又一个金山安全

绅博周幸

mipko.ru/files/mipko_time_sheriff_setup_203.exe

dalianjhc1986

http://samples.nod32.com.sg/inde ... 15dcc73298f33547b47

saga3721

红伞杀“SPR/Tool.KGBKeylogger.268 [riskware]”

Mr.Tong

360未知

andoyi

没敢实机测试

留侯

文件加了壳，大蜘蛛：
mipko_time_sheriff_setup_203.exe - 压缩文件 BINARYRES
mipko_time_sheriff_setup_203.exe/data002 - 压缩文件 INNO SETUP
mipko_time_sheriff_setup_203.exe/data002/Script2.bin - 压缩文件 BINARYRES
mipko_time_sheriff_setup_203.exe/data002/0.file 已打包，方式： ASPROTECT
mipko_time_sheriff_setup_203.exe/data002/0.file 已打包，方式： FLY-CODE
mipko_time_sheriff_setup_203.exe/data002/0.file 已打包，方式： ZLIB
mipko_time_sheriff_setup_203.exe/data002/0.file - 压缩文件 BINARYRES
mipko_time_sheriff_setup_203.exe/data002/1.file 已打包，方式： ASPROTECT
mipko_time_sheriff_setup_203.exe/data002/1.file 已打包，方式： FLY-CODE
mipko_time_sheriff_setup_203.exe/data002/1.file 已打包，方式： ZLIB
mipko_time_sheriff_setup_203.exe/data002/1.file - 压缩文件 BINARYRES
mipko_time_sheriff_setup_203.exe/data002/4.file 是风险程序 Program.MPK
mipko_time_sheriff_setup_203.exe/data002/30.file - 压缩文件 NSIS
mipko_time_sheriff_setup_203.exe/data002/30.file/DriverSigning.exe 已打包，方式： FLY-CODE

Palkia

俄语。。。我觉得是正常程序。

jayavira

elg显示病毒，等级为10

星晨

BitDefender to

hddu

2011-09-20 14:05:02    运行应用程序      操作:允许
进程路径:F:\virus\mipko_time_sheriff_setup_203.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
命令行:/SL5="$A024A,4585419,140800,F:\virus\mipko_time_sheriff_setup_203.exe"
触发规则:所有程序规则->其它程序设置->*\Temp\*


2011-09-20 14:05:19    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*


2011-09-20 14:05:20    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Documents and Settings\All Users\Application Data\TS
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-09-20 14:05:23    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-MVDTL.tmp\MPK_FLT.exe
命令行:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-09-20 14:05:23    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-MVDTL.tmp\MPK_FLT.exe
文件路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\DriverSigning.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*.exe


2011-09-20 14:05:23    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-MVDTL.tmp\MPK_FLT.exe
文件路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*.exe


2011-09-20 14:05:23    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-MVDTL.tmp\MPK_FLT.exe
文件路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\ndisrd.sys
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*.sys


2011-09-20 14:05:23    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-MVDTL.tmp\MPK_FLT.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\nsj6.tmp\ns7.tmp
命令行:"C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\DriverSigning.exe" /verbose /off
触发规则:所有程序规则->其它程序设置->*\Temp\*


2011-09-20 14:05:24    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\nsj6.tmp\ns7.tmp
文件路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\DriverSigning.exe
命令行:/verbose /off
触发规则:应用程序规则->自动创建规则->?:\*


2011-09-20 14:05:24    修改注册表内容      操作:阻止
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\DriverSigning.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Driver Signing
注册表名称:Policy
触发规则:所有程序规则->其他重要项->*\Software\Microsoft\Driver Signing


2011-09-20 14:05:24    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-MVDTL.tmp\MPK_FLT.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\nsj6.tmp\ns8.tmp
命令行:"C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe" -v -l ndisrd.inf -m ndisrd_m.inf -c s -i nt_ndisrd
触发规则:所有程序规则->其它程序设置->*\Temp\*


2011-09-20 14:05:24    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\nsj6.tmp\ns8.tmp
文件路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
命令行:-v -l ndisrd.inf -m ndisrd_m.inf -c s -i nt_ndisrd
触发规则:应用程序规则->自动创建规则->?:\*


2011-09-20 14:05:33    修改文件      操作:阻止
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\setupapi.log
触发规则:所有程序规则->WINDOWS允许设置->%windir%\*.log


2011-09-20 14:05:33    修改文件      操作:阻止
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\setupapi.log
触发规则:所有程序规则->WINDOWS允许设置->%windir%\*.log


2011-09-20 14:05:33    修改文件      操作:阻止
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\setupapi.log
触发规则:所有程序规则->WINDOWS允许设置->%windir%\*.log


2011-09-20 14:05:35    创建文件      操作:允许
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\LastGood
触发规则:所有程序规则->WINDOWS全局设置->%windir%\*


2011-09-20 14:05:35    创建文件      操作:允许
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\LastGood\INF
触发规则:所有程序规则->WINDOWS允许设置->%windir%\LastGood\*


2011-09-20 14:05:35    创建文件      操作:允许
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\LastGood\INF\oem1.inf
触发规则:所有程序规则->WINDOWS允许设置->%windir%\LastGood\*


2011-09-20 14:05:35    创建文件      操作:允许
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\LastGood\INF\oem1.inf
触发规则:所有程序规则->WINDOWS允许设置->%windir%\LastGood\*


2011-09-20 14:05:35    创建文件      操作:允许
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\LastGood\INF\oem1.PNF
触发规则:所有程序规则->WINDOWS允许设置->%windir%\LastGood\*


2011-09-20 14:05:35    创建文件      操作:允许
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\LastGood\INF\oem1.PNF
触发规则:所有程序规则->WINDOWS允许设置->%windir%\LastGood\*


2011-09-20 14:05:36    修改文件      操作:阻止
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\setupapi.log
触发规则:所有程序规则->WINDOWS允许设置->%windir%\*.log


2011-09-20 14:05:36    修改文件      操作:阻止
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\setupapi.log
触发规则:所有程序规则->WINDOWS允许设置->%windir%\*.log


2011-09-20 14:05:37    创建文件      操作:允许
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\LastGood\INF\oem2.inf
触发规则:所有程序规则->WINDOWS允许设置->%windir%\LastGood\*


2011-09-20 14:05:37    创建文件      操作:允许
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\LastGood\INF\oem2.inf
触发规则:所有程序规则->WINDOWS允许设置->%windir%\LastGood\*


2011-09-20 14:05:37    创建文件      操作:允许
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\LastGood\INF\oem2.PNF
触发规则:所有程序规则->WINDOWS允许设置->%windir%\LastGood\*


2011-09-20 14:05:37    创建文件      操作:允许
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\LastGood\INF\oem2.PNF
触发规则:所有程序规则->WINDOWS允许设置->%windir%\LastGood\*


2011-09-20 14:05:46    修改文件      操作:阻止
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\setupapi.log
触发规则:所有程序规则->WINDOWS允许设置->%windir%\*.log


2011-09-20 14:05:46    修改文件      操作:阻止
进程路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\snetcfg.exe
文件路径:C:\WINDOWS\setupapi.log
触发规则:所有程序规则->WINDOWS允许设置->%windir%\*.log


2011-09-20 14:05:48    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-MVDTL.tmp\MPK_FLT.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\nsj6.tmp\nsF.tmp
命令行:"C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\DriverSigning.exe" /verbose /on
触发规则:所有程序规则->其它程序设置->*\Temp\*


2011-09-20 14:05:48    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\nsj6.tmp\nsF.tmp
文件路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\instimtmp\DriverSigning.exe
命令行:/verbose /on
触发规则:应用程序规则->自动创建规则->?:\*


2011-09-20 14:05:49    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-MVDTL.tmp\MPK_FLT.exe
文件路径:C:\Documents and Settings\All Users\Application Data\TS\DRVFLT\fltun.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*.exe


2011-09-20 14:05:51    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\unins000.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe


2011-09-20 14:05:53    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\unins000.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe


2011-09-20 14:05:56    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\MPKTS.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe


2011-09-20 14:05:57    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\MPKTS.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe


2011-09-20 14:06:00    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\MPKTSView.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe


2011-09-20 14:06:01    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\MPKTSView.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe


2011-09-20 14:06:02    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\MPKTS.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll


2011-09-20 14:06:02    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\MPKTS.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll


2011-09-20 14:06:02    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\MPKTS64.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll


2011-09-20 14:06:02    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\MPKTS64.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll


2011-09-20 14:06:03    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\MPKTS64.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe


2011-09-20 14:06:04    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\MPKTS64.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe


2011-09-20 14:06:05    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\sqlite3.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll


2011-09-20 14:06:05    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\sqlite3.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll


2011-09-20 14:06:06    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\Images
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*\*


2011-09-20 14:06:07    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\Help
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*\*


2011-09-20 14:06:08    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\Help\English\invisible.htm
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.htm


2011-09-20 14:06:09    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\Help\English\password.htm
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.htm


2011-09-20 14:06:10    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\Help\English\popupmessage.htm
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.htm


2011-09-20 14:06:11    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\Help\English\settings_node.htm
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.htm


2011-09-20 14:06:12    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\Help\English\timecontrol.htm
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.htm


2011-09-20 14:06:13    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\Help\English\update.htm
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.htm


2011-09-20 14:06:14    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\Help\English\users_node.htm
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.htm


2011-09-20 14:06:15    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\Help\Russian\invisible.htm
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.htm


2011-09-20 14:06:16    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\Help\Russian\password.htm
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.htm


2011-09-20 14:06:16    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\Help\Russian\popupmessage.htm
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.htm


2011-09-20 14:06:17    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\Help\Russian\settings_node.htm
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.htm


2011-09-20 14:06:18    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\Help\Russian\timecontrol.htm
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.htm


2011-09-20 14:06:19    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\Help\Russian\update.htm
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.htm


2011-09-20 14:06:20    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\Help\Russian\users_node.htm
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.htm


2011-09-20 14:06:20    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\ndisapi.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll


2011-09-20 14:06:20    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Program Files\TS\ndisapi.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll


2011-09-20 14:06:22    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Documents and Settings\Administrator\「开始」菜单\程序\Time Sheriff
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\*


2011-09-20 14:06:23    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Documents and Settings\Administrator\「开始」菜单\程序\Time Sheriff\Time Sheriff.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk


2011-09-20 14:06:25    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Documents and Settings\Administrator\「开始」菜单\程序\Time Sheriff\Сайт Time Sheriff в Интернете.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk


2011-09-20 14:06:27    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Documents and Settings\Administrator\「开始」菜单\程序\Time Sheriff\Купить сейчас!.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk


2011-09-20 14:06:29    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\Documents and Settings\Administrator\桌面\Time Sheriff.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\桌面\*.lnk


2011-09-20 14:06:29    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
文件路径:C:\WINDOWS\system32\runts.lnk
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->%WinDir%\system32\*


2011-09-20 14:06:29    修改注册表内容      操作:使用任务隔离区操作
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
注册表名称:Userinit
更改后:c:\windows\system32\userinit.exe,C:\Program Files\TS\MPKTS.exe
更改前:C:\WINDOWS\system32\userinit.exe,
触发规则:应用程序规则->WinLogon设置->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon*


2011-09-20 14:06:30    创建注册表值      操作:使用任务隔离区操作
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-NDLOM.tmp\mipko_time_sheriff_setup_203.tmp
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
注册表名称:DefaultDataInformation
触发规则:应用程序规则->WinLogon设置->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon*