文件伪装王的生成物

RickyBoy

IK只报ins_cs

kalynn84

Win32:Adware-gen [Adw]

悠柚

SD with Antivirus miss all

fatezero

木马程序 Trojan.Win32.Agent.cxjy        E:\download\ins_cs.rar       
病毒 HEUR:Trojan.Win32.StartPage        E:\download\fusong.rar/fusong.exe

无尽藏海

结果: 找到 1 恶意软件
BehavesLike:Trojan.StartPage (怀疑的感染)
D:\Virus\fusong.rar\fusong.exe

--------------------------------------------------------------------------------

找到危险软件
Application.Generic.242195 (危险软件)
D:\Virus\ins_cs.rar\ins_cs.exe
D:\Virus\ins_cs.rar

C.C.

to avira

328397663

回复 1# RickyBoy 效率有了。但是准确率有些低。

fatezero

红伞

The file 'crverify.exe' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.

........................................................................................................................................

卡巴

Hello,
crverify.exe
No malicious code was found in this file.

will

crverify.exe   ---   Clean(Not-a-malware)
fusong.exe   ---   Malware/W32.StartPage

[ Changes to filesystem ]
   * Creates file C:\Documents and Settings\Administrator\Local Settings\Temp\forqd75.exe
   * Creates file C:\Documents and Settings\Administrator\Local Settings\Temp\haozip_v1.5.3180.x86_tiny.200084.exe
   * Creates file C:\Documents and Settings\Administrator\Local Settings\Temp\pplivesetup_forqd75.exe
   * Creates file C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q78DYP3J\pplivesetup_forqd75[1].exe

[ Changes to registry ]
   * Creates value "ip_haoya=01000000" in key HKEY_LOCAL_MACHINE\software\ExFlags
   * Creates value "ip_ppli=01000000" in key HKEY_LOCAL_MACHINE\software\ExFlags
   * Modifies value "Start Page=http://www.2345.com/?304" in key HKEY_CURRENT_USER\software\Microsoft\Internet Explorer\Main
          old value "Start Page=about:blank"

[ Network services ]
   * Looks for an Internet connection.
   * Connects to "222.73.218.127" on port 80.
   * Connects to "127.0.0.1" on port 2875.
   * Connects to "61.55.164.84" on port 80.

ins_cs.exe   ---   Suspicious/W32.Clicker

[ Changes to filesystem ]
   * Creates file C:\Documents and Settings\Administrator\Cookies\administrator@www.yahoo[1].txt
   * Creates file C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\67b9_appcompat.txt
   * Deletes file C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\67b9_appcompat.txt

[ Network services ]
   * Looks for an Internet connection.
   * Connects to "209.131.36.158" on port 80.
   * Connects to "98.137.149.56" on port 80.
   * Opens next URLs:
     http://www.yahoo.com

jayavira

ess kill2个。to1个