3个(em_setup.exe)

显示全部楼层 · 发表于 2009-4-8 22:09:33

4fd606468e8ffd48f10a0e4fab631c83 em_setup.exe
https://www.virustotal.com/anali ... c949cec59de170771ef

464ee9c41b15eb17c5662edc27391396 IE2EM.dll2
3e6ad89ba1da36504f7ca7493eb75ba9 eMuleObject.exe2
76ef04a97a86db85111babac335c4856 eMule32.exe2

显示全部楼层 · 发表于 2009-4-8 22:14:00

Starting the file scan:

Begin scan in 'D:\kafan\eMule32.exe2'
Begin scan in 'D:\kafan\eMuleObject.exe2'
D:\kafan\eMuleObject.exe2
[DETECTION] Is the TR/KernelBot.1.7372 Trojan
[NOTE]    A backup was created as '4a51b1ce.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\IE2EM.dll2'

End of the scan: 2009年4月8日  22:15
Used time: 00:00 Minute(s)

The scan has been done completely.

   0 Scanned directories
   3 Files were scanned
   1 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   1 files were deleted
   0 Viruses and unwanted programs were repaired
   1 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   0 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2009-4-8 22:25:21

to js

显示全部楼层 · 发表于 2009-4-8 22:38:28

McAfee miss

显示全部楼层 · 发表于 2009-4-8 22:39:45

红伞未杀的2个为安全
File ID  Filename Size (Byte) Result
25316633  2.rar 1.7 MB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename Size (Byte) Result
25316613  eMule32.exe2  5.01 MB  CLEAN
25316612  IE2EM.dll2  89.57 KB  CLEAN

显示全部楼层 · 发表于 2009-4-8 23:57:02

All to VB

显示全部楼层 · 发表于 2009-4-9 13:08:47

2009-04-09 13:08:31 修改注册表内容操作:阻止
进程路径:E:\virus\eMule32.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:AppData
触发规则:所有程序规则->07-系统和软件操作（黑白名单）->*\Software\Microsoft\Windows*\*

2009-04-09 13:08:32 运行应用程序操作:阻止
进程路径:E:\virus\eMule32.exe
文件路径:C:\WINDOWS\system32\verclsid.exe
命令行:/C {871C5380-42A0-1069-A2EA-08002B30309D} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
触发规则:所有程序规则->02-禁止运行的高危程序（黑名单）->%windir%\system32\*

显示全部楼层 · 发表于 2009-4-9 16:26:50

To KL

显示全部楼层 · 发表于 2009-4-9 17:26:59

谢谢你

[病毒样本] 3个(em_setup.exe)

本帖子中包含更多资源

回复 9楼尤金卡巴斯基的帖子

[病毒样本] 3个(em_setup.exe)

本帖子中包含更多资源

回复 9楼 尤金卡巴斯基 的帖子

回复 9楼尤金卡巴斯基的帖子