gen_一个

jayavira

hitman kill

Dust-;羅錠

大蜘蛛：

ZHANGYUANQING

微点解压杀之

老虎猫

_8023

小A KILLED

62590423

Trojan.Generic.2808321.

左手

老虎猫 发表于 2012-7-9 16:56

2012-7-9 17:03:21    创建新进程    允许
进程: c:\documents and settings\administrator\桌面\nbcda.exe
目标: c:\documents and settings\administrator\local settings\temp\kvzzns.exe
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kvzzns.exe" "-"
规则: [应用程序]* -> [子应用程序]?:\*\local settings\temp\*

2012-7-9 17:03:21    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\nbcda.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\DisableRegistryTools
值: 0x00000001(1)
规则: [应用程序]c:\documents and settings\administrator\桌面\nbcda.exe -> [注册表]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system; DisableRegistryTools

2012-7-9 17:03:21    创建新进程    允许
进程: c:\documents and settings\administrator\桌面\nbcda.exe
目标: c:\documents and settings\administrator\local settings\temp\kvzzns.exe
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kvzzns.exe" "-"
规则: [应用程序]* -> [子应用程序]?:\*\local settings\temp\*

2012-7-9 17:03:21    向其他进程发送消息    阻止
进程: c:\documents and settings\administrator\桌面\nbcda.exe
目标: c:\windows\system32\csrss.exe
消息: 0x03E0
规则: [应用程序]* -> [目标应用程序]U+_行为防御_进程入侵保护

2012-7-9 17:03:21    创建新进程    阻止并结束进程
进程: c:\documents and settings\administrator\桌面\nbcda.exe
目标: c:\windows\explorer.exe
命令行: "C:\WINDOWS\Explorer.exe" /idlist,:428:5984,C:\Documents and Settings\Administrator\桌面
规则: [应用程序]* -> [子应用程序]c:\windows\*

2012-7-9 17:03:22    修改注册表值    阻止并结束进程
进程: c:\documents and settings\administrator\local settings\temp\kvzzns.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA
值: 0x00000000(0)
规则: [注册表组]Malicious Keys -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Policies\*

2012-7-9 17:03:22    修改注册表值    阻止并结束进程
进程: c:\documents and settings\administrator\local settings\temp\kvzzns.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA
值: 0x00000000(0)
规则: [注册表组]Malicious Keys -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Policies\*

小妞儿

骚护士拦截