此毒狂笑费尔

显示全部楼层 · 发表于 2010-11-19 09:37:10

金山网盾KILL
gennic变种隶属于WIN32下 Trojan

显示全部楼层 · 发表于 2010-11-19 19:42:57

2010-11-19 19:41:04 c:\documents and settings\administrator\桌面\1\1.exe 创建文件 C:\Program Files\F0D372DB329B4CB080027FF4F94.t 阻止 [文件组]系统文件夹写保护(阻止创建) -> [文件]*\program files; *.*

2010-11-19 19:41:06 c:\documents and settings\administrator\桌面\1\1.exe 创建文件 C:\Program Files\F0D372DB329B4CB080027FF4F94.exe 阻止 [文件组]文件安全读写规则(询问创建) -> [文件]*\program files\*; *.exe

2010-11-19 19:41:06 c:\documents and settings\administrator\桌面\1\1.exe 创建文件 C:\Program Files\F0D372DB329B4CB080027FF4F94.vbs 阻止 [文件组]系统文件夹写保护(阻止创建) -> [文件]*\program files; *.*

2010-11-19 19:41:06 c:\documents and settings\administrator\桌面\1\1.exe 创建文件 C:\Program Files\F0D372DB329B4CB080027FF4F94.bat 阻止 [文件组]系统文件夹写保护(阻止创建) -> [文件]*\program files; *.*

2010-11-19 19:41:06 c:\documents and settings\administrator\桌面\1\1.exe 创建文件 C:\Program Files\F0D372DB329B4CB080027FF4F94.s 阻止 [文件组]系统文件夹写保护(阻止创建) -> [文件]*\program files; *.*

2010-11-19 19:41:06 c:\documents and settings\administrator\桌面\1\1.exe 创建文件 C:\Program Files\F0D372DB329B4CB080027FF4F94.s 阻止 [文件组]系统文件夹写保护(阻止创建) -> [文件]*\program files; *.*

2010-11-19 19:41:07 c:\documents and settings\administrator\桌面\1\1.exe 修改注册表值 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache 阻止 [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache 值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files

2010-11-19 19:41:08 c:\documents and settings\administrator\桌面\1\1.exe 修改注册表值 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies 阻止 [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies 值: C:\Documents and Settings\Administrator\Cookies

2010-11-19 19:41:09 c:\documents and settings\administrator\桌面\1\1.exe 修改注册表值 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History 阻止 [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History 值: C:\Documents and Settings\Administrator\Local Settings\History

2010-11-19 19:41:09 c:\windows\system32\svchost.exe 从其他进程复制句柄 c:\documents and settings\administrator\桌面\1\1.exe 阻止 [应用程序]c:\windows\system32\svchost.exe 句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness

2010-11-19 19:41:10 c:\documents and settings\administrator\桌面\1\1.exe 访问网络 TCP [本机 : 1147] -> [202.102.110.204 : 80 (http)] 阻止 [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-11-19 19:41:12 c:\documents and settings\administrator\桌面\1\1.exe 创建文件 C:\Program Files\F0D372DB329B4CB080027FF4F94.t 阻止 [文件组]系统文件夹写保护(阻止创建) -> [文件]*\program files; *.*

2010-11-19 19:41:22 c:\documents and settings\administrator\桌面\1\1.exe 创建文件 C:\Program Files\F0D372DB329B4CB080027FF4F94.t 阻止 [文件组]系统文件夹写保护(阻止创建) -> [文件]*\program files; *.*

显示全部楼层 · 发表于 2010-11-20 00:12:09

AVAST KILL

显示全部楼层 · 发表于 2010-11-20 06:18:52

看到很多人注册时间比我短但是积分比我高那么多我就知道都是我只看帖不回帖的缘故了

[病毒样本] 此毒狂笑费尔