VIRUS(373楼更新)

ahhh

zmzcy 发表于 2011-4-16 12:21
rising miss

30L

zmzcy

ahhh 发表于 2011-4-16 13:31
30L

额 我没有双击

kurakimai

4.16更新挂得有点惨

NOD32也OVER了、、

我X，连360的云也过了

看来这次不一样了

arsh

过红伞小A,360压缩认为安全

hx1997

2011-04-16 18:40:31    创建文件      操作:阻止
进程路径:G:\Documents and Settings\Administrator.HX-C0987054243B\桌面\BestAntivirus2011.exe
文件路径:G:\Sandbox\HX\Virus\user\all\Application Data\gNl24500eAnBm24500\gNl24500eAnBm24500.exe
触发规则:所有程序规则->高危目录->*\Application Data*\*.exe

kurakimai

回复 34楼 arsh 的帖子

360这次算是失明了

fzq198776

金山毒霸 云鉴定 鉴定为 安全， 晕菜！！！有图有真相！！！

Mr.XCLK

360网盾报未知
360QVM鉴定为病毒：QVM20

Mr.XCLK

金山太不给力，给我报了一个安全~~~
如果真相信了结果，那就是见了大头鬼~~

Mr.XCLK

金山沙箱记录

2011-04-16 19:00:01 D:\My Documents\Downloads\BestAntivirus2011.exe加载库文件C:\WINDOWS\system32\query.dll C:\WINDOWS\system32\query.dll
2011-04-16 19:00:01 D:\My Documents\Downloads\BestAntivirus2011.exe加载库文件C:\WINDOWS\system32\query.dll C:\WINDOWS\system32\query.dll
2011-04-16 19:00:01 D:\My Documents\Downloads\BestAntivirus2011.exe加载库文件C:\WINDOWS\system32\IMM32.DLL C:\WINDOWS\system32\IMM32.DLL
2011-04-16 19:00:01 D:\My Documents\Downloads\BestAntivirus2011.exe加载库文件C:\WINDOWS\system32\LPK.DLL C:\WINDOWS\system32\LPK.DLL
2011-04-16 19:00:01 D:\My Documents\Downloads\BestAntivirus2011.exe加载库文件C:\WINDOWS\system32\USP10.dll C:\WINDOWS\system32\USP10.dll
2011-04-16 19:00:01 D:\My Documents\Downloads\BestAntivirus2011.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
2011-04-16 19:00:01 D:\My Documents\Downloads\BestAntivirus2011.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\KisDcom.dll C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\KisDcom.dll
2011-04-16 19:00:03 D:\My Documents\Downloads\BestAntivirus2011.exe加载库文件C:\WINDOWS\system32\IPHLPAPI.DLL C:\WINDOWS\system32\IPHLPAPI.DLL
2011-04-16 19:00:03 D:\My Documents\Downloads\BestAntivirus2011.exe加载库文件C:\WINDOWS\system32\WS2_32.dll C:\WINDOWS\system32\WS2_32.dll
2011-04-16 19:00:03 D:\My Documents\Downloads\BestAntivirus2011.exe加载库文件C:\WINDOWS\system32\WS2HELP.dll C:\WINDOWS\system32\WS2HELP.dll
2011-04-16 19:00:03 D:\My Documents\Downloads\BestAntivirus2011.exe加载库文件C:\WINDOWS\system32\MSIMG32.dll C:\WINDOWS\system32\MSIMG32.dll
2011-04-16 19:00:03 D:\My Documents\Downloads\BestAntivirus2011.exe加载库文件C:\WINDOWS\system32\PSAPI.DLL C:\WINDOWS\system32\PSAPI.DLL
2011-04-16 19:00:03 D:\My Documents\Downloads\BestAntivirus2011.exe创建注册表键值HKEY_USERS\S-1-5-21-1343024091-57989841-1417001333-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_USERS\S-1-5-21-1343024091-57989841-1417001333-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
2011-04-16 19:00:03 D:\My Documents\Downloads\BestAntivirus2011.exe创建文件D:\KSafeBox\5BA44DBC\My Documents\Downloads\BestAntivirus2011 D:\KSafeBox\5BA44DBC\My Documents\Downloads\BestAntivirus2011
2011-04-16 19:00:03 D:\My Documents\Downloads\BestAntivirus2011.exe写文件D:\KSafeBox\5BA44DBC\My Documents\Downloads\BestAntivirus2011 D:\KSafeBox\5BA44DBC\My Documents\Downloads\BestAntivirus2011
2011-04-16 19:00:03 D:\My Documents\Downloads\BestAntivirus2011.exe创建文件C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\ C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\
2011-04-16 19:00:03 D:\My Documents\Downloads\BestAntivirus2011.exe创建文件C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe
2011-04-16 19:00:03 D:\My Documents\Downloads\BestAntivirus2011.exe写文件C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe
2011-04-16 19:00:03 D:\My Documents\Downloads\BestAntivirus2011.exe删除文件D:\KSafeBox\5BA44DBC\My Documents\Downloads\BestAntivirus2011 D:\KSafeBox\5BA44DBC\My Documents\Downloads\BestAntivirus2011
2011-04-16 19:00:03 D:\My Documents\Downloads\BestAntivirus2011.exe加载库文件C:\WINDOWS\system32\Apphelp.dll C:\WINDOWS\system32\Apphelp.dll
2011-04-16 19:00:04 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe加载库文件C:\WINDOWS\system32\query.dll C:\WINDOWS\system32\query.dll
2011-04-16 19:00:04 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe加载库文件C:\WINDOWS\system32\IMM32.DLL C:\WINDOWS\system32\IMM32.DLL
2011-04-16 19:00:04 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe加载库文件C:\WINDOWS\system32\LPK.DLL C:\WINDOWS\system32\LPK.DLL
2011-04-16 19:00:04 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe加载库文件C:\WINDOWS\system32\USP10.dll C:\WINDOWS\system32\USP10.dll
2011-04-16 19:00:04 结束进程D:\My Documents\Downloads\BestAntivirus2011.exe D:\My Documents\Downloads\BestAntivirus2011.exe
2011-04-16 19:00:04 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
2011-04-16 19:00:04 D:\My Documents\Downloads\BestAntivirus2011.exe创建进程C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe
2011-04-16 19:00:04 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\KisDcom.dll C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\KisDcom.dll
2011-04-16 19:00:06 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe加载库文件C:\WINDOWS\system32\IPHLPAPI.DLL C:\WINDOWS\system32\IPHLPAPI.DLL
2011-04-16 19:00:06 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe加载库文件C:\WINDOWS\system32\WS2_32.dll C:\WINDOWS\system32\WS2_32.dll
2011-04-16 19:00:06 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe加载库文件C:\WINDOWS\system32\WS2HELP.dll C:\WINDOWS\system32\WS2HELP.dll
2011-04-16 19:00:06 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe加载库文件C:\WINDOWS\system32\MSIMG32.dll C:\WINDOWS\system32\MSIMG32.dll
2011-04-16 19:00:06 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe加载库文件C:\WINDOWS\system32\PSAPI.DLL C:\WINDOWS\system32\PSAPI.DLL
2011-04-16 19:00:06 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe创建注册表键值HKEY_USERS\S-1-5-21-1343024091-57989841-1417001333-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_USERS\S-1-5-21-1343024091-57989841-1417001333-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
2011-04-16 19:00:06 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe写文件C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500
2011-04-16 19:00:06 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe加载库文件C:\WINDOWS\system32\Apphelp.dll C:\WINDOWS\system32\Apphelp.dll
2011-04-16 19:00:06 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe写虚拟内存C:\WINDOWS\Explorer.EXE C:\WINDOWS\Explorer.EXE
2011-04-16 19:00:06 C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe远程注入C:\WINDOWS\Explorer.EXE C:\WINDOWS\Explorer.EXE
2011-04-16 19:00:06 结束进程C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe C:\KSafeBox\5BA44DBC\Documents and Settings\All Users\Application Data\fFi24500eOhCk24500\fFi24500eOhCk24500.exe


我用云鉴定器鉴定，结果金山还是报安全~~~