大量伪快播(Qvod.exe,click.exe,duogua.exe),天天更新 (637 楼有新)

sam.to

b597a7f62e3195ce7dbc477d4a64f724   Qvod.e_xe
to kl,ll,eset,mcafee,comodo,avira

http://samples.nod32.com.hk/inde ... 5ce7dbc477d4a64f724

The file 'Qvod.e2xe' has been determined to be 'UNDER ANALYSIS'.



The file 'Qvod.e2xe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Agent.dkdy.2. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.10.05.243.

62590423

to MS mp

bluechong

进来瞅瞅@！

dyhua

小A直接拦截不让下载

songdehao

TO 卡巴
TO 百锐

jayavira

to eset

yishuad

又是冒充快播的
to rising 查询编号：RS20100327173442437528

ablhr

avast kill

jason_jiang

to panda

XE-cj

微点


2010-3-27 18:16:07    创建文件    允许
进程: c:\documents and settings\owner\my documents\qvod.exe
目标: C:\Program Files\Common Files\01.exe
规则: [文件组]特殊目录 -> [文件]c:\program files\common files

2010-3-27 18:16:07    创建新进程    允许
进程: c:\documents and settings\owner\my documents\qvod.exe
目标: c:\program files\common files\01.exe
命令行: "C:\Program Files\Common Files\01.exe"
规则: [应用程序]*

2010-3-27 18:16:08    创建文件    允许
进程: c:\documents and settings\owner\my documents\qvod.exe
目标: C:\Program Files\Common Files\Bho-xz.exe
规则: [文件组]特殊目录 -> [文件]c:\program files\common files

2010-3-27 18:16:11    创建新进程    允许
进程: c:\documents and settings\owner\my documents\qvod.exe
目标: c:\program files\common files\bho-xz.exe
命令行: "C:\Program Files\Common Files\Bho-xz.exe"
规则: [应用程序]*

2010-3-27 18:16:13    创建文件    允许
进程: c:\program files\common files\01.exe
目标: D:\cconter.exe
规则: [文件组]全局FD -> [文件]?:\; *.exe

2010-3-27 18:16:14    创建文件    允许
进程: c:\program files\common files\bho-xz.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temp\~DF92A1.tmp
规则: [文件]*

2010-3-27 18:16:24    创建文件    阻止并结束进程
进程: c:\program files\common files\bho-xz.exe
目标: C:\WINDOWS\StrongIndex.reg
规则: [文件]*