1X

猪头大队

360网盾报毒

瑞星无视

恋亿晓

to avast!

尤金卡巴斯基

xiegua3.1.exe_ - Trojan-Downloader.Win32.NSIS.hb

gogo8989

360网盾独立版本不报.360云上报后显示是危险

zuo

2011-1-9 19:13:49    删除注册表值    阻止
进程: c:\program files\winrar\winrar.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Documents and Settings\Administrator\桌面\9158chat_11826.exe
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2011-1-9 19:13:49    修改注册表值    阻止
进程: c:\program files\winrar\winrar.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\LangID
值: 04 08
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2011-1-9 19:13:57    创建新进程    允许
进程: c:\documents and settings\administrator\桌面\xiegua3[1].1\xiegua3.1.exe
目标: c:\documents and settings\administrator\local settings\temp\xieguaddzjpq.exe
命令行: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\xieguaddzjpq.exe
规则: [应用程序组]所有程序规则-外部程序执行规则 -> [应用程序]* -> [子应用程序]*temp\*.exe

2011-1-9 19:13:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\xieguaddzjpq.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2011-1-9 19:13:59    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\xiegua3[1].1\xiegua3.1.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2011-1-9 19:14:00    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\xieguaddzjpq.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2011-1-9 19:14:00    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\xiegua3[1].1\xiegua3.1.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2011-1-9 19:14:01    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\xieguaddzjpq.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2011-1-9 19:14:01    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\xiegua3[1].1\xiegua3.1.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2011-1-9 19:14:01    从其他进程复制句柄    阻止
进程: c:\windows\system32\svchost.exe
目标: c:\documents and settings\administrator\local settings\temp\xieguaddzjpq.exe
句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
规则: [应用程序]c:\windows\system32\svchost.exe

2011-1-9 19:14:02    从其他进程复制句柄    阻止
进程: c:\windows\system32\svchost.exe
目标: c:\documents and settings\administrator\桌面\xiegua3[1].1\xiegua3.1.exe
句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
规则: [应用程序]c:\windows\system32\svchost.exe

2011-1-9 19:14:02    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\xieguaddzjpq.exe
目标: TCP [本机 : 1372] ->  [202.102.110.204 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2011-1-9 19:14:02    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\xieguaddzjpq.exe
目标: TCP [本机 : 1373] ->  [173.224.208.72 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2011-1-9 19:14:02    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\xiegua3[1].1\xiegua3.1.exe
目标: TCP [本机 : 1374] ->  [202.102.110.204 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2011-1-9 19:14:02    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\xiegua3[1].1\xiegua3.1.exe
目标: TCP [本机 : 1375] ->  [111.68.2.102 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2011-1-9 19:14:02    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\xiegua3[1].1\xiegua3.1.exe
目标: TCP [本机 : 1376] ->  [111.68.2.146 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2011-1-9 19:14:05    删除注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\xieguaddzjpq.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Documents and Settings\Administrator\桌面\9158chat_11826.exe
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2011-1-9 19:14:05    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\xieguaddzjpq.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\LangID
值: 04 08
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2011-1-9 19:14:08    创建新进程    阻止
进程: c:\documents and settings\administrator\local settings\temp\xieguaddzjpq.exe
目标: c:\program files\internet explorer\iexplore.exe
命令行: "C:\Program Files\Internet Explorer\iexplore.exe" http://www.xiegua.com/read-htm-tid-1770.html
规则: [应用程序组]RD应用程序规则-危险进程执行规则 -> [应用程序]*temp\*.* -> [子应用程序]4D应用程序规则-浏览进程执行规则 -> [应用程序]c:\program files\internet explorer\iexplore.exe