VIRUS(373楼更新)

显示全部楼层 · 发表于 2011-6-6 22:36:06

365,MSE入库‘
Rogue:Win32/FakeRean

显示全部楼层 · 发表于 2011-6-6 22:47:17

kurakimai 发表于 2011-6-6 00:57
UPDATE

卡巴斯基安全部队
2012
拒绝访问
无法访问该网页

请求对象位于网址：

http://bbs.kafan.cn/forum.php?mod=
attachment&aid=MTI1MDI4NnwyMDY2MDA5ZXwxM
zA3MzcxNjE0fDQ4NjA0OXw5NTg2NjU%3D

检测到威胁：

对象已感染病毒Trojan.Win32.FakeAV.djcb
发生时间： 22:44:20

显示全部楼层 · 发表于 2011-6-12 22:25:14

UPDATE

显示全部楼层 · 发表于 2011-6-12 22:37:23

373L，大蜘蛛clean，已上報！

显示全部楼层 · 发表于 2011-6-12 23:24:58

卡巴 CLEAN

显示全部楼层 · 发表于 2011-6-12 23:50:45

373L
To ESET.
http://samples.nod32.com.hk/inde ... 143051c84efe595eee2

显示全部楼层 · 发表于 2011-6-12 23:59:03

本帖最后由 a256886572008 于 2011-6-13 00:04 编辑

kurakimai 发表于 2011-6-12 22:25
UPDATE

http://camas.comodo.com/cgi-bin/submit?file=30880e2df98de2decc93eaa57403a02d2c7e8508726d358b8ce7e82ee690953c

Auto Analysis Verdict
Suspicious++

Suspicious Actions Detected
Deletes self
Disables windows firewall

-------------------------------------------------------

-----------------------------------------------------------

2011-06-12 23:57:24 C:\Documents and Settings\Roger\桌面\VIRUS\FastAntivirus2011\FastAntivirus2011.exe Sandboxed As Partially Limited

2011-06-12 23:57:25 C:\Documents and Settings\Roger\桌面\VIRUS\FastAntivirus2011\FastAntivirus2011.exe Modify Key HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall

2011-06-12 23:57:25 C:\Documents and Settings\Roger\Local Settings\Application Data\ria.exe Sandboxed As Partially Limited

2011-06-12 23:57:31 C:\Documents and Settings\Roger\Local Settings\Application Data\ria.exe Modify File C:\Documents and Settings\Roger\桌面\VIRUS\FastAntivirus2011\FastAntivirus2011.ex

2011-06-12 23:57:43 C:\Documents and Settings\Roger\Local Settings\Application Data\ria.exe Access COM Interface Shell.Explorer.2

2011-06-12 23:57:43 C:\Documents and Settings\Roger\Local Settings\Application Data\ria.exe Access Memory System

2011-06-12 23:57:43 C:\Documents and Settings\Roger\Local Settings\Application Data\ria.exe Modify Key HKUS\S-1-5-21-1214440339-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe

2011-06-12 23:57:45 C:\Documents and Settings\Roger\Local Settings\Application Data\ria.exe Scanned Online and Found Malicious

显示全部楼层 · 发表于 2011-6-13 00:35:17

373L
过金山卫士，360SD KILL。

显示全部楼层 · 发表于 2011-6-13 00:41:52

无法下载附件，直接被BD拦截。。。

显示全部楼层 · 发表于 2011-6-13 07:31:22

jiangmin clean

[病毒样本] VIRUS(373楼更新)

本帖子中包含更多资源

评分

本帖子中包含更多资源