带数字签名的Adware， 24/ 43 (55.8%)VirusTotal MD5:05a34d

s8706042

已上報趨勢嚕~

Love=卡巴+费尔

bbszy

Kaspersky Lab
拒绝访问
无法访问该网页

请求的网址：

http://bbs.kafan.cn/forum-attachment-aid
-mta5nty0ohximje1zta5zxwxmjk1odmzmjg5fdq
2mdg2ng%3d%3d.html

包含的正版软件可能被犯罪分子利用以破坏您的计算机或窃取隐私数据
not-a-virus:WebToolbar.Win32.Zango.aft

创建日期： 9:40:25

710244016

pyic 发表于 2011-1-23 19:32
http://www.virustotal.com/file-scan/report.html?id=3613f8386e7d3ceb517773c59bbc6196e9151806c29e5 ...

黑羽

hitman 胶囊均报

hadg

360 KILL

XMonster

avg 阻止联网

zuo

2011-1-24 18:08:02    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\setup\setup.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2011-1-24 18:08:03    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\setup\setup.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2011-1-24 18:08:03    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\setup\setup.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2011-1-24 18:08:03    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\setup\setup.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@xpsp3res.dll,-20001
值: 诊断连接问题...
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache; @*

2011-1-24 18:08:04    从其他进程复制句柄    阻止
进程: c:\windows\system32\svchost.exe
目标: c:\documents and settings\administrator\桌面\setup\setup.exe
句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
规则: [应用程序]c:\windows\system32\svchost.exe

2011-1-24 18:08:23    创建新进程    允许
进程: c:\documents and settings\administrator\桌面\setup\setup.exe
目标: c:\documents and settings\administrator\local settings\temp\sai5.exe
命令行: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sai5.exe /AffiliateId=1000007011 /BannerId= /Requestor=
规则: [应用程序组]所有程序规则-外部程序执行规则 -> [应用程序]* -> [子应用程序]*temp\*.exe

2011-1-24 18:08:31    删除文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\sai5.exe
目标: C:\Program Files\HBCheckPermission.txt
规则: [文件组]文件安全读写规则(允许创建，阻止修改、删除) -> [文件]*; *.txt

2011-1-24 18:08:35    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\sai5.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2011-1-24 18:08:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\sai5.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2011-1-24 18:08:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\sai5.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2011-1-24 18:08:37    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\sai5.exe
目标: TCP [本机 : 1584] ->  [66.150.14.74 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2011-1-24 18:08:37    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\sai5.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsr8.tmp\Install.dll
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SYSTEM\*ControlSet*\Control\Session Manager; *FileRenameOperations

2011-1-24 18:08:37    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\sai5.exe
目标: C:\WINDOWS\wininit.ini
规则: [文件组]系统文件加强型保护(防修改) -> [文件]c:\windows; wininit.ini

2011-1-24 18:08:37    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\sai5.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsr8.tmp\System.dll
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SYSTEM\*ControlSet*\Control\Session Manager; *FileRenameOperations

2011-1-24 18:08:37    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\sai5.exe
目标: C:\WINDOWS\wininit.ini
规则: [文件组]系统文件加强型保护(防修改) -> [文件]c:\windows; wininit.ini

2011-1-24 18:08:37    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\sai5.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsr8.tmp\
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SYSTEM\*ControlSet*\Control\Session Manager; *FileRenameOperations

2011-1-24 18:08:37    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\sai5.exe
目标: C:\WINDOWS\wininit.ini
规则: [文件组]系统文件加强型保护(防修改) -> [文件]c:\windows; wininit.ini

2011-1-24 18:08:48    创建新进程    阻止
进程: c:\documents and settings\administrator\桌面\setup\setup.exe
目标: c:\documents and settings\administrator\local settings\temp\sai9.exe
命令行: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sai9.exe /did= /homepage= /defaultsearch= /banner_id=
规则: [应用程序组]所有程序规则-外部程序执行规则 -> [应用程序]* -> [子应用程序]*temp\*.exe

2011-1-24 18:08:53    创建新进程    阻止
进程: c:\documents and settings\administrator\桌面\setup\setup.exe
目标: c:\documents and settings\administrator\local settings\temp\saia.exe
命令行: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\saiA.exe
规则: [应用程序组]所有程序规则-外部程序执行规则 -> [应用程序]* -> [子应用程序]*temp\*.exe

2011-1-24 18:08:58    创建新进程    阻止
进程: c:\documents and settings\administrator\桌面\setup\setup.exe
目标: c:\program files\internet explorer\iexplore.exe
命令行: "C:\Program Files\Internet Explorer\iexplore.exe" http://free.porndirt.com/row/defaultpop/
规则: [应用程序组]所有程序规则-系统程序执行规则 -> [应用程序]* -> [子应用程序]c:\program files\internet explorer\iexplore.exe

Raid

2011-1-25 12:17:16        恶意HTTP对象 <http://bbs.kafan.cn/forum-attach ... tml//Setup.exe//UPX>：detected: 风险软件 'not-a-virus:WebToolbar.Win32.Zango.aft'。
没过卡巴