smss2.exe

O(∩_∩)O哈哈~

蝉鸣时

ESET NOD32 detected.
smss2.exe - a variant of Win32/TrojanClicker.BHO.NCB trojan

留侯

大蜘蛛：smss2.exe found virus Trojan.Click1.28270

hansyu

AVG Identity Protecion Blocked

xiongchuanxc

360sd qvm报恶意程序

xiongchuanxc

360网盾报未知

fatezero

to kl

猪头大队

avira miss, 360网盾 未知，上报,已入库，看来是没解压的关系。

zdolo

QVM06

zuo

2010-12-11 19:15:33    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\smss2\smss2.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-11 19:15:33    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\smss2\smss2.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2010-12-11 19:15:34    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\smss2\smss2.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2010-12-11 19:15:35    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\smss2\smss2.exe
目标: C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.url
规则: [文件组]系统文件夹写保护(询问创建、修改) -> [文件]c:\*\microsoft\internet explorer\quick launch\*

2010-12-11 19:15:37    从其他进程复制句柄    阻止
进程: c:\windows\system32\svchost.exe
目标: c:\documents and settings\administrator\桌面\smss2\smss2.exe
句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
规则: [应用程序]c:\windows\system32\svchost.exe

2010-12-11 19:15:37    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\smss2\smss2.exe
目标: TCP [本机 : 1414] ->  [202.102.110.204 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-11 19:15:37    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\smss2\smss2.exe
目标: TCP [本机 : 1415] ->  [119.84.84.57 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-11 19:15:37    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\smss2\smss2.exe
目标: C:\WINDOWS\Survival_0.txt
规则: [文件组]文件安全读写规则(允许创建，阻止修改、删除) -> [文件]*; *.txt

2010-12-11 19:15:40    创建新进程    阻止
进程: c:\documents and settings\administrator\桌面\smss2\smss2.exe
目标: c:\windows\system32\reg.exe
命令行: reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v "micrososoot" /d "c:\documents and settings\administrator\桌面\smss2\smss2.exe " /f
规则: [应用程序组]所有程序规则-系统程序执行规则 -> [应用程序]* -> [子应用程序]*\reg.exe

2010-12-11 19:15:42    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\smss2\smss2.exe
目标: C:\Documents and Settings\All Users\「开始」菜单\程序\启动\hihotrun.jse
规则: [文件组]系统文件夹写保护(询问创建、修改) -> [文件]c:\documents and settings\*\程序\启动\*