Trojan.Win32.FakeSpyguard

wptyh73hm

2009-6-27 20:35:37    创建新进程    允许
进程: c:\program files\opera\opera.exe
目标: f:\program files\7-zip\7zfm.exe
命令行: "F:\Program Files\7-Zip\7zFM.exe" "D:\Backup\我的文档\byoutatat.rar"
规则: [应用程序]*

2009-6-27 20:35:45    创建文件    允许
进程: f:\program files\7-zip\7zfm.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\7zO2B6.tmp\byoutatat.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2009-6-27 20:35:48    创建新进程    允许
进程: f:\program files\7-zip\7zfm.exe
目标: c:\documents and settings\administrator\local settings\temp\7zo2b6.tmp\byoutatat.exe
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7zO2B6.tmp\byoutatat.exe"
规则: [应用程序]*

2009-6-27 20:35:51    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo2b6.tmp\byoutatat.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\byoutatat
值: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7zO2B6.tmp\byoutatat.exe"
规则: [注册表组]自动运行程序所在位置 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*

2009-6-27 20:35:53    修改其他进程的内存    阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo2b6.tmp\byoutatat.exe
目标: c:\windows\explorer.exe
规则: [应用程序]*

2009-6-27 20:35:56    修改其他进程的内存    阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo2b6.tmp\byoutatat.exe
目标: c:\windows\explorer.exe
规则: [应用程序]*

2009-6-27 20:36:02    删除文件    允许
进程: f:\program files\7-zip\7zfm.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\7zO2B6.tmp\byoutatat.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

sam.to

Hello,


byoutatat.ex2e - Trojan.Win32.Tdss.aidm

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

runyon

2009-6-28 6:58:54        已拒绝: Trojan.Win32.Tdss.aidm        不存在                http://bbs.kafan.cn/attachment.p ... 3528//byoutatat.exe                       

kis2010

runyon

2009-6-28 7:01:55        已拒绝: Trojan.Win32.Tdss.aidm        不存在                http://bbs.kafan.cn/attachment.p ... 3703//byoutatat.exe                        kis2010