exa95ip.exe&qE6.exe[VS 7/37] DeepGuard可攔截

显示全部楼层 · 发表于 2012-12-14 15:00:50

MSE解压杀

显示全部楼层 · 发表于 2012-12-14 15:14:43

本帖最后由 darkwolf_99 于 2012-12-14 15:15 编辑

惯例——win7x64，SSF+SBie，以后只测两者的组合，省时间，也是我实机的组合

exa95ip.exe——SSF没有反应，样本秒退，BSA无可疑报告

以下是qE6.exe

BSA

Detailed report of suspicious malware actions:

Defined file type created: C:\Users\Evangeline\AppData\Roaming\Ovuwwe\livi.exe
Defined registry AutoStart location created or modified: user\current\software\Microsoft\Windows\CurrentVersion\Run\{0B1B4EEE-BCD3-AD41-E2FB-11F8D57D32E5} = C:\Users\Evangeline\AppData\Roaming\Ovuwwe\livi.exe
Internet connection: C:\Sandbox\Evangeline\DefaultBox\user\current\AppData\Roaming\Ovuwwe\livi.exe Connects to "124.123.202.174" on port 15485 (TCP).
Internet connection: C:\Sandbox\Evangeline\DefaultBox\user\current\AppData\Roaming\Ovuwwe\livi.exe Connects to "178.24.248.112" on port 29246 (TCP).
Queried DNS: dns.msftncsi.com

显示全部楼层 · 发表于 2012-12-14 19:28:44

显示全部楼层 · 发表于 2012-12-14 20:47:14

Dr.Web

C:\users\lin\downloads\exa95ip.exe&qe6.exe\exa95ip.exe - infected with Trojan.PWS.Panda.3241
C:\users\lin\downloads\exa95ip.exe&qe6.exe\qe6.exe - infected with Trojan.PWS.Panda.3241

[病毒样本] exa95ip.exe&qE6.exe[VS 7/37] DeepGuard可攔截

本帖子中包含更多资源

本帖子中包含更多资源