teaser1.wmv.exe-Trojan.Win32.Vundo

wsmurderer

2009-3-29 22:18:32    创建注册表项    阻止
进程: c:\documents and settings\administrator\桌面\teaser1.wmv.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{67eb2833-ac7c-4b6b-b536-f4e122536470}
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\Currentversion\Explorer\Browser helper objects*

2009-3-29 22:18:32    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\teaser1.wmv.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jutinabulu
值: Rundll32.exe "C:\Documents and Settings\All Users\Application Data\wimohigi\wimohigi.dll",s
规则: [注册表组]自动运行 -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*

2009-3-29 22:18:32    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\teaser1.wmv.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\jutinabulu
值: Rundll32.exe "C:\Documents and Settings\All Users\Application Data\wimohigi\wimohigi.dll",s
规则: [注册表组]自动运行 -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*

2009-3-29 22:18:32    安装全局消息钩子    阻止
进程: c:\documents and settings\administrator\桌面\teaser1.wmv.exe
目标: c:\documents and settings\all users\application data\dowalora\dowalora.dll
钩子类型: WH_CALLWNDPROCRET
规则: [应用程序]*

2009-3-29 22:18:32    安装全局消息钩子    阻止
进程: c:\documents and settings\administrator\桌面\teaser1.wmv.exe
目标: c:\documents and settings\all users\application data\dowalora\dowalora.dll
钩子类型: WH_CALLWNDPROCRET
规则: [应用程序]*

2009-3-29 22:18:42    修改其他进程的内存    阻止
进程: c:\documents and settings\administrator\桌面\teaser1.wmv.exe
目标: c:\windows\explorer.exe
规则: [应用程序]*

浪人哭泣

BIT砍杀于网络防护，根本进步了系统，哈哈哈哈

黑衣~魂

DW
teaser1.wmv.exe - infected with Trojan.Virtumod.1666

kingmuro

过kv和pctools

JusT.Like

Trojan.Vundo.GMM

chier

kis2009 拦截

shirenlau

标记已读～

xppara

http://www.virustotal.com/zh-tw/ ... 5c53ef8d392d58a5973