QQ刷钻充Q币及图标点亮器.exe [MD5: 173FDC] [VirusTotal: 2/43 (4.7%)]

蝉鸣时

File: QQ刷钻充Q币及图标点亮器.exe
MD5: 173FDC505BEE076ED9EF0B991048A4A4
VirusTotal: 2 / 43 (4.7%)　Click here to view the VirusTotal report

This file was submitted to ESET.

Thank you for your submission.
The detection for this threat will be included in our next signature update.

Regards,

Kopera Michal
Virus Researcher
ESET spol. s r.o.

小猫种鱼

红伞报

745931269

假的真不了，真的假不了。

pop0762

F-secure2009

360报了

jason_jiang

社会工程学233

zuo

2010-12-26 12:52:33    创建新进程    允许
进程: c:\documents and settings\administrator\桌面\qq刷钻充q币及图标点亮器\qq刷钻充q币及图标点亮器.exe
目标: c:\program files\internet explorer\iexplore.exe
命令行: "C:\Program Files\Internet Explorer\IEXPLORE.EXE"  http://www.niuniu980.cn
规则: [应用程序组]所有程序规则-系统程序执行规则 -> [应用程序]* -> [子应用程序]c:\program files\internet explorer\iexplore.exe

2010-12-26 12:52:35    修改注册表值    阻止
进程: c:\program files\internet explorer\iexplore.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Locked
值: 0x00000001(1)
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Internet explorer\Toolbar

2010-12-26 12:52:36    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\qq刷钻充q币及图标点亮器\qq刷钻充q币及图标点亮器.exe
目标: C:\windows\system32\data.dat
规则: [文件组]文件安全读写规则(询问创建) -> [文件]c:\windows\system32; *.*

2010-12-26 12:52:36    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\qq刷钻充q币及图标点亮器\qq刷钻充q币及图标点亮器.exe
目标: C:\windows\system32\data.dat
规则: [文件组]文件安全读写规则(询问创建) -> [文件]c:\windows\system32; *.*

2010-12-26 12:52:37    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\qq刷钻充q币及图标点亮器\qq刷钻充q币及图标点亮器.exe
目标: C:\windows\system32\data.dat
规则: [文件组]文件安全读写规则(询问创建) -> [文件]c:\windows\system32; *.*

2010-12-26 12:52:37    修改注册表值    阻止
进程: c:\program files\internet explorer\iexplore.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\system32\NOTEPAD.EXE
值: 记事本
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2010-12-26 12:52:37    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\qq刷钻充q币及图标点亮器\qq刷钻充q币及图标点亮器.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-26 12:52:38    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\qq刷钻充q币及图标点亮器\qq刷钻充q币及图标点亮器.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2010-12-26 12:52:39    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\qq刷钻充q币及图标点亮器\qq刷钻充q币及图标点亮器.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2010-12-26 12:52:39    从其他进程复制句柄    阻止
进程: c:\windows\system32\svchost.exe
目标: c:\documents and settings\administrator\桌面\qq刷钻充q币及图标点亮器\qq刷钻充q币及图标点亮器.exe
句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
规则: [应用程序]c:\windows\system32\svchost.exe

2010-12-26 12:52:39    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\qq刷钻充q币及图标点亮器\qq刷钻充q币及图标点亮器.exe
目标: TCP [本机 : 1258] ->  [202.102.110.204 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-26 12:52:39    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\qq刷钻充q币及图标点亮器\qq刷钻充q币及图标点亮器.exe
目标: TCP [本机 : 1259] ->  [61.174.63.178 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

西风萧雨

卡巴不报，上报卡巴`~ TO KL
Hello,

This message is generated by automatic letter reception system. The report contains information on what the verdicts on the files (if any in the letter) makes antivirus with latest updates. Letter will be passed to the virus analyst.

QQ刷钻充Q币及图标点亮器.exe

This file is in process.

Best Regards, Kaspersky Lab

10/1, 1st Volokolamsky Proezd, Moscow, 123060, Russia
Tel./Fax: + 7 (495) 797 8700
http://www.kaspersky.com http://www.viruslist.com

594157544

留侯

大蜘蛛clean，已上报