Trojan-Downloader.Win32.Delf.aiua

zuo

2010-12-19 19:34:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\setop3010\setop3010.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winmgmt\Start
值: 0x00000002(2)
规则: [注册表组]系统关键设置保护(询问) -> [注册表]*\SYSTEM\*Controlset*\Services\*; Start

2010-12-19 19:34:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\setop3010\setop3010.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-19 19:34:26    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\setop3010\setop3010.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2010-12-19 19:34:27    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\setop3010\setop3010.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2010-12-19 19:34:28    从其他进程复制句柄    阻止
进程: c:\windows\system32\svchost.exe
目标: c:\documents and settings\administrator\桌面\setop3010\setop3010.exe
句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
规则: [应用程序]c:\windows\system32\svchost.exe

2010-12-19 19:34:28    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\setop3010\setop3010.exe
目标: TCP [本机 : 1406] ->  [202.102.110.204 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-19 19:34:28    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\setop3010\setop3010.exe
目标: TCP [本机 : 1407] ->  [218.29.109.120 : 81]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-19 19:34:28    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\setop3010\setop3010.exe
目标: TCP [本机 : 1408] ->  [58.253.235.82 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

fatezero

KIS
检测到威胁: Trojan-Downloader.Win32.Delf.aiua        E:\download\setop3010.7z/setop3010.exe       

s8706042

已上報趨勢嚕~

jason_jiang

Trj/CI.A