46.exe

显示全部楼层 · 发表于 2008-10-14 16:52:20

2008/10/14 16:51:07 已清除广告软件 not-a-virus:AdWare.Win32.Agent.fvt G:\Temp\Virus\46.zip
2008/10/14 16:51:07 已清除广告软件 not-a-virus:AdWare.Win32.Agent.fvt G:\Temp\Virus\46.zip/46.exe//data0003

显示全部楼层 · 发表于 2008-10-14 17:00:16

C:\Documents and Settings\123\桌面\46.zip > ZIP > 46.exe > NSIS > ?

显示全部楼层 · 发表于 2008-10-14 17:06:07

The file '46.exe' has been determined to be 'MALWARE'. Our analysts named the threat DR/Gooochi.C. The term "DR/" denotes a program that is able to place a virus or a malware discretely on a system.Detection will be added to our virus definition file (VDF) with one of the next updates.

显示全部楼层 · 发表于 2008-10-14 18:48:20

2008-10-14 18:48:00 创建注册表值    操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.813\46.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Session Manager
注册表名称:PendingFileRenameOperations
触发规则:所有程序规则->系统设置_普通模式->HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Session Manager

2008-10-14 18:48:01 创建注册表值    操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.813\46.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Session Manager
注册表名称:PendingFileRenameOperations
触发规则:所有程序规则->系统设置_普通模式->HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Session Manager

2008-10-14 18:48:01 创建注册表值    操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.813\46.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Session Manager
注册表名称:PendingFileRenameOperations
触发规则:所有程序规则->系统设置_普通模式->HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Session Manager

显示全部楼层 · 发表于 2008-10-14 19:14:57

Begin scan in 'E:\Download\Virus\46.zip'
E:\Download\Virus\46.zip
[0] Archive type: ZIP
--> 46.exe
[DETECTION] Contains recognition pattern of the DR/Agent.fvt.17 dropper
[NOTE] The file was deleted!

显示全部楼层 · 发表于 2008-10-14 19:54:43

McAfee miss

显示全部楼层 · 发表于 2008-10-14 20:47:48

金山 0

[病毒样本] 46.exe

回复 14楼 Kitman 的帖子