外-挂病毒一只

112112

金山云报，微点2.0扫描miss
http://u.115.com/file/t7a7c0bf46#
DNF吕布9.4.rar

ppy0606

真不好跑

2011-4-22 18:59:12    修改注册表值    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\9eyes.PPY\Local Settings\Temporary Internet Files
规则: [应用程序组]●研磨 -> [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-4-22 18:59:12    修改注册表值    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\9eyes.PPY\Cookies
规则: [应用程序组]●研磨 -> [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-4-22 18:59:12    修改注册表值    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\9eyes.PPY\Local Settings\History
规则: [应用程序组]●研磨 -> [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-4-22 18:59:12    修改注册表值    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData
值: C:\Documents and Settings\All Users\Application Data
规则: [应用程序组]●研磨 -> [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-4-22 18:59:12    修改注册表值    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\9eyes.PPY\Application Data
规则: [应用程序组]●研磨 -> [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-4-22 18:59:12    启动驱动程序或服务    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: Remote Access Connection Manager
文件路径: C:\WINDOWS\system32\svchost.exe -k netsvcs
规则: [应用程序组]●研磨

2011-4-22 18:59:12    修改注册表值    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
值: 0x00000000(0)
规则: [应用程序组]●研磨 -> [注册表组]注册表保护 -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\*

2011-4-22 18:59:12    删除注册表值    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
规则: [应用程序组]●研磨 -> [注册表组]注册表保护 -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\*

2011-4-22 18:59:12    删除注册表值    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
规则: [应用程序组]●研磨 -> [注册表组]注册表保护 -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\*

2011-4-22 18:59:12    修改注册表值    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\9eyes.PPY\Application Data
规则: [应用程序组]●研磨 -> [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-4-22 18:59:12    启动驱动程序或服务    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: Remote Access Connection Manager
文件路径: C:\WINDOWS\system32\svchost.exe -k netsvcs
规则: [应用程序组]●研磨

2011-4-22 18:59:12    访问网络    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: UDP [本机 : 1577] ->  [127.0.0.1 : 1577]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2011-4-22 18:59:12    修改注册表值    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\9eyes.PPY\Application Data
规则: [应用程序组]●研磨 -> [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-4-22 18:59:12    启动驱动程序或服务    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: Network Location Awareness (NLA)
文件路径: C:\WINDOWS\system32\svchost.exe -k netsvcs
规则: [应用程序组]●研磨

2011-4-22 18:59:12    访问网络    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: UDP [本机 : 54191] ->  [222.246.129.80 : 53 (domain)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2011-4-22 18:59:14    启动驱动程序或服务    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: Remote Access Connection Manager
文件路径: C:\WINDOWS\system32\svchost.exe -k netsvcs
规则: [应用程序组]●研磨

2011-4-22 18:59:14    修改注册表值    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\9eyes.PPY\Application Data
规则: [应用程序组]●研磨 -> [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2011-4-22 18:59:14    启动驱动程序或服务    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: Remote Access Connection Manager
文件路径: C:\WINDOWS\system32\svchost.exe -k netsvcs
规则: [应用程序组]●研磨

2011-4-22 18:59:14    访问网络    阻止
进程: d:\我的文档\virus test\dnf%e5%90%95%e5%b8%839.4\dnf吕布9.4.exe
目标: UDP [本机 : 65027] ->  [222.246.129.80 : 53 (domain)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

z2009

Start of the scan: 2011年4月22日  19:10

Starting the file scan:

Begin scan in 'C:\Users\Desktop\DNF吕布9.4.rar'
C:\Users\\Desktop\DNF吕布9.4.rar
[0] Archive type: RAR
  [DETECTION] Is the TR/Black.Gen2 Trojan
  --> DNFￂ￀ﾲﾼ9.4.exe
  [DETECTION] Is the TR/Black.Gen2 Trojan

Beginning disinfection:
C:\Users\\Desktop\DNF吕布9.4.rar
    [DETECTION] Is the TR/Black.Gen2 Trojan
    [NOTE]      The file was deleted!


End of the scan: 2011年4月22日  19:10
Used time: 00:00 Minute(s)

The scan has been done completely.

      0 Scanned directories
      3 Files were scanned
      1 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      1 files were deleted
      0 Viruses and unwanted programs were repaired
      0 Files were moved to quarantine
      0 Files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      0 Warnings
      1 Notes

ywsuda

红伞 kill

arsh

微点右键扫描过，360杀毒清除

hx1997

ESET kill
G:\Documents and Settings\Administrator.HX-C0987054243B\桌面\DNF吕布9.4.rar > RAR > DNF吕布9.4.exe - Win32/Packed.VMProtect.AAD 特洛伊木马 的变种

留侯

大蜘蛛clean，已上报！

s8706042

已上报趋势～
未侦测到威胁～

hj5abc

mse
VirTool:Win32/Obfuscator.XZ

qq351100394

已上报微点