一个小东西[AE8659]

红心王子

狮子挂
上报

野马

原帖由 hj5abc 于 2007-7-5 00:01 发表
微点报了? 真玄..

96658

promised

C:\ABC\AE8659.rar:\AE8659.EXE - Suspect code-parts found (Level: 100)
C:\ABC\AE8659.rar

        2 Files scanned
          (1 Archiv with 1 file)
        0 Signatures found
        1 Suspect code-part found
        Used time: 0:00.032

a256886572008

運行AE8659.EXE，發現下列行為，被EQ-Secure RC3攔截！

2007-07-05 09:25:12    創建文件      操作:允許
進程路徑:D:\桌面\virus\AE8659\AE8659.EXE
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:25:12    創建文件      操作:允許
進程路徑:D:\桌面\virus\AE8659\AE8659.EXE
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current\Local Settings
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:25:12    創建文件      操作:允許
進程路徑:D:\桌面\virus\AE8659\AE8659.EXE
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:25:12    創建文件      操作:允許
進程路徑:D:\桌面\virus\AE8659\AE8659.EXE
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:25:12    創建文件      操作:允許
進程路徑:D:\桌面\virus\AE8659\AE8659.EXE
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:25:12    修改文件      操作:允許
進程路徑:D:\桌面\virus\AE8659\AE8659.EXE
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:25:12    創建文件      操作:允許
進程路徑:D:\桌面\virus\AE8659\AE8659.EXE
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current\Local Settings
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:25:12    修改文件      操作:允許
進程路徑:D:\桌面\virus\AE8659\AE8659.EXE
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current\Local Settings
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:25:13    創建文件      操作:允許
進程路徑:D:\桌面\virus\AE8659\AE8659.EXE
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:25:13    創建文件      操作:允許
進程路徑:D:\桌面\virus\AE8659\AE8659.EXE
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp\fcd3_appcompat.txt
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:25:13    修改文件      操作:允許
進程路徑:D:\桌面\virus\AE8659\AE8659.EXE
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp\fcd3_appcompat.txt
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:25:13    修改文件      操作:允許
進程路徑:D:\桌面\virus\AE8659\AE8659.EXE
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp\fcd3_appcompat.txt
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*


2007-07-05 09:25:13    創建文件      操作:允許
進程路徑:C:\windows\system32\dwwin.exe
文件路徑:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp\B200C9.dmp
規則:所有程序規則->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

1.他會在C:\Documents and Settings\Hung  Jui Hung\Local Settings\Temp\生成
   fcd3_appcompat.txt
2.他會利用dwwin.exe在C:\Documents and Settings\Hung  Jui Hung\Local Settings\Temp\生成
   B200C9.dmp