VT Detection ratio: 3 / 50 JR.exe 略屌

进击滴213

第一个FS毒库杀

Renascence

GD2015扫描全杀：


关闭病毒监控:

双击JR.exe，程序无反应，系统Windows8.1 X64;

ho.exe、fiqo.exe双击后均被GD主防截杀：


*** Process ***
Process: 1368
File name: ho.exe
Path: c:\users\XXX\desktop\ho.exe
Publisher: Unknown publisher
Creation date: 03/18/14 12:31:08
Modification date: 03/04/14 12:40:13
Started by: explorer.exe
Publisher: Microsoft Windows

*** Actions ***
The virus scanner has detected that the file is malicious.
The program has created or manipulated an executable file.
The program created a copy of itself.
An executable file was stored in a suspicious location.

*** Quarantine ***
The following files were moved into quarantine:
C:\Users\XXX\Desktop\ho.exe
C:\Users\XXX\zisedarqozyv.exe
c:\users\XXX\zisedarqozyv.exe
The following registry entries were deleted:

YHLS0HJycnJiYuBycisnt2Ji8HJycnJiYnAqdHJCJycmBrdycnJyYmKQKycL/HJycnJiYvAsJycnJyYGhyonJycnJgaHLicnJycmBqcrG/81ZionG/81ZionJgbnKCcH9ygnBwA
Rules version: 4.4.8
OS: Windows 6.2 Service Pack 0.0 Build: 9200 - Workstation 64bit OS
dll version: 40166
"C:\Users\XXX\Desktop\ho.exe"
MD5: 2EBD52B41129C23C92C012567412F9D3
C:\Windows\Explorer.EXE
MD5:


*** Process ***
Process: 3596
File name: fiqo.exe
Path: c:\users\XXX\desktop\fiqo.exe
Publisher: Unknown publisher
Creation date: 03/18/14 12:31:32
Modification date: 09/04/13 10:05:04
Started by: fiqo.exe
Publisher: Unknown publisher

*** Actions ***
The virus scanner has detected that the file is malicious.
A packer was run on the program file, possibly to conceal malicious content.
The program file header contains an error.
The program was modified in memory.

*** Quarantine ***
The following files were moved into quarantine:
C:\Users\XXX\Desktop\fiqo.exe
The following registry entries were deleted:

YHLi8HJycnJiYnAqdHJCJycmBrdycnJyYmJwLCcnJycmBphiwXJiwXJiYpArJwqccnJycmJi4CsWKQfeYpFycLqi4TVmKycaXmO2cmJicI5ywnCPcnIAAA
Rules version: 4.4.8
OS: Windows 6.2 Service Pack 0.0 Build: 9200 - Workstation 64bit OS
dll version: 40166
C:\Users\XXX\Desktop\fiqo.exe
MD5: AFBDF78BB721AF2967BA262D2A422AA2
"C:\Users\XXX\Desktop\fiqo.exe"
MD5: AFBDF78BB721AF2967BA262D2A422AA2
*** Process ***
Process: 3596
File name: fiqo.exe
Path: c:\users\XXX\desktop\fiqo.exe
Publisher: Unknown publisher
Creation date: 03/18/14 12:31:32
Modification date: 09/04/13 10:05:04
Started by: fiqo.exe
Publisher: Unknown publisher

*** Actions ***
The virus scanner has detected that the file is malicious.
A packer was run on the program file, possibly to conceal malicious content.
The program file header contains an error.
The program was modified in memory.

*** Quarantine ***
The following files were moved into quarantine:
C:\Users\XXX\Desktop\fiqo.exe
The following registry entries were deleted:

YHLi8HJycnJiYnAqdHJCJycmBrdycnJyYmJwLCcnJycmBphiwXJiwXJiYpArJwqccnJycmJi4CsWKQfeYpFycLqi4TVmKycaXmO2cmJicI5ywnCPcnIAAA
Rules version: 4.4.8
OS: Windows 6.2 Service Pack 0.0 Build: 9200 - Workstation 64bit OS
dll version: 40166
C:\Users\XXX\Desktop\fiqo.exe
MD5: AFBDF78BB721AF2967BA262D2A422AA2
"C:\Users\XXX\Desktop\fiqo.exe"
MD5: AFBDF78BB721AF2967BA262D2A422AA2