secure

solcroft

越来越佩服微软了，什么时候有空试试看OneCare...
http://www.virustotal.com/analisis/c878305b6b2ef61e2a9756eff94dfd59

mofunzone

运行后什么也没发生？？

solcroft

Patience, young grasshopper.

挪威的冬天

金山毒霸 0

电影结束了

。。。
等了一分钟没啥行为

傻猪猪米走鸡

young grasshopper是什么意思呢？年轻的蚱蜢？还是意味着什么？

傻猪猪米走鸡

难道就是指心急的人？

电影结束了

• The following file was created in the system:

#	Filename(s)	File Size	File MD5	Alias
1	%AppData%\xycif.exe [file and pathname of the sample #1]	14,336 bytes	0x21A8A1AA109665993BDDBA7B76AAE11B	Awola [Symantec]

• Note:
  • %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	49,152 bytes
xycif.exe	%AppData%\xycif.exe	49,152 bytes

Registry Modifications

• The newly created Registry Value is:
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    • Microsoft Windows Adapter 5.1.3214 = "%AppData%\xycif.exe"
    
    so that xycif.exe runs every time Windows starts
    

。。。。
无语。。。

allinwonderi

Nothing found. TO viruslab

The file 'secure' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.FakeAle.B. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.