囧1

ghj89100062

查询编号：RS20090713090319375552
文件名称：qqfcwg.exe
文件MD5：D7E303684AEE528FDEF5D96263C9E375
文件状态：分析中

angir

kaba miss
to kl

Palkia

查询编号：RS20090713090319375552
文件名称：qqfcwg.exe
文件MD5：D7E303684AEE528FDEF5D96263C9E375
文件状态：病毒文件
病毒名称：Trojan.Win32.Generic.51EA79C4
解决版本：22.04.00.01

schumi小粉

2009-07-13 09:52:03    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\qqfcwg\qqfcwg.exe
文件路径:C:\Sandbox\Administrator\DefaultBox\drive\C\WINDOWS\security\mspump.exe
触发规则:所有程序规则->A02…有关文件创建修改组（含黑名单）->*\*.exe


2009-07-13 09:52:03    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\qqfcwg\qqfcwg.exe
注册表路径:HKEY_CURRENT_USER\machine\software\microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:Common Desktop
触发规则:所有程序规则->A07…系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*


2009-07-13 09:52:03    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\qqfcwg\qqfcwg.exe
注册表路径:HKEY_CURRENT_USER\machine\software\microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:Common Desktop
触发规则:所有程序规则->A07…系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*


2009-07-13 09:52:07    运行应用程序      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\qqfcwg\qqfcwg.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c del C:\DOCUME~1\ADMINI~1\桌面\新建文~1\qqfcwg\qqfcwg.exe > nul
触发规则:应用程序规则->A04…禁止的程序操作->*.*->*\cmd.exe

z2665

mse miss，to
avira miss,to

悠柚

This file has been compressed using unusual runtime compression (PCK/FSG). Please verify the origin of this file.

ghj89100062

Hello,

qqfcwg.exe_ - Trojan.Win32.Agent2.kwm

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources

luxiao200888

日期和时间：  2009-7-13 11:05:58
文件名：  qqfcwg[1].rar
原始路径：  c:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VLM03UJ0\
文件大小：  4.28 KB
病毒名称：  Net-Worm.Win32.Maslan.A
建议：  删除
编号：  190640