New-Video-Addon.48134.exe

jrsmith

F-Secure Client Security 9.1
攔截

hj5abc

熊猫云
suspicious file

xc19882001

KOI9009

360 SD Kill

星晨

BitDefender New-Video-Addon.48134.exe Gen:Variant.Kazy.16058

shanghaiplmm

诺顿杀掉.

zuo

2011-3-20 13:25:19    删除注册表值    阻止
进程: c:\program files\winrar\winrar.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program Files\WinRAR\WinRAR.exe
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2011-3-20 13:25:19    修改注册表值    阻止
进程: c:\program files\winrar\winrar.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\LangID
值: 04 08
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2011-3-20 13:25:25    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\new-video-addon[1].48134.exe\new-video-addon.48134.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2011-3-20 13:25:26    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\new-video-addon[1].48134.exe\new-video-addon.48134.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2011-3-20 13:25:26    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\new-video-addon[1].48134.exe\new-video-addon.48134.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2011-3-20 13:25:27    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\new-video-addon[1].48134.exe\new-video-addon.48134.exe
目标: TCP [本机 : 1586] ->  [64.120.174.121 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2011-3-20 13:25:28    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\new-video-addon[1].48134.exe\new-video-addon.48134.exe
目标: TCP [本机 : 1587] ->  [76.76.104.99 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2011-3-20 13:25:28    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\new-video-addon[1].48134.exe\new-video-addon.48134.exe
目标: TCP [本机 : 1588] ->  [76.76.104.99 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2011-3-20 13:25:29    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\new-video-addon[1].48134.exe\new-video-addon.48134.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Unb..bat
规则: [文件组]文件安全读写规则(询问创建) -> [文件]*temp\*; *.bat

qianyuqx

rising kill

fatezero

KIS

检测到威胁: Trojan-Downloader.Win32.CodecPack.anbb        E:\download\New-Video-Addon.48134.exe.7z/New-Video-Addon.48134.exe               

jason_jiang

MSG [2824] 2011/03/20 16:42:24: R:\temp\Rar$DR54.888\New-Video-Addon.48134.exe (diagnosis: Malware family: VirTool.Win32.Obfuscator.hg!b1 (v) accessed by: D:\Program Files\WinRAR\WinRAR.exe) => Block