誤報

lbb9432

Bullguard没报  360杀

cgfy

G data直接拦截下载

zhanghongyuan1

金山kill

倾枫锝渔♂

迷惘的执著 发表于 2012-2-28 13:02
ESS 不报，360kill了。。

eset报了~

绅博周幸

STOP! Bitdefender blocked this web page.





The page you are trying to access contains malware.


Details:
Web Page: http://bbs.kafan.cn/forum.php?mo ... 0ODc1fDEyMzE0OTM%3D
Detected viruses: Trojan.Dropper.UEA



Access from your browser has been blocked.

Take me back to safety

Nocria

ESS 报了
已经以误报的形式上报了

Nocria

ESS 报了
已经以误报的形式上报了

hddu

2012-02-29 16:26:39    创建文件      操作:允许
进程路径:F:\virus\175\175.EXE
文件路径:C:\Documents and Settings\Administrator\Application Data\Rubig
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2012-02-29 16:26:39    创建文件      操作:允许
进程路径:F:\virus\175\175.EXE
文件路径:C:\Documents and Settings\Administrator\Application Data\Rubig\laby.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*.exe


2012-02-29 16:26:40    创建文件      操作:允许
进程路径:F:\virus\175\175.EXE
文件路径:C:\Documents and Settings\Administrator\Application Data\Yrqyep
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2012-02-29 16:26:42    修改文件      操作:允许
进程路径:F:\virus\175\175.EXE
文件路径:C:\Documents and Settings\Administrator\Application Data\Rubig\laby.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*.exe


2012-02-29 16:26:42    运行应用程序      操作:允许
进程路径:F:\virus\175\175.EXE
文件路径:C:\Documents and Settings\Administrator\Application Data\Rubig\laby.exe
触发规则:应用程序规则->程序->?:\*


2012-02-29 16:26:43    修改其它进程内存      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Rubig\laby.exe
目标进程:C:\WINDOWS\explorer.exe
触发规则:所有程序规则->*


2012-02-29 16:26:43    修改其它进程内存      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Rubig\laby.exe
目标进程:C:\WINDOWS\mixer.exe
触发规则:所有程序规则->*


2012-02-29 16:26:43    修改其它进程内存      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Rubig\laby.exe
目标进程:C:\WINDOWS\system32\ctfmon.exe
触发规则:所有程序规则->*


2012-02-29 16:26:43    修改其它进程内存      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Rubig\laby.exe
目标进程:C:\Program Files\SogouExplorer\SogouExplorer.exe
触发规则:所有程序规则->*


2012-02-29 16:26:43    修改其它进程内存      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Rubig\laby.exe
目标进程:C:\Program Files\SogouExplorer\SogouExplorer.exe
触发规则:所有程序规则->*


2012-02-29 16:26:43    修改其它进程内存      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Rubig\laby.exe
目标进程:C:\Program Files\SogouExplorer\SogouExplorer.exe
触发规则:所有程序规则->*


2012-02-29 16:26:43    修改其它进程内存      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Rubig\laby.exe
目标进程:C:\Program Files\SogouExplorer\SogouExplorer.exe
触发规则:所有程序规则->*


2012-02-29 16:26:43    修改其它进程内存      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Rubig\laby.exe
目标进程:F:\virus\175\175.EXE
触发规则:所有程序规则->*


2012-02-29 16:26:45    运行应用程序      操作:允许
进程路径:F:\virus\175\175.EXE
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp71483981.bat"
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe


2012-02-29 16:26:47    删除文件      操作:允许
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:F:\virus\175\175.EXE
触发规则:应用程序规则->CMD设置->%windir%\system32\cmd.exe->?:\*