哥惨遭wgsdgsdgdsgsd.zip逆袭 2 / 46 不解释 （再加一个毒网地址，33楼EQ完整拦截

firefox3

好端端的电脑为何无端重启，大毛豆为何半夜惨叫，请看这一集……楼主的不归路



https://www.virustotal.com/file/ ... nalysis/1354767346/

毒网地址：hour.learningfundamental.org/r/l/updating-bugs_keeping.php （应该是这个，没敢再进去）再加一个，真的猛士进：interest.fightyourbills.net/r/l/updating-bugs_keeping.php


毛豆拦截记录

2012-12-06 12:07:52         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe        

Sandbox中运行         部分限制
2012-12-06 12:07:52         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe        

Sandbox中运行         部分限制
2012-12-06 12:07:55         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe        

Sandbox中运行         部分限制
2012-12-06 12:07:58         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\All Users\Application Data\REGSVR32.EXE-x.txt
2012-12-06 12:07:58         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\All Users\Application Data\RUNDLL32.EXE-x.txt
2012-12-06 12:07:58         C:\Program Files\Internet Explorer\IEXPLORE.EXE         Sandbox中运行

        部分限制
2012-12-06 12:07:59         C:\WINDOWS\system32\ctfmon.exe         Sandbox中运行         部分限制
2012-12-06 12:08:00         C:\Program Files\Internet Explorer\IEXPLORE.EXE         Sandbox中运行

        部分限制
2012-12-06 12:08:03         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1609
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKUS\S-1-5-21-789336058-1708537768-682003330-500

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKUS\S-1-5-21-789336058-1708537768-682003330-500

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet

Explorer\Recovery\Active\RecoveryStore.{84AD69A3-3F5A-11E2-A226-506313B49FD4}.dat
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKLM\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\EventMessageFile
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:03         C:\WINDOWS\system32\ctfmon.exe         修改注册表项         HKUS\S-1-5-21-

789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKUS\S-1-5-21-789336058-1708537768-682003330-500

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKUS\S-1-5-21-789336058-1708537768-682003330-500

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet

Explorer\Recovery\Active\{84AD69A4-3F5A-11E2-A226-506313B49FD4}.dat
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKUS\S-1-5-21-789336058-1708537768-682003330-500

\Software\Microsoft\Windows\CurrentVersion\Internet

Settings\Connections\DefaultConnectionSettings
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKUS\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA}\InprocServer32
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:03         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:04         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe        

Sandbox中运行         部分限制
2012-12-06 12:08:08         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:08:08         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:08:08         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\All Users\Application Data\IEXPLORE.EXE-x.txt
2012-12-06 12:08:08         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:08:08         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\All Users\Application Data\IEXPLORE.EXE-x.txt
2012-12-06 12:08:08         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:08:08         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:08         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:08:08         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:08         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:08         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:08         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:08         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:08         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:08         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:08         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:08         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:08         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet

Files\Content.IE5
2012-12-06 12:08:08         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:08         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:09         C:\Program Files\Internet Explorer\IEXPLORE.EXE         Sandbox中运行

        部分限制
2012-12-06 12:08:09         C:\WINDOWS\system32\ctfmon.exe         Sandbox中运行         部分限制
2012-12-06 12:08:10         C:\Program Files\Internet Explorer\IEXPLORE.EXE         Sandbox中运行

        部分限制
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet

Files\Content.IE5
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet

Files\Content.IE5
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:16         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe        

Sandbox中运行         部分限制
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet

Files\Content.IE5
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet

Files\Content.IE5
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:19         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:19         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:08:20         C:\Program Files\Internet Explorer\IEXPLORE.EXE         Sandbox中运行

        部分限制
2012-12-06 12:08:21         C:\WINDOWS\system32\ctfmon.exe         Sandbox中运行         部分限制
2012-12-06 12:08:22         C:\Program Files\Internet Explorer\IEXPLORE.EXE         Sandbox中运行

        部分限制
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet

Files\Content.IE5
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet

Files\Content.IE5
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:24         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:26         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe        

Sandbox中运行         部分限制
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet

Files\Content.IE5
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:30         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet

Files\Content.IE5
2012-12-06 12:08:31         C:\Program Files\Internet Explorer\IEXPLORE.EXE         Sandbox中运行

        部分限制
2012-12-06 12:08:31         C:\WINDOWS\system32\ctfmon.exe         Sandbox中运行         部分限制
2012-12-06 12:08:35         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:35         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:35         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:35         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:35         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:35         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:35         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet

Files\Content.IE5
2012-12-06 12:08:35         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:08:35         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:35         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:35         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:08:35         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet

Files\Content.IE5
2012-12-06 12:08:35         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:08:35         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:35         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKLM\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\EventMessageFile
2012-12-06 12:08:35         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:08:35         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:35         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:08:35         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\All Users\Application Data\RUNDLL32.EXE-x.txt
2012-12-06 12:08:35         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:08:37         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe        

Sandbox中运行         部分限制
2012-12-06 12:08:46         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\All Users\Application Data\RUNDLL32.EXE-x.txt
2012-12-06 12:08:46         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1609
2012-12-06 12:08:46         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:46         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:08:46         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:46         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKUS\S-1-5-21-789336058-1708537768-682003330-500

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2012-12-06 12:08:46         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:46         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKUS\S-1-5-21-789336058-1708537768-682003330-500

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2012-12-06 12:08:46         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet

Explorer\Recovery\Active\RecoveryStore.{8AEF95E3-3F5A-11E2-A226-506313B49FD4}.dat
2012-12-06 12:08:46         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKLM\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\EventMessageFile
2012-12-06 12:08:46         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:08:46         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKUS\S-1-5-21-789336058-1708537768-682003330-500

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe
2012-12-06 12:08:46         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:46         C:\WINDOWS\system32\ctfmon.exe         修改注册表项         HKUS\S-1-5-21-

789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe
2012-12-06 12:08:46         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:08:46         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:46         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKUS\S-1-5-21-789336058-1708537768-682003330-500

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2012-12-06 12:08:46         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:08:46         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKUS\S-1-5-21-789336058-1708537768-682003330-500

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2012-12-06 12:08:46         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet

Explorer\Recovery\Active\{8AEF95E4-3F5A-11E2-A226-506313B49FD4}.dat
2012-12-06 12:09:39         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:39         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:09:39         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKUS\S-1-5-21-789336058-1708537768-682003330-500

\Software\Microsoft\Windows\CurrentVersion\Internet

Settings\Connections\DefaultConnectionSettings
2012-12-06 12:09:39         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:09:39         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKUS\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA}\InprocServer32
2012-12-06 12:09:39         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:09:39         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:39         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:09:39         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:39         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:39         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:39         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:39         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:39         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:39         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:09:39         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKUS\S-1-5-21-789336058-1708537768-682003330-500

\Software\Microsoft\Windows\CurrentVersion\Internet

Settings\Connections\DefaultConnectionSettings
2012-12-06 12:09:39         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:39         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:39         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:09:39         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:48         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:48         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:09:48         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKLM\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\EventMessageFile
2012-12-06 12:09:48         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:48         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:48         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-06 12:09:48         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:48         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2012-12-06 12:09:48         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:48         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History
2012-12-06 12:09:48         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\All Users\Application Data\IEXPLORE.EXE-x.txt
2012-12-06 12:09:48         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet

Files\Content.IE5
2012-12-06 12:09:48         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\All Users\Application Data\IEXPLORE.EXE-x.txt
2012-12-06 12:09:48         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项        

HKUS\S-1-5-21-789336058-1708537768-682003330-500

\Software\Microsoft\Windows\CurrentVersion\Internet

Settings\Connections\DefaultConnectionSettings
2012-12-06 12:09:48         C:\Program Files\Internet Explorer\iexplore.exe         修改文件        

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2012-12-06 12:09:48         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:48         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:48         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:48         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2012-12-06 12:09:48         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改

文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
报告结束

yaoyunjia

过小a

真小读者

过微点
http://fireeye.ijinshan.com/anal ... ea79de5f5cf62d#full
经新毒霸云安全中心分析，该文件暂无风险！

xu3160668

不是有效的程序！

hddu

2012-12-06 12:48:33    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\rundll32.exe
文件路径:C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
触发规则:应用程序规则->rundll32设置->%windir%\system32\rundll32.exe->?:\Documents and Settings\*\*菜单\程序\启动\*


2012-12-06 12:48:37    修改注册表内容      操作:阻止
进程路径:C:\WINDOWS\system32\rundll32.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
注册表名称:1609
触发规则:应用程序规则->系统程序(二)->%windir%\system32\rundll32.exe->*


2012-12-06 12:48:38    修改注册表内容      操作:阻止
进程路径:C:\WINDOWS\system32\rundll32.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
注册表名称:1609
触发规则:应用程序规则->系统程序(二)->%windir%\system32\rundll32.exe->*


2012-12-06 12:48:39    修改注册表内容      操作:阻止
进程路径:C:\WINDOWS\system32\rundll32.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
注册表名称:1609
触发规则:应用程序规则->系统程序(二)->%windir%\system32\rundll32.exe->*


2012-12-06 12:48:40    修改注册表内容      操作:阻止
进程路径:C:\WINDOWS\system32\rundll32.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
注册表名称:1609
触发规则:应用程序规则->系统程序(二)->%windir%\system32\rundll32.exe->*


2012-12-06 12:48:40    创建注册表值      操作:阻止并结束进程
进程路径:C:\WINDOWS\system32\rundll32.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
注册表名称:2500
触发规则:所有程序规则->IE浏览器设置->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones*


2012-12-06 12:48:40    创建注册表值      操作:阻止并结束进程
进程路径:C:\WINDOWS\system32\rundll32.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
注册表名称:2500
触发规则:所有程序规则->IE浏览器设置->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones*

firefox3

xu3160668 发表于 2012-12-6 12:39
不是有效的程序！

你可以进毒网试一下很爽的
记得携带Fan{过}{滤}Qiang工具，jre-7u5-windows-i586.exe哦
运行不了，可以看看这里 http://bbs.kafan.cn/thread-1422889-2-1.html  11楼

xu3160668

firefox3 发表于 2012-12-6 12:48
你可以进毒网试一下很爽的
记得携带Fan{过}{滤}Qiang工具，jre-7u5-windows-i586.exe哦
运 ...

怕...

firefox3

xu3160668 发表于 2012-12-6 12:49
怕...

要相信最新版的DG我看好你哦

xu3160668

firefox3 发表于 2012-12-6 12:50
要相信最新版的DG我看好你哦

刚换了   TP版的和我的QQ2013冲突....

CIA

费尔        直接启发了