aini.exe

Love=卡巴+费尔

s8706042

已上報趨勢~

猪头大队

BackDoor-AWQ.l

hadg

两个一起下完后，在能查出病毒。
C:\Documents and Settings\Administrator\桌面\截图1289388507.jpg
C:\Documents and Settings\Administrator\桌面\截图1289388564.jpg

ljy_0119

第一个分卷，小a没报，第二个刚打开，还没下完，小a就拦截了

尤金卡巴斯基

Aini.exe - Trojan.Win32.Delf.ahqs
Eumif.exe - Trojan.Win32.Delf.ahqt
Awko.dll - Backdoor.Win32.Hupigon.mqqb

jinyuming

回复 16楼 尤金卡巴斯基 的帖子

你咋知道这病名称的？和卡巴回信一样
莫非是卡巴的~

左手

2010-11-11 17:04:39    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\obcsk\eumif.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-11 17:04:40    读文件    阻止
进程: c:\documents and settings\administrator\桌面\test\obcsk\aini.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-11 17:04:40    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\obcsk\aini.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-11 17:04:45    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\obcsk\aini.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-11 17:04:45    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\obcsk\aini.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
规则: [注册表]*

2010-11-11 17:04:45    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\obcsk\aini.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1\CacheLimit
值: 0x00007d04(32004)
规则: [注册表]*

2010-11-11 17:04:45    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\obcsk\aini.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-11 17:04:45    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\obcsk\aini.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-11 17:04:45    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\test\obcsk\aini.exe
目标: C:\Documents and Settings\Administrator\桌面\test\Obcsk\Rkiah\Aini.ini
规则: [文件组]文件保护 -> [文件]c:\documents and settings\*\桌面\*

2010-11-11 17:04:45    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\test\obcsk\aini.exe
目标: C:\Documents and Settings\Administrator\桌面\test\Obcsk\Rkiah\Aini.ini
规则: [文件组]文件保护 -> [文件]c:\documents and settings\*\桌面\*

2010-11-11 17:04:45    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\test\obcsk\aini.exe
目标: C:\Documents and Settings\Administrator\桌面\test\Obcsk\Rkiah\Aini.ini
规则: [文件组]文件保护 -> [文件]c:\documents and settings\*\桌面\*

2010-11-11 17:04:45    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\test\obcsk\aini.exe
目标: C:\Program Files\Common Files\System\Ole DB\msadotb.htm
规则: [文件组][S]系统文件夹 -> [文件]c:\program files\common files\system\*

2010-11-11 17:04:54    读文件    阻止
进程: c:\documents and settings\administrator\桌面\test\obcsk\eumif.exe
目标: \Device\NamedPipe\EVENTLOG
规则: [文件]*

F-secure2009

小A拦住了