netprotocol.exe

留侯

大蜘蛛：netprotocol.exe infected with BackDoor.Butirat.24

z2009

                 Warning
In order not to compromise your security, this page will not be accessed
A virus or unwanted program was found in the HTTP data of the requested page.



Requested URL:                http://bbs.kafan.cn/forum.php?mo ... DQ4NjA0OXwxMDk4MzU0
Information:                Is the TR/Vundo.A.759 Trojan
Generated by Web Protection 12.01.06.17, AVE 8.2.6.68, VDF 7.11.15.98

hx1997

2011-10-5 0:34:47        C:\Documents and Settings\Administrator\桌面\netprotdrvss.exe        修改启动设置        HKEY_USERS\S-1-5-21-790525478-1343024091-303738163-500\Software\Microsoft\Windows\CurrentVersion\Run\Netprotocol        已阻止        040.Autoruns       

2011-10-5 0:34:44        C:\Documents and Settings\Administrator\桌面\netprotdrvss.exe        修改注册表        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData        已阻止        038.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\       

2011-10-5 0:34:36        C:\Documents and Settings\Administrator\桌面\netprotdrvss.exe        修改其他应用程序的状态        C:\Documents and Settings\Administrator\桌面\netprotdrvss.exe        已允许        018.修改其他应用程序状态 & 加驱       

2011-10-5 0:34:12        C:\Documents and Settings\Administrator\桌面\netprotocol.exe        修改注册表        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData        已阻止        038.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\       

2011-10-5 0:34:12        C:\Documents and Settings\Administrator\桌面\netprotocol.exe        修改启动设置        HKEY_USERS\S-1-5-21-790525478-1343024091-303738163-500\Software\Microsoft\Windows\CurrentVersion\Run\Netprotocol        已阻止        040.Autoruns