1/ 43 (2.3%)

luxiao200888

http://www.virustotal.com/file-s ... 52a58c82-1292125568

蝉鸣时

To ESET and KL.

Mail from ESET

Thank you for your submission.
The detection for this threat will be included in our next signature update.

7FD5AA_211.exe - Win32/TrojanDownloader.Agent.QLE trojan

Regards,

Dalibor Drzik
Virus Researcher
ESET spol. s r.o.

414447992

qvm09

zuo

2010-12-12 12:17:14    修改注册表值    允许
进程: c:\documents and settings\administrator\桌面\7fd5aa_211\7fd5aa_211.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Documents and Settings\Administrator\桌面\7FD5AA_211\7FD5AA_211.exe
值: C:\Documents and Settings\Administrator\桌面\7FD5AA_211\7FD5AA_211.exe:*:Disabled:System_media
规则: [注册表组]系统关键设置保护(询问) -> [注册表]*\SYSTEM\*Controlset*\Services\*

2010-12-12 12:17:16    修改注册表值    允许
进程: c:\documents and settings\administrator\桌面\7fd5aa_211\7fd5aa_211.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-12 12:17:17    修改注册表值    允许
进程: c:\documents and settings\administrator\桌面\7fd5aa_211\7fd5aa_211.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2010-12-12 12:17:18    修改注册表值    允许
进程: c:\documents and settings\administrator\桌面\7fd5aa_211\7fd5aa_211.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2010-12-12 12:17:18    从其他进程复制句柄    允许
进程: c:\windows\system32\svchost.exe
目标: c:\documents and settings\administrator\桌面\7fd5aa_211\7fd5aa_211.exe
句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
规则: [应用程序]c:\windows\system32\svchost.exe

2010-12-12 12:17:19    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\7fd5aa_211\7fd5aa_211.exe
目标: TCP [本机 : 1201] ->  [202.102.110.204 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-12 12:17:19    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\7fd5aa_211\7fd5aa_211.exe
目标: TCP [本机 : 1202] ->  [68.68.105.163 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-12 12:17:20    删除注册表值    阻止
进程: c:\documents and settings\administrator\桌面\7fd5aa_211\7fd5aa_211.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@shell32.dll,-31233
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache; @*

2010-12-12 12:17:20    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\7fd5aa_211\7fd5aa_211.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\LangID
值: 04 08
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2010-12-12 12:17:26    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\7fd5aa_211\7fd5aa_211.exe
目标: TCP [本机 : 1203] ->  [68.68.105.163 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-12 12:17:26    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\7fd5aa_211\7fd5aa_211.exe
目标: TCP [本机 : 1204] ->  [68.68.105.163 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

oneappleliu

上报 金山 NOD32

留侯

大蜘蛛clean

恋亿晓

to avast!

listen1

to avira

ablhr

回复 8楼 listen1 的帖子

乃咋也来样本区玩了

卍解十字架