keepprivacyU.exe

显示全部楼层 · 发表于 2010-12-11 19:01:24

本帖最后由 xcffl 于 2010-12-11 19:02 编辑

过金山卫士下载保护
金山沙箱行为分析未发现危险，仅有未知

显示全部楼层 · 发表于 2010-12-11 19:10:11

2010-12-11 19:09:05 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\keepprivacyu\keepprivacyu.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-11 19:09:05 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\keepprivacyu\keepprivacyu.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2010-12-11 19:09:06 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\keepprivacyu\keepprivacyu.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2010-12-11 19:09:07 从其他进程复制句柄阻止
进程: c:\windows\system32\svchost.exe
目标: c:\documents and settings\administrator\桌面\keepprivacyu\keepprivacyu.exe
句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
规则: [应用程序]c:\windows\system32\svchost.exe

2010-12-11 19:09:07 访问网络阻止
进程: c:\documents and settings\administrator\桌面\keepprivacyu\keepprivacyu.exe
目标: TCP [本机 : 1388] -> [202.102.110.204 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-11 19:09:07 访问网络阻止
进程: c:\documents and settings\administrator\桌面\keepprivacyu\keepprivacyu.exe
目标: TCP [本机 : 1389] -> [115.68.15.240 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

显示全部楼层 · 发表于 2010-12-11 20:42:13

KL回信说无毒，那么应该是无毒的

显示全部楼层 · 发表于 2010-12-11 23:30:53

回复 8楼 zdolo 的帖子

你是怎么获得的结果？

显示全部楼层 · 发表于 2010-12-11 23:42:27

A2版报Adware.Win32.KeepPrivacy!A2 金山卫士微点套无视

显示全部楼层 · 发表于 2010-12-11 23:48:26

小A红伞无视，AVG报

显示全部楼层 · 发表于 2010-12-12 00:03:55

趨勢測出TROJ~

显示全部楼层 · 发表于 2010-12-12 00:11:48

回复 14楼 luxiao200888 的帖子

我当然有程序，不过是最新的测试版本

显示全部楼层 · 发表于 2010-12-12 01:22:54

显示全部楼层 · 发表于 2010-12-12 08:15:18

2010/12/12 08:11:26 | E:\病毒\netprotocol.7z.htm=>netprotocol.exe [DELETED] [process: 276.C:\WINDOWS\Explorer.EXE] [user: ibm] [virus: Trojan.Generic.KD.86063] [op: OPEN]

[病毒样本] keepprivacyU.exe

评分

本帖子中包含更多资源