灰常新鲜的后门病毒

230f4

infected

僵尸爱上猫

regds.exe -- Detections(6/56)
29c3f34338b6a490bfc0f8023525c73d
-------------------------------

Fortinet	W32/Injector.CDIF!tr
CAT-QuickHeal	TrojanPWS.Zbot.VA3
VIPRE	Backdoor.Win32.Netwiredrc.c (v)
AVware	Backdoor.Win32.Netwiredrc.c (v)
Kaspersky	Backdoor.Win32.DarkKomet.fplz
ESET-NOD32	a variant of Win32/Injector.CDPE
Bkav	CLEAN
TotalDefense	CLEAN
MicroWorld-eScan	CLEAN
nProtect	CLEAN
McAfee	CLEAN
Malwarebytes	CLEAN
Zillya	CLEAN
SUPERAntiSpyware	CLEAN
TheHacker	CLEAN
Alibaba	CLEAN
K7GW	CLEAN
K7AntiVirus	CLEAN
Arcabit	CLEAN
Agnitum	CLEAN
F-Prot	CLEAN
Symantec	CLEAN
TrendMicro-HouseCall	CLEAN
Avast	CLEAN
ClamAV	CLEAN
BitDefender	CLEAN
NANO-Antivirus	CLEAN
ViRobot	CLEAN
Tencent	CLEAN
Ad-Aware	CLEAN
Emsisoft	CLEAN
Comodo	CLEAN
F-Secure	CLEAN
DrWeb	CLEAN
TrendMicro	CLEAN
McAfee-GW-Edition	CLEAN
Sophos	CLEAN
Cyren	CLEAN
Jiangmin	CLEAN
Avira	CLEAN
Antiy-AVL	CLEAN
Kingsoft	CLEAN
Microsoft	CLEAN
AegisLab	CLEAN
AhnLab-V3	CLEAN
GData	CLEAN
ByteHero	CLEAN
ALYac	CLEAN
VBA32	CLEAN
Baidu-International	CLEAN
Zoner	CLEAN
Rising	CLEAN
Ikarus	CLEAN
AVG	CLEAN
Panda	CLEAN
Qihoo-360	CLEAN

pal家族

Filename: regds.exe
Threat name: SONAR.SuspDataRunFull Path: Not Available

SONAR.SuspDataRun is a heuristic detection that is designed to detect suspicious modifications to a computer's startup behaviors and application data folders

____________________________

____________________________


On computers as of 
2015/7/2 at 11:18:26

Last Used 
2015/7/2 at 11:18:26

Startup Item 
No

Launched 
Yes

SONAR Protection monitors for suspicious program activity on your computer.


____________________________


regds.exe Threat name: SONAR.SuspDataRun
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.


____________________________


Source: External Media

Source File:
winrar.exe

File Created:
regds.exe

____________________________

File Actions

File: e:\迅雷下载\regds\ regds.exe Threat Removed
File: c:\users\我就是小之之\appdata\roaming\java\ winvncsv.exe Threat Removed
Directory: c:\users\我就是小之之\appdata\roaming\ java Threat Removed
____________________________

Registry Actions

Registry change: HKEY_USERS\S-1-5-21-3586500503-2481598044-4063237542-1001\Software\ SogouInput.user->SogouComponentFirstLoad:1435807088, Registry Hive: 64 bit Repaired
Registry change: HKEY_USERS\S-1-5-21-3586500503-2481598044-4063237542-1001\Software\ SogouInput.user->Used:1435807088, Registry Hive: 64 bit Repaired
____________________________

System Settings Actions

Event: Process start (Performed by e:\迅雷下载\regds\regds.exe, PID:6808) No action taken
(Performed by e:\迅雷下载\regds\regds.exe, PID:6808) No action taken
Event: PE file creation: c:\users\我就是小之之\appdata\roaming\java\ winvncsv.exe (Performed by e:\迅雷下载\regds\regds.exe, PID:6808) No action taken
Event: Process start: e:\迅雷下载\regds\ regds.exe, PID:6808 (Performed by e:\迅雷下载\regds\regds.exe, PID:6808) No action taken
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

http://www.symantec.com/security_response/writeup.jsp?docid=2014-060411-4957-99

dongwenqi

卡巴入库了，360尽快入库

EnZhSTReLniKoVa

双击没过掉BD  AVC防御

EnZhSTReLniKoVa

僵尸爱上猫 发表于 2015-7-2 11:15
regds.exe -- Detections(6/56)
29c3f34338b6a490bfc0f8023525c73d
-------------------------------

BD不杀 不代表能过AVC。

僵尸爱上猫

君陌潇 发表于 2015-7-2 11:23
BD不杀 不代表能过AVC。

这个是
我上传个扫描结果
最近不太双击了

llcy

QVM03

fish

竟然有飞塔入库带云杀软没入库的样本

fuzhk

FSCS
DG Blocked