80后

显示全部楼层 · 发表于 2016-3-19 21:52:00

本帖最后由左手于 2016-3-19 21:53 编辑

[mw_shl_code=css,true]2016-3-19 21:49:59 创建新进程风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: c:\documents and settings\administrator\桌面\80\80.exe
命令行: "C:\Documents and Settings\Administrator\桌面\80\80.exe"
规则: [应用程序]??* -> [子应用程序]*\桌面\*

2016-3-19 21:50:00 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal
值: C:\Documents and Settings\Administrator\My Documents
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-19 21:50:07 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: C:\Documents and Settings\Administrator\My Documents\pofhtd.exe
规则: [应用程序]?:\*\*\*\*\* -> [文件]c:\documents and settings\*\my documents\*

2016-3-19 21:50:07 读文件风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: \Device\NamedPipe\wkssvc
规则: [文件组]Namedpipe -> [文件]\device\namedpipe\*

2016-3-19 21:50:07 读文件风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件组]Namedpipe -> [文件]\device\namedpipe\*

2016-3-19 21:50:07 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Documents
值: C:\Documents and Settings\All Users\Documents
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-19 21:50:07 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop
值: C:\Documents and Settings\Administrator\桌面
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-19 21:50:07 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Desktop
值: C:\Documents and Settings\All Users\桌面
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-19 21:50:07 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
值: 0x00000001(1)
规则: [注册表组]拦截_重要关联 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap; ProxyBypass

2016-3-19 21:50:07 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
值: 0x00000001(1)
规则: [注册表组]拦截_重要关联 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap; IntranetName

2016-3-19 21:50:07 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000001(1)
规则: [注册表组]拦截_重要关联 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap; UNCAsIntranet

2016-3-19 21:50:07 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
值: 0x00000001(1)
规则: [注册表组]拦截_重要关联 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap; AutoDetect

2016-3-19 21:50:07 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
值: 0x00000001(1)
规则: [注册表组]拦截_重要关联 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap; ProxyBypass

2016-3-19 21:50:07 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
值: 0x00000001(1)
规则: [注册表组]拦截_重要关联 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap; IntranetName

2016-3-19 21:50:07 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000001(1)
规则: [注册表组]拦截_重要关联 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap; UNCAsIntranet

2016-3-19 21:50:07 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
值: 0x00000001(1)
规则: [注册表组]拦截_重要关联 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap; AutoDetect

2016-3-19 21:50:07 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-19 21:50:07 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-19 21:50:07 创建新进程风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\80\80.exe
目标: c:\windows\system32\cmd.exe
命令行: "C:\WINDOWS\system32\cmd.exe" /c DEL C:\DOCUME~1\ADMINI~1\桌面\80\80.exe >> NUL
规则: [应用程序组]→终止_降权组件

2016-3-19 21:50:40 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\my documents\pofhtd.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal
值: C:\Documents and Settings\Administrator\My Documents
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-19 21:50:40 读文件风险级别:未知阻止
进程: c:\documents and settings\administrator\my documents\pofhtd.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件组]Namedpipe -> [文件]\device\namedpipe\*

2016-3-19 21:50:40 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\my documents\pofhtd.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CD Burning
值: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\CD Burning
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-19 21:50:40 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\my documents\pofhtd.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop
值: C:\Documents and Settings\Administrator\桌面
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-19 21:50:40 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\my documents\pofhtd.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Desktop
值: C:\Documents and Settings\All Users\桌面
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-19 21:50:40 读文件风险级别:未知阻止
进程: c:\documents and settings\administrator\my documents\pofhtd.exe
目标: \Device\NamedPipe\wkssvc
规则: [文件组]Namedpipe -> [文件]\device\namedpipe\*

2016-3-19 21:50:40 读文件风险级别:未知阻止
进程: c:\documents and settings\administrator\my documents\pofhtd.exe
目标: \Device\NamedPipe\srvsvc
规则: [文件组]Namedpipe -> [文件]\device\namedpipe\*

2016-3-19 21:50:40 修改文件风险级别:未知阻止
进程: c:\documents and settings\administrator\my documents\pofhtd.exe
目标: C:\Documents and Settings\Administrator\ntuser.dat.LOG
规则: [应用程序]?:\*\*\*\* -> [文件]c:\documents and settings\administrator

2016-3-19 21:50:41 修改注册表值风险级别:未知阻止并结束进程
进程: c:\documents and settings\administrator\my documents\pofhtd.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\_xfdt
值: C:\WINDOWS\SYSTEM32\CMD.EXE /C START C:\Documents and Settings\Administrator\My Documents\pofhtd.exe
规则: [应用程序组]D+_Documents -> [应用程序]c:\documents and settings\*\* -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*
[/mw_shl_code]

显示全部楼层 · 发表于 2016-3-19 22:12:21

本帖最后由 y3312068 于 2016-3-19 22:14 编辑

aboringman 发表于 2016-3-19 20:37
AVG：

扫描：miss；

你被加密过吗，亲，另外我这里是中等，不知你为什么是高

显示全部楼层 · 发表于 2016-3-19 22:31:32

本帖最后由 cfhdrty 于 2016-3-19 22:33 编辑

fs主防杀，还是云杀安逸

显示全部楼层 · 发表于 2016-3-20 01:23:28

y3312068 发表于 2016-3-19 22:12
你被加密过吗，亲，另外我这里是中等，不知你为什么是高

肯定有，但都不是楼主提供的样本，而且都是很老型的。。。。。。

显示全部楼层 · 发表于 2016-3-20 11:08:10

卡饭最近卡卡的
20.03.2016 11.07.48;Download blocked;https://att.kafan.cn/forum.php?mo ... DMzNzMz//80.exe;360极速浏览器;Trojan program;03/20/2016 11:07:48

[可疑文件] 80后

本帖子中包含更多资源

评分

本帖子中包含更多资源

浏览过的版块