QQ病毒

zplju1

http://www.brsbox.com/filebox/uploadcomplete/randstr/881OJ6h8q284b3A516661HJ092/fgid/e00b88df2098ea25ccf8de12d5883154/dirids/

悠柚

Multi Command-Line Scanner 报告
-------------------------------------------------------------------------
D:\TDDownload\QQVideo.exe
MD5 Hash: EC9F3DFD25ACE6C500006294E30616AF

A-squared -----Nothing
F-Prot -----Nothing
Sophos ----- Sus/Behav-1021
VBA32 -----Nothing

*** 1/4 杀毒引擎在文件中发现病毒 ***
-------------------------------------------------------------------------

任务完成 @ 2009-10-29 星期四 17:38:47.60
注意: 结果可能与GUI版本不同。

林吉茄文

红伞启发是怀疑对象上报红伞了

562421722

卡巴斯基没反应...

maeeqqp

avg norton扫描没反应

[ 本帖最后由 maeeqqp 于 2009-10-29 18:53 编辑 ]

kingmuro

过瑞星2010和360杀毒

ouyangliang

没反应

BING126

McAfee 报了可疑月神。。

adad2008

c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     修改注册表     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory = C:\Documents and Settings\Administrator.BC64EFBA12F1423\Local Settings\Temporary Internet Files\Content.IE5     2009-10-29 下午 09:38:15     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     修改注册表     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path1\CachePath = C:\Documents and Settings\Administrator.BC64EFBA12F1423\Local Settings\Temporary Internet Files\Content.IE5\Cache1     2009-10-29 下午 09:38:15     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     修改注册表     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path2\CachePath = C:\Documents and Settings\Administrator.BC64EFBA12F1423\Local Settings\Temporary Internet Files\Content.IE5\Cache2     2009-10-29 下午 09:38:16     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     修改注册表     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path3\CachePath = C:\Documents and Settings\Administrator.BC64EFBA12F1423\Local Settings\Temporary Internet Files\Content.IE5\Cache3     2009-10-29 下午 09:38:17     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     修改注册表     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path4\CachePath = C:\Documents and Settings\Administrator.BC64EFBA12F1423\Local Settings\Temporary Internet Files\Content.IE5\Cache4     2009-10-29 下午 09:38:18     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     创建注册表键     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked     2009-10-29 下午 09:38:20     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     创建注册表键     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached     2009-10-29 下午 09:38:21     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     创建注册表键     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders     2009-10-29 下午 09:38:21     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     创建注册表键     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders     2009-10-29 下午 09:38:22     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     修改注册表     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Start Menu = C:\Documents and Settings\All Users.WINDOWS\「开始」菜单     2009-10-29 下午 09:38:23     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     创建注册表键     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders     2009-10-29 下午 09:38:23     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     创建注册表键     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders     2009-10-29 下午 09:38:24     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     修改注册表     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Desktop = C:\Documents and Settings\All Users.WINDOWS\桌面     2009-10-29 下午 09:38:24     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     创建注册表键     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders     2009-10-29 下午 09:38:25     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     创建注册表键     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders     2009-10-29 下午 09:38:26     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     修改注册表     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData = C:\Documents and Settings\All Users.WINDOWS\Application Data     2009-10-29 下午 09:38:26     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     创建注册表键     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders     2009-10-29 下午 09:38:27     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     创建注册表键     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders     2009-10-29 下午 09:38:27     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     修改注册表     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CommonPictures = C:\Documents and Settings\All Users.WINDOWS\Documents\My Pictures     2009-10-29 下午 09:38:28     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     创建注册表键     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders     2009-10-29 下午 09:38:28     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     创建注册表键     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders     2009-10-29 下午 09:38:29     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     修改注册表     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Documents = C:\Documents and Settings\All Users.WINDOWS\Documents     2009-10-29 下午 09:38:29     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     创建注册表键     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders     2009-10-29 下午 09:38:30     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     创建注册表键     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders     2009-10-29 下午 09:38:30     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     修改注册表     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CommonMusic = C:\Documents and Settings\All Users.WINDOWS\Documents\My Music     2009-10-29 下午 09:38:31     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     创建注册表键     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders     2009-10-29 下午 09:38:31     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     创建注册表键     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders     2009-10-29 下午 09:38:32     
c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     修改注册表     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CommonVideo = C:\Documents and Settings\All Users.WINDOWS\Documents\My Videos     2009-10-29 下午 09:38:32     


kv的主动防御框提示用户

c:\documents and settings\administrator.bc64efba12f1423\桌面\qqvideo\qqvideo.exe     

发现可疑程序     

创建文件;

修改注册表;

创建注册表键;     

2009-10-29 下午 09:38:46


kv主动防御提示用户阻止

该程序创建的文件列表
C:\DOCUME~1\ADMINI~1.BC6\LOCALS~1\Temp\~DF898E.tmp
C:\Documents and Settings\Administrator.BC64EFBA12F1423\「开始」菜单\程序\Internet Explorer.url

kv主动防御果然比rising要强

[ 本帖最后由 adad2008 于 2009-10-29 21:57 编辑 ]

尤金卡巴斯基

To KL