File name: fulchila.exe Detection ratio: 3 / 55 不服你就双击

杀软神马

AVA 25.5092
GD 25.6143

*** 进程 ***

进程: 4784
文件名: fulchila.exe
路径: c:\users\沙勇军\desktop\fulchila.exe

发行商：: 未知发行商
创建日期: 01/05/16 06:56:09
修改日期: 01/05/16 02:52:48

启动进程：: start.exe
发行商：: Invincea, Inc.


*** 操作 ***

程序已更改可能危及系统的注册表项值。
程序正试图建立自启动项，以在系统启动时自动运行。
程序正经过网络建立连接。
一个未知进程访问了。
程序已创建或已操作可执行文件。
该程序可以用户执行任何程序代码。
程序进行了自我复制。


*** 隔离区 ***

下列文件被转入隔离区：
C:\Users\沙勇军\Desktop\fulchila.exe
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\baidu\bdplayer\5.1.1.9\bduninstall.exe
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\7z.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\acauth.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\atl100.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\chrome.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\chrome_child.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\chrome_elf.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\chrome_watcher.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\config_updater.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\courgette.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\d3dcompiler_47.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\icsdhcp.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\pphelper\7z.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\pphelper\achievelib.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\pphelper\adbutil.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\pphelper\adbwinapi.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\pphelper\adbwinusbapi.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\5.5.9235.9\pphelper\devicehelper.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\downloader\download\atl71.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\downloader\download\dl_peer_id.dll
c:\sandbox\沙勇军\defaultbox\drive\c\program files (x86)\ucbrowser\temp\source6464_6384\chrome-bin\downloader\download\download_engine.dll
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\microsoft\windows\temporary internet files\content.ie5\ijxjix5a\7185bdf1gw1ewyl50mtpeg20go0a5u10[1].gif
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\microsoft\windows\temporary internet files\content.ie5\r5lvhqh1\7185bdf1gw1ezaqdv6z1eg20s60i07ww[1].gif
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\microsoft\windows\temporary internet files\counters.dat
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\12au7a794\appdata\homepage\0\website\bgsearch_day.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\12au7a794\appdata\thumb\http___browser.qq.com_new_wechat1.0.html_type=1.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\12au7a794\appdata\thumb\http___qzone.qq.com_.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\12au7a794\appdata\thumb\http___s.click.taobao.com_khr1bay.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\12au7a794\appdata\thumb\http___speed.qq.com_act_a20141103plan_.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\12au7a794\appdata\thumb\http___tq.qq.com_qbrcenter_index.html_adtag=8gongge.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\12au7a794\appdata\thumb\http___www.3366.com__adtag=cop.qqbrowser.8new.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\12au7a794\appdata\thumb\http___www.qq.com__pgv_ref=qqbrowserpc.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\12au7a794\appdata\thumb\https___mail.qq.com_.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\12au7a794\appdata\thumb\qqbrowser_home.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\12au7a794\bin\microsoft.vc90.crt\msvcm90.dll
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\12au7a794\bin\service\7z.exe
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\12au7a794\bin\service\xperf.exe
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\12au7a794\customerjoinplan.txt
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\12au7a794\license.txt
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\2.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\nssc21.tmp\base64.dll
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\nssc21.tmp\inetc.dll
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\nssc21.tmp\system.dll
c:\sandbox\沙勇军\defaultbox\user\current\appdata\local\temp\nssc21.tmp\zipdll.dll
c:\sandbox\沙勇军\defaultbox\user\current\appdata\roaming\tencent\qqbrowser\homepage\0\website\bgsearch_day.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\roaming\tencent\qqbrowser\thumb\http___browser.qq.com_new_wechat1.0.html_type=1.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\roaming\tencent\qqbrowser\thumb\http___qzone.qq.com_.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\roaming\tencent\qqbrowser\thumb\http___s.click.taobao.com_khr1bay.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\roaming\tencent\qqbrowser\thumb\http___speed.qq.com_act_a20141103plan_.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\roaming\tencent\qqbrowser\thumb\http___tq.qq.com_qbrcenter_index.html_adtag=8gongge.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\roaming\tencent\qqbrowser\thumb\http___www.3366.com__adtag=cop.qqbrowser.8new.jpg
c:\sandbox\沙勇军\defaultbox\user\current\appdata\roaming\tencent\qqbrowser\thumb\https___mail.qq.com_.jpg

下列注册表项被删除：

\registry\user\sandbox_沙勇军_defaultbox\machine\software\microsoft\windows nt\currentversion\image file execution options\qqbrowser.exe || disableexceptionchainvalidation
\registry\user\sandbox_沙勇军_defaultbox\machine\software\wow6432node\microsoft\active setup\installed components\65122cb0-ea0f-47df-a953-017170ed12f9 || stubpath
\registry\user\sandbox_沙勇军_defaultbox\machine\software\wow6432node\microsoft\windows\currentversion\run || bdplayer_autorun
\registry\user\sandbox_沙勇军_defaultbox\user\current\software\microsoft\windows\currentversion\internet settings\connections || savedlegacysettings

YGLRr3K8Cywnd3JycnIGLSdoLCeHcnKv4HJy+CwnzHJymAbocpJiYnKSkCgnKiYmJwq5YtGvcngPyXKikC0nCelysvZiYnKy9qAnJy4mJicOynKSjWJicpKNoC0nLicqJwqscvJycnLiwC8n5yYnLifXCI1ykrtiYnKSu9AtJ8liYnKSDO1ygmJicoLgJicIj3JyYmJycvAsJygmJicI/3KSi2JicpKLcGdyonKiYmJwh3KicqJiYnCnctJwaHKCYmJygnC4cqJyomJicNhyonJycpJwuoLhX2O2cigY/jVmKycXiDVmK3dw23KCYmJygnDscpJrYmJykmtw/HKS7WJicpLtcI5ysnD/coIpJycniICWcrJ3gPhy4mJicuKAaXLiAAA
规则版本： 5.0.77
OS: Windows 6.1 Service Pack 1.0 Build: 7601 - Workstation 64bit OS
DLL版本： 55982

"C:\Users\沙勇军\Desktop\fulchila.exe"
MD5: 9BEF1917E28115CA4C9C5878F2733BE3
"C:\Program Files\Sandboxie\Start.exe" /env:00000000_SBIE_CURRENT_DIRECTORY="C:\Users\沙勇军\Desktop" /env:=Refresh /elevate "C:\Users\沙勇军\Desktop\fulchila.exe"
MD5:

狐狸糊涂

BD双击

墨家小子

狐狸糊涂 发表于 2016-1-5 17:25
BD双击

我擦 你网速好快好快的

ccboxes

墨家小子 发表于 2016-1-5 17:29
我擦 你网速好快好快的

没办法，这类流氓下载器我都不测，下病毒的还能看防火墙，这就只能靠拉黑了。

墨家小子

ccboxes 发表于 2016-1-5 19:28
没办法，这类流氓下载器我都不测，下病毒的还能看防火墙，这就只能靠拉黑了。

服不服？

尘梦幽然

胖福 发表于 2016-1-5 13:55
提交了(Tracking #39527613)，提交也没啥意义，基本就是按照Trojan.Gen或者Trojan.Gen2入库，改下MD5照过 ...

你可以留意一下回复，这次应该是特征入库，但是需要一些时间才是真正的特征入库。
[mw_shl_code=css,true]Assessment

File1:        efc75a37b8d24b65b13f5179957df80af8f516c58aa9cfc63ae7c0ac51f27ae6
MD5:        0x9BEF1917E28115CA4C9C5878F2733BE3
SHA-1:        0xDF13360475A682C8C49D8962041840E66BC2A6F2
Machine:        Machine
Determination:        NewThreat
Submission Detail:        This file is detected as PUA.Downloader with our existing Rapid Release definition set. Protection is available in Rapid Release definitions with a sequence number of 171460 or greater.
Signature Protection Name:        PUA.Downloader
Rapid Release Sequence Number:        171460

This message was generated by Symantec Security Response automation.[/mw_shl_code]