谁看看这程序要干什么？

s0s020000

怎么启动时要删除host？是不是要弹窗？ 瑞星提示，微点直接报毒

0000

McAfee VirusScan Enterprise + Spyware Enterprise 8.7i
found nothing

Submitted to McAfee Avert Labs

post8

UGuard v6 - 扫描日志

C:\Users\ms\Desktop\asdsa.rar>>20090820>>d3d9.dll -> Packed.Unknown
C:\Users\ms\Desktop\asdsa.rar>>20090820>>蜗牛.exe -> Packed.Unknown

日志结束。

[ 本帖最后由 post8 于 2009-8-20 14:24 编辑 ]

62590423

eset miss

s0s020000

我指的是他的行为啊，不是有没有毒

相思引

浏览器劫持..?

xppara

http://www.virustotal.com/zh-tw/ ... 40913be3-1250747050

wmcxdb

2009/8/20 14:51:50    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\comctl32.dll

2009/8/20 14:51:50    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\odbcint.dll

2009/8/20 14:51:50    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\uxtheme.dll

2009/8/20 14:51:50    访问COM接口    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: {8856F961-340A-11D0-A96B-00C04FD705A2} Shell.Explorer.2
文件路径: C:\Windows\system32\ieframe.dll

2009/8/20 14:51:51    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\clbcatq.dll

2009/8/20 14:51:51    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\ieframe.dll

2009/8/20 14:51:51    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\secur32.dll

2009/8/20 14:51:51    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\apphelp.dll

2009/8/20 14:51:51    访问COM接口    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: {8856F961-340A-11D0-A96B-00C04FD705A2} Shell.Explorer.2
文件路径: C:\Windows\system32\ieframe.dll

2009/8/20 14:51:51    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\rasapi32.dll

2009/8/20 14:51:51    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\credssp.dll

2009/8/20 14:51:51    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\schannel.dll

2009/8/20 14:51:51    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\sensapi.dll

2009/8/20 14:51:51    修改注册表值    阻止
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy
值: 0x00000001(1)

2009/8/20 14:51:51    修改注册表值    阻止
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
值: 0x00000000(0)

2009/8/20 14:51:51    删除注册表值    阻止
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer

2009/8/20 14:51:51    删除注册表值    阻止
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL

2009/8/20 14:51:51    修改注册表值    阻止
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable
值: 0x00000000(0)

2009/8/20 14:51:51    修改注册表值    阻止
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
值: 46 00 00 00 87 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 e0 8f d4 c3 8b e6 c9 01 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 17 00 00 00 00 00 00 00 fe 80 00 00 00 00 00 00 e0 91 7f 2d fb b5 0c ca 0a 00 00 00 7e 00 31 00 5c 00 41 00 70 00 70 00 44 00 61 00 01 00 00 00 5c 00 4c 00 6f 00 63 00 00 00 00 00 5c 00 54 00 65 00 6d 00 70 00 00 00 54 00 52 00 00 00 00 00 45 00 5f 00 08 00 00 00 00 00 00 00 08 9e 39 00 d0 be b9 04 00 08 00 00 02 00 00 00 00 00 00 60 00 00 00 20 20 05 00 00 68 ba 3e 00 02 00 00 00 02 00 00 00 dc b3 d2 7d 00 00 00 00 00 00 00 00 e4 04 00 00 d4 0d 02 00 76 00 2e 00 63 00 6f 00 72 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 00 00 00 3c 00 00 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 00 2d 00 42 00 36 00 07 00 00 00 2d 00 32 00 00 00 00 00 46 00 44 00 00 00 00 00 02 00 00 00 0a a0 18 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 10 02 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 a0 c5 3f 00 00 00 00 00 00 00 00 00 42 00 56 00 01 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 41 00 4d 00 45 00 3d 00 00 00 00 00 00 00 00 00 53 00 45 00 13 00 00 13 4c e5 00 00

2009/8/20 14:51:51    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\nlaapi.dll

2009/8/20 14:51:51    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\rasadhlp.dll

2009/8/20 14:51:51    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\urlmon.dll

2009/8/20 14:51:51    删除注册表值    阻止
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet settings\ZoneMap\ProxyBypass

2009/8/20 14:51:51    删除注册表值    阻止
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName

2009/8/20 14:51:51    修改注册表值    阻止
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000000(0)

2009/8/20 14:51:51    修改注册表值    阻止
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
值: 0x00000001(1)

2009/8/20 14:51:51    删除注册表值    阻止
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass

2009/8/20 14:51:51    删除注册表值    阻止
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName

2009/8/20 14:51:51    修改注册表值    阻止
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000000(0)

2009/8/20 14:51:51    修改注册表值    阻止
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
值: 0x00000001(1)

2009/8/20 14:51:51    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\mswsock.dll

2009/8/20 14:51:51    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\wshtcpip.dll

2009/8/20 14:51:51    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\wship6.dll

2009/8/20 14:51:51    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\napinsp.dll

2009/8/20 14:51:51    加载动态链接库    允许
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: c:\windows\system32\winrnr.dll

2009/8/20 14:51:51    访问网络    阻止
进程: f:\下载\20090820\20090820\蜗牛.exe
目标: TCP [本机 : 51062] ->  [219.152.120.50 : 80 (http)]

panjuncai6610

看不明

佰恋雨

穿越火线透视G！！！

这东西应该没毒