e10930125t.exe

留侯

大蜘蛛MISS，加了壳：e10930125t.exe packed by UPX
已上报

zuo

2010-12-12 20:09:42    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\e10930125t\e10930125t.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-12 20:09:43    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\e10930125t\e10930125t.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2010-12-12 20:09:44    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\e10930125t\e10930125t.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2010-12-12 20:09:46    从其他进程复制句柄    阻止
进程: c:\windows\system32\svchost.exe
目标: c:\documents and settings\administrator\桌面\e10930125t\e10930125t.exe
句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
规则: [应用程序]c:\windows\system32\svchost.exe

2010-12-12 20:09:46    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\e10930125t\e10930125t.exe
目标: TCP [本机 : 1032] ->  [202.102.110.204 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-12 20:09:46    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\e10930125t\e10930125t.exe
目标: TCP [本机 : 1033] ->  [61.147.72.202 : 91]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

huangqian202

s8706042

已上報趨勢~

猪头大队

360网盾报毒
红伞
开始在“C:\Users\Administrator\Downloads\e10930125t.7z”中扫描
C:\Users\Administrator\Downloads\e10930125t.7z
[0] 存档类型: 7-Zip
  [检测]        是 TR/Dropper.Gen 特洛伊木马
--> e10930125t.exe
  [检测]        是 TR/Dropper.Gen 特洛伊木马

kinkids

Kaspersky Internet Security 2011，
掃瞄偵測為{Trojan-PSW.Win32.QQShou.all}，
已進行隔離/刪除動作。

掃瞄偵測到1個可疑檔案，--個 Kaspersky Cloud，--個啟發，1個特徵碼，一隻病毒一條特徵碼，傻眼，囧rz，
剩餘--個文件MISS，無威脅可疑，已提交至 Kaspersky。