes

-------------------------------------------------------------------------



2012，雲鑑定真快

沒有雲的殺軟，查殺速度快跟不上了

Nocria

clean

jayavira

to eset

http://samples.nod32.com.hk/inde ... 2b381ac5a273ac6af0d

留侯

大蜘蛛：
xKqhJ.exe infected with Win32.HLLW.Autoruner.52574

saga3721

红伞杀“TR/Ircbrute.A.1357 [trojan]”

dannes456

卡巴网页防护阻止下载

bvc

卡巴杀

weipengsmile

CAV kill

hddu

2011-06-27 11:30:57    创建文件      操作:允许
进程路径:F:\virus\xKqhJ\xKqhJ.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\F8C1AE91\cr[1].exe
触发规则:所有程序规则->IE临时文件夹设置->?:\Documents and Settings\*\Local Settings\Temporary Internet Files\*.exe


2011-06-27 11:31:00    运行应用程序      操作:允许
进程路径:F:\virus\xKqhJ\xKqhJ.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\hJfVh.exe
触发规则:所有程序规则->其它程序设置->*\Temp\*


2011-06-27 11:31:02    运行应用程序      操作:允许
进程路径:F:\virus\xKqhJ\xKqhJ.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c ""C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\uAtCW.bat" "
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe


2011-06-27 11:31:05    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\WINDOWS\system32\reg.exe
命令行:ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Serivces" /t REG_SZ /d "C:\Documents and Settings\Administrator\Application Data\Microsoft\#scvhost.exe" /f
触发规则:所有程序规则->系统程序设置->*\reg.exe


2011-06-27 11:31:06    创建文件      操作:阻止
进程路径:F:\virus\xKqhJ\xKqhJ.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\#scvhost.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\Microsoft\*.exe


2011-06-27 11:31:06    创建文件      操作:阻止
进程路径:F:\virus\xKqhJ\xKqhJ.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\#scvhost.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\Microsoft\*.exe


2011-06-27 11:33:18    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\hJfVh.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\hJfVh.exe
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-06-27 11:33:20    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\hJfVh.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c ""C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\BLJVt.bat" "
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe


2011-06-27 11:33:20    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\WINDOWS\system32\reg.exe
命令行:ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Serivces" /t REG_SZ /d "C:\Documents and Settings\Administrator\Application Data\Microsoft\#scvhost.exe" /f
触发规则:所有程序规则->系统程序设置->*\reg.exe


2011-06-27 11:33:20    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\hJfVh.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\#scvhost.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\Microsoft\*.exe


2011-06-27 11:33:20    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\hJfVh.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\#scvhost.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\Microsoft\*.exe

恋亿晓

to avast!