xxx_video_955.avi.exe

a369258147

taihuxian

C:\Documents and Settings\Administrator\桌面\xxx_video_955.avi.rar=>xxx_video_955.avi.exe        木马(Trojan/Win32.Generic.52247680)        已删除

XE-cj

2010-8-7 20:15:19    创建新进程    允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\xe-cj\my documents\xxx_video_955.avi.exe
命令行: "C:\Documents and Settings\XE-CJ\My Documents\xxx_video_955.avi.exe"
规则: [应用程序]c:\windows\explorer.exe

2010-8-7 20:15:20    创建新进程    允许
进程: c:\documents and settings\xe-cj\my documents\xxx_video_955.avi.exe
目标: c:\documents and settings\xe-cj\my documents\xxx_video_955.avi.exe
命令行: "C:\Documents and Settings\XE-CJ\My Documents\xxx_video_955.avi.exe"
规则: [应用程序]*

2010-8-7 20:15:25    创建注册表项    阻止
进程: c:\documents and settings\xe-cj\my documents\xxx_video_955.avi.exe
目标: HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Policies\system
规则: [注册表组]系统设置 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\*

2010-8-7 20:15:27    修改注册表值    阻止
进程: c:\documents and settings\xe-cj\my documents\xxx_video_955.avi.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
值: C:\Documents and Settings\XE-CJ\My Documents\xxx_video_955.avi.exe
规则: [注册表组]自动运行程序所在位置 -> [注册表]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon; Shell

2010-8-7 20:15:30    创建注册表项    阻止
进程: c:\documents and settings\xe-cj\my documents\xxx_video_955.avi.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network_
规则: [注册表组]系统设置 -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\*

2010-8-7 20:15:33    创建注册表项    阻止
进程: c:\documents and settings\xe-cj\my documents\xxx_video_955.avi.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal_
规则: [注册表组]系统设置 -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\*

2010-8-7 20:15:38    创建注册表项    阻止
进程: c:\documents and settings\xe-cj\my documents\xxx_video_955.avi.exe
目标: HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Policies\system
规则: [注册表组]系统设置 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\*

O(∩_∩)O哈哈~

病毒名： Trojan-Dropper
建议： 保存并删除
特征Id: 43494369

--by ikarus

schumi小粉

to 咖啡~

jayavira

ess kill

   Win32/LockScreen.VL 特洛伊木马

XMonster

filseclab kill D:\下载\xxx_video_955.avi.rar>>xxx_video_955.avi.exe        Trojan.Generic.hooq        木马        还未处理