Mal/Generic-L [MD5: D9E80F]

黑衣~魂

Dr.web 6.0
svchost(1).rar\svchost(1).exe;C:\Documents and Settings\all\桌面\svchost(1).rar;Trojan.DownLoader1.17440;;
svchost(1).rar;C:\Documents and Settings\all\桌面;發現壓縮檔案中有被感染的檔案;已刪除。;

蝉鸣时

Kaspersky detected.
svchost(1).exe - HEUR:Trojan.Win32.Generic

To KL.

Hello,

This message is generated by automatic letter reception system. The report contains information on what the verdicts on the files (if any in the letter) makes antivirus with latest updates. Letter will be passed to the virus analyst.

svchost(1).exe - Trojan-Spy.Win32.Agent.bink

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Best Regards, Kaspersky Lab

XE-cj

2010-8-12 19:48:51    创建新进程    允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\xe-cj\my documents\svchost(1).exe
命令行: "C:\Documents and Settings\XE-CJ\My Documents\svchost(1).exe"
规则: [应用程序]c:\windows\explorer.exe

2010-8-12 19:48:56    从其他进程复制句柄    阻止
进程: c:\documents and settings\xe-cj\my documents\svchost(1).exe
目标: c:\windows\system32\smss.exe
句柄: (Process) c:\windows\system32\csrss.exe
规则: [应用程序]*

2010-8-12 19:48:58    修改其他进程的内存    阻止
进程: c:\documents and settings\xe-cj\my documents\svchost(1).exe
目标: c:\windows\system32\csrss.exe
规则: [应用程序]*

2010-8-12 19:49:01    修改注册表值    阻止
进程: c:\documents and settings\xe-cj\my documents\svchost(1).exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\c:\documents and settings\all users\application data\kingsoft\kis\uplive\kisliveca59683breupdate.dat  \??\C:\Documents and Settings\XE-CJ\My Documents\svchost(1).exe
规则: [注册表组]自动运行程序所在位置 -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager; PendingFileRenameOperations