误报中 求鉴定

hansyu

ThreatExpert在线分析认为是威胁
http://www.threatexpert.com/repo ... 1a17a2e48b5f55f60e8

jayavira

回复 11楼 hansyu 的帖子

只要有杀毒软件报毒的话，TE就会认定是威胁啊

liulangzhecgr

看见说明。。。

尤金卡巴斯基

您反映的问题已经处理完毕，下次病毒库更新即可解决。

s8706042

已上報趨勢嚕~

cz88

文件里面好像没有毒    外面的壳有变种

zuo

2011-1-24 18:10:23    删除注册表值    阻止
进程: c:\program files\winrar\winrar.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program Files\WinRAR\WinRAR.exe
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2011-1-24 18:10:23    修改注册表值    阻止
进程: c:\program files\winrar\winrar.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\LangID
值: 04 08
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2011-1-24 18:10:33    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\fysafe_破解版\fysafe_破解版\fysetup.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2011-1-24 18:10:34    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\fysafe_破解版\fysafe_破解版\fysetup.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2011-1-24 18:10:34    删除注册表值    阻止
进程: c:\documents and settings\administrator\桌面\fysafe_破解版\fysafe_破解版\fysetup.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program Files\WinRAR\WinRAR.exe
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2011-1-24 18:10:34    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\fysafe_破解版\fysafe_破解版\fysetup.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\LangID
值: 04 08
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2011-1-24 18:10:34    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\fysafe_破解版\fysafe_破解版\fysetup.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\Setup.exe
值: 风云防火墙 安装/卸载 程序
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2011-1-24 18:10:35    创建新进程    阻止
进程: c:\documents and settings\administrator\桌面\fysafe_破解版\fysafe_破解版\fysetup.exe
目标: c:\documents and settings\administrator\local settings\temp\rarsfx0\setup.exe
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\Setup.exe" /1
规则: [应用程序组]所有程序规则-服务驱动安装规则 -> [应用程序]* -> [子应用程序]?:\?*\*setup.exe

2011-1-24 18:10:35    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\fysafe_破解版\fysafe_破解版\fysetup.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\Setup.exe
值: 风云防火墙 安装/卸载 程序
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2011-1-24 18:10:37    创建新进程    允许
进程: c:\documents and settings\administrator\桌面\fysafe_破解版\fysafe_破解版\fysetup.exe
目标: c:\documents and settings\administrator\local settings\temp\rarsfx0\setup.exe
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\Setup.exe" /1
规则: [应用程序组]所有程序规则-服务驱动安装规则 -> [应用程序]* -> [子应用程序]?:\?*\*setup.exe

2011-1-24 18:10:56    创建文件    允许
进程: c:\documents and settings\administrator\local settings\temp\rarsfx0\setup.exe
目标: C:\Program Files\FYSafe\ArpInfo.dll
规则: [文件组]文件安全读写规则(询问创建) -> [文件]*\program files\*; *.dll

2011-1-24 18:10:57    创建文件    允许
进程: c:\documents and settings\administrator\local settings\temp\rarsfx0\setup.exe
目标: C:\Program Files\FYSafe\FYSafe_MT_Wind.dll
规则: [文件组]文件安全读写规则(询问创建) -> [文件]*\program files\*; *.dll

2011-1-24 18:10:57    创建文件    允许
进程: c:\documents and settings\administrator\local settings\temp\rarsfx0\setup.exe
目标: C:\Program Files\FYSafe\FYSafe_Notify.dll
规则: [文件组]文件安全读写规则(询问创建) -> [文件]*\program files\*; *.dll

2011-1-24 18:10:58    创建注册表项    阻止
进程: c:\documents and settings\administrator\local settings\temp\rarsfx0\setup.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\FYSafe_Notify
规则: [注册表组]注册表启动项保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\*

2011-1-24 18:10:58    创建注册表项    阻止
进程: c:\documents and settings\administrator\local settings\temp\rarsfx0\setup.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\FYSafe_Notify
规则: [注册表组]注册表启动项保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\*

2011-1-24 18:10:58    创建文件    允许
进程: c:\documents and settings\administrator\local settings\temp\rarsfx0\setup.exe
目标: C:\WINDOWS\system32\FYSafe_Notify.dll
规则: [文件组]文件安全读写规则(询问创建) -> [文件]c:\windows\system32; *.*

2011-1-24 18:10:59    创建文件    允许
进程: c:\documents and settings\administrator\local settings\temp\rarsfx0\setup.exe
目标: C:\Documents and Settings\Administrator\桌面\风云防火墙.lnk
规则: [文件组]系统文件夹写保护(询问修改) -> [文件]*桌面; *.lnk

2011-1-24 18:11:06    注销、关机或重新启动系统    阻止
进程: c:\documents and settings\administrator\local settings\temp\rarsfx0\setup.exe
规则: [应用程序]*