大家看看红软的病毒~~~~~·

左手

2010-11-9 17:14:45    读文件    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-9 17:14:45    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-9 17:14:49    读文件    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: \Device\NamedPipe\wkssvc
规则: [文件]*

2010-11-9 17:14:49    读文件    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-9 17:14:49    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-9 17:14:49    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
规则: [注册表]*

2010-11-9 17:14:49    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1\CacheLimit
值: 0x00007d04(32004)
规则: [注册表]*

2010-11-9 17:14:49    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-9 17:14:49    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-9 17:14:49    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 17:14:49    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 17:14:49    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 17:14:49    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 17:14:49    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 17:14:49    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 17:14:49    创建新进程    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: c:\program files\tencent\tt\bin\ttraveler.exe
命令行: "C:\Program Files\Tencent\TT\bin\TTraveler.exe"  "http://www.redruan.cn/"
规则: [应用程序]*

2010-11-9 17:15:02    读文件    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-9 17:15:12    创建新进程    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: c:\program files\tencent\tt\bin\ttraveler.exe
命令行: "C:\Program Files\Tencent\TT\bin\TTraveler.exe"  "http://www.redruan.cn/"
规则: [应用程序]*

2010-11-9 17:15:14    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: C:\Documents and Settings\Administrator\Application Data\Tencent\QQWubi\typeStat.dat
规则: [文件]*

2010-11-9 17:15:14    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\test\冲q币.exe
目标: C:\Documents and Settings\Administrator\Application Data\Tencent\QQWubi\local.stat
规则: [文件]*


这玩意不联网,也能冲QB？
本地冲？

lsldream

过nod32

huaicat

回复 4楼 吉祥如意MM 的帖子

说真的。。我看到这个可爱的小工具特意登录的。。

hadg

360杀毒
病毒扫描结果
----------------------
C:\Downloads\cqb.rar=>冲q币.exe        Malware.QVM05.Gen        已删除

兜里揣着メ壹块

360报毒nod32没反应

zuo

回复 1楼 yuanjian1324 的帖子

2010-11-10 10:09:49        c:\documents and settings\administrator\桌面\cqb\冲q币.exe        修改注册表值        HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache        允许        [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache        值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files

2010-11-10 10:09:50        c:\documents and settings\administrator\桌面\cqb\冲q币.exe        修改注册表值        HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies        阻止        [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies        值: C:\Documents and Settings\Administrator\Cookies

2010-11-10 10:09:51        c:\documents and settings\administrator\桌面\cqb\冲q币.exe        修改注册表值        HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History        阻止        [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History        值: C:\Documents and Settings\Administrator\Local Settings\History
2010-11-10 10:09:52        c:\program files\internet explorer\iexplore.exe        修改注册表值        HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Locked        阻止        [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Internet explorer\Toolbar        值: 0x00000001(1)

高木涉

哈哈  360网盾都没过

liuyongqing1

过fscs

猪头大队

VSE无视，360网盾报毒
上报给咖啡，还在分析，我晕