hxxp://rw.behr.sites.uol.com.br/imagem/ie8.htm

a256886572008

http://camas.comodo.com/cgi-bin/submit?file=ba1c08d9248b328917ad1ab7a84730d137a03a1210eca83f69df2bf0f64ec2df

• Verdict
Auto Analysis Verdict
Suspicious+

• Description
Suspicious Actions Detected
Creates autorun records

----------------------------------------------------------

2011-06-28 11:11:44   C:\Documents and Settings\Roger\桌面\VIRUS\ie8\ie8.exe   Sandboxed As   Partially Limited   

2011-06-28 11:11:46   C:\Documents and Settings\Roger\桌面\VIRUS\ie8\ie8.exe   Access COM Interface   Shell.Explorer.2   

2011-06-28 11:12:18   C:\Documents and Settings\Roger\桌面\VIRUS\ie8\ie8.exe   Modify Key   HKUS\S-1-5-21-1214440339-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run\javaw   

2011-06-28 11:13:39   C:\Documents and Settings\Roger\桌面\VIRUS\ie8\ie8.exe   Scanned Online and Found Malicious  

訪問網路

-----------------------------------------------------------------
comodo 雲查殺

2011-06-28 11:13:51   C:\Documents and Settings\Roger\桌面\VIRUS\ie8\ie8.exe   
CloudBehavior.Suspicious@1   

z2009

过kav 2012
毒霸 2012下载保护杀

Nocria

clean

blue_仰望

to avira


Dear Sir or Madam,

Thank you for your submission. Your tracking number is 772126. Please always state your tracking number if contacting support.

This email is automatically generated. Please do not reply to it. At the time the result of the technical analysis is ready we will send a reply including results.


Additionally you will be able to see it online here:
http://analysis.avira.com/sample ... p;incidentid=772126

An overview of your previous submissions can be accessed here:
http://analysis.avira.com/sample ... 2d3SgT7Q9LTNAsjHET6


Sincerely yours,
Avira Virus Lab Response Team

歌歌的人

过AVG，上报

bvc

卡巴 miss

ywsuda

完整路径: 不可用
____________________________
____________________________
在电脑上的创建时间:
2011/6/28 ( 11:49:38 )
上次使用时间:
2011/6/28 ( 11:49:38 )
启动项:
否
已启动:
是
____________________________
____________________________
极少用户信任的文件
诺顿社区中有不到 5 名用户使用了此文件。
____________________________
高
此文件具有高风险。
____________________________
威胁详细信息
SONAR 主动防护监视电脑上的可疑程序活动。
____________________________
来源
下载自  URL 不可用

源文件:
winrar.exe
创建的文件:
ie8.exe
____________________________
文件操作
文件: c:\users\yw\desktop\ie8.exe
已删除
____________________________
系统设置操作
事件: 进程启动 (Performed by c:\users\yw\desktop\ie8.exe, PID:5020)
未采取操作
____________________________
文件指纹 - SHA:
不可用
____________________________
文件指纹 - MD5:
不可用
____________________________

sanhu35

金山 kill

-oAo-

360未知

maomao110

歌歌的人 发表于 2011-6-28 11:23
过AVG，上报

还过IDP的啊？