111111111

bzaf868

1094947421

1073328164 发表于 2014-12-9 20:50
哇，好怀念的版本，当年把这货和卡巴2011装在一起都能兼容，你在虚拟机用的？

实机，win8.1x64

vm001

1094947421 发表于 2014-12-9 18:53
360云监控不报，扫描报毒

360杀毒..

1094947421

vm001 发表于 2014-12-9 21:09
360杀毒..

扫描只开了云和qvm，难道是qvm的误报

利刀1937

360安全

lovelive10010

基本信息
文件名称：       
nvssvc.exe
MD5：        f4fa0d3d2978c0f812a45f87143189d4
文件类型：        EXE
上传时间：        2014-12-09 21:32:28
出品公司：        N/A
版本：        1.0.0.0---1.0.0.0
壳或编译器信息：        COMPILER:Elan
关键行为
行为描述：        设置特殊文件夹属性
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
行为描述：        隐藏指定窗口
详情信息：       
[Window,Class] = [,Afx:400000:8:10011:1900015:0]
[Window,Class] = [,WTWindow]
进程行为
行为描述：        创建下载文件进程
详情信息：       
ImagePath = c:\monitor\Baidusd.Setup.2.1.0.3086.youqian_1000025647.exe, CmdLine = c:\monitor\Baidusd.Setup.2.1.0.3086.youqian_1000025647.exe
ImagePath = c:\monitor\BaiduAn.Setup.1117.3.0.0.3971_1000025647.exe, CmdLine = c:\monitor\BaiduAn.Setup.1117.3.0.0.3971_1000025647.exe
ImagePath = c:\monitor\bdBrowserSetup-5953-ftn_1000025647.exe, CmdLine = c:\monitor\bdBrowserSetup-5953-ftn_1000025647.exe
ImagePath = c:\monitor\service_680_11000.exe, CmdLine = c:\monitor\service_680_11000.exe
文件行为
行为描述：        设置特殊文件夹属性
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
网络行为
行为描述：        连接指定站点
详情信息：       
InternetConnectA: ServerName = dlsw.br.baidu.com, PORT = 80
InternetConnectA: ServerName = down.xiami321.com, PORT = 80
行为描述：        下载文件
详情信息：       
C:\monitor\Baidusd.Setup.2.1.0.3086.youqian_1000025647.exe
C:\monitor\BaiduAn.Setup.1117.3.0.0.3971_1000025647.exe
C:\monitor\bdBrowserSetup-5953-ftn_1000025647.exe
C:\monitor\service_680_11000.exe
行为描述：        读取网络文件
详情信息：       
hFile = 0x000006b0, BytesToRead =10240, BytesRead = 10240.
hFile = 0x000006a8, BytesToRead =10240, BytesRead = 10240.
hFile = 0x000006a4, BytesToRead =10240, BytesRead = 10240.
hFile = 0x000006b4, BytesToRead =10240, BytesRead = 10240.
行为描述：        打开HTTP请求
详情信息：       
HttpOpenRequestA: dlsw.br.baidu.com:80/ditui/zujian/baidusd.setup.2.1.0.3086.youqian_1000025647.exe, hConnect = 0x000006b4
HttpOpenRequestA: dlsw.br.baidu.com:80/ditui/zujian/baiduan.setup.1117.3.0.0.3971_1000025647.exe, hConnect = 0x000006ac
HttpOpenRequestA: dlsw.br.baidu.com:80/ditui/zujian/bdbrowsersetup-5953-ftn_1000025647.exe, hConnect = 0x000006b0
HttpOpenRequestA: down.xiami321.com:80/download/service_680_11000.exe, hConnect = 0x000006a8
其他行为
行为描述：        创建互斥体
详情信息：       
RasPbFile
行为描述：        隐藏指定窗口
详情信息：       
[Window,Class] = [,Afx:400000:8:10011:1900015:0]
[Window,Class] = [,WTWindow]

s22962000

https://www.virustotal.com/zh-tw ... nalysis/1418133983/
偵測率:         11 / 56

Avast         Win32:Malware-gen         20141209
Comodo         Worm.Win32.Dropper.RA         20141209
Cyren         W32/Agent.EW.gen!Eldorado         20141209
ESET-NOD32         a variant of Win32/FlyStudio         20141209
F-Prot         W32/Agent.EW.gen!Eldorado         20141209
F-Secure         Trojan:W32/DelfInject.R         20141209
Kaspersky         HEUR:Trojan-Downloader.Win32.Generic         20141209
Malwarebytes         Spyware.OnlineGames         20141209
McAfee         Artemis!F4FA0D3D2978         20141209
Norman         OnLineGames.LWBP         20141209
Sophos         Generic PUA CN         20141209

hzz2009

卡巴6了

QQ1014530747

hzz2009 发表于 2014-12-9 23:44
卡巴6了

就是卡巴杀出来的。发现还是卡巴凑会点

Love=卡巴+费尔