Win32/TrojanClicker.Delf.NLX

显示全部楼层 · 发表于 2010-12-19 19:39:33

2010-12-19 19:38:00 创建新进程允许
进程: c:\documents and settings\administrator\桌面\setup\setup.exe
目标: c:\windows\system32\cmd.exe
命令行: cmd /c C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\hluqybd.bat
规则: [应用程序组]所有程序规则-系统程序执行规则 -> [应用程序]* -> [子应用程序]c:\windows\system32\cmd.exe

2010-12-19 19:38:02 创建文件阻止
进程: c:\windows\system32\cmd.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\jliwdvzq.bat
规则: [文件组]文件安全读写规则(询问创建) -> [文件]*temp\*; *.bat

2010-12-19 19:38:05 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\setup\setup.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-19 19:38:06 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\setup\setup.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2010-12-19 19:38:06 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\setup\setup.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2010-12-19 19:38:07 从其他进程复制句柄阻止
进程: c:\windows\system32\svchost.exe
目标: c:\documents and settings\administrator\桌面\setup\setup.exe
句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
规则: [应用程序]c:\windows\system32\svchost.exe

2010-12-19 19:38:08 创建文件阻止并结束进程
进程: c:\documents and settings\administrator\桌面\setup\setup.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\YB61O80O\setup[1].exe
规则: [文件组]系统文件夹写保护(拒绝创建) -> [文件]c:\documents and settings\*; *.exe

显示全部楼层 · 发表于 2010-12-19 23:05:49

趨勢可偵測嚕~~

显示全部楼层 · 发表于 2010-12-19 23:06:44

KIS拦截

显示全部楼层 · 发表于 2010-12-19 23:44:21

To KL

显示全部楼层 · 发表于 2010-12-20 00:00:55

MSE杀了

显示全部楼层 · 发表于 2010-12-20 06:58:26

TR/Dropper.Gen avirakill

显示全部楼层 · 发表于 2010-12-20 07:32:31

Trj/CI.A

[病毒样本] Win32/TrojanClicker.Delf.NLX

本帖子中包含更多资源