c9b3e2c655dad85fc0dd0554a4a38915

jayavira

1. 2013-6-3 16:30:37,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,53,Allowed ;启动一个应用程序 (D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe)
   
2. 2013-6-3 16:30:39,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,36,Allowed ;注入DLL (c9b3e2c655dad85fc0dd0554a4a38915.exe(pid=3032))
   
3. 2013-6-3 16:30:44,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,26,Allowed ;改变关键注册表项目 (HKCU\Sandbox_Administrator_DefaultBox\user\current\Software\Classes\CLSID\{A755C8C9-0787-F946-B3D0-99891294A531}\0BC402F2\CS1)
   
4. 2013-6-3 16:30:46,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,50,Allowed ;通过DNS解析服务访问网络
   
5. 2013-6-3 16:30:48,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,48,Allowed ;传出的网络访问-出站
   
6. 2013-6-3 16:30:51,C:\Program Files\Sandboxie\SbieSvc.exe,53,Allowed ;启动一个应用程序 (C:\Program Files\Sandboxie\SbieSvc.exe)
   
7. 2013-6-3 16:30:52,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,40,Allowed ;打开其它进程并获取修改权限 (EXPLORER.EXE(pid=864))
   
8. 2013-6-3 16:30:55,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,29,Allowed ;访问其它进程内存 (SandboxieRpcSs.exe(pid=8856))
   
9. 2013-6-3 16:30:58,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,29,Allowed ;访问其它进程内存 (SandboxieRpcSs.exe(pid=8856))
   
10. 2013-6-3 16:31:03,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,47,Allowed ;创建或修改NTFS数据流文件 (E:\Sandbox\Administrator\DefaultBox\drive\D\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe:Zone.Identifier)
    
11. 2013-6-3 16:31:05,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,29,Allowed ;访问其它进程内存 (SandboxieRpcSs.exe(pid=8856))
    
12. 2013-6-3 16:31:06,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,29,Allowed ;访问其它进程内存 (SandboxieRpcSs.exe(pid=8856))
    
13. 2013-6-3 16:31:08,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,29,Allowed ;访问其它进程内存 (SandboxieRpcSs.exe(pid=8856))
    
14. 2013-6-3 16:31:08,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,29,Allowed ;访问其它进程内存 (SandboxieDcomLaunch.exe(pid=1328))
    
15. 2013-6-3 16:31:09,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,29,Allowed ;访问其它进程内存 (SandboxieDcomLaunch.exe(pid=1328))
    
16. 2013-6-3 16:31:10,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,29,Allowed ;访问其它进程内存 (SandboxieDcomLaunch.exe(pid=1328))
    
17. 2013-6-3 16:31:11,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,29,Allowed ;访问其它进程内存 (SandboxieDcomLaunch.exe(pid=1328))
    
18. 2013-6-3 16:31:12,D:\下载文件夹\tmp\virii\c9b3e2c655dad85fc0dd0554a4a38915.exe,29,Allowed ;访问其它进程内存 (SandboxieDcomLaunch.exe(pid=1328))

复制代码

狴犴睚眦

过FS扫描

费尔动态防御杀

猪头无双

BD无视

llcy

毒霸火眼提示病毒

猪头无双

擦，写错地方了

蓝天二号

费尔的报毒速度居然超数字。。。

消停

删除自身所在的文件夹！

XMonster

呵呵,以前俺推荐的SSF不错吧.

darkwolf_99

不是在x64系统里运行的日志吧

蓝核

狴犴睚眦 发表于 2013-6-3 16:39
过FS扫描

费尔动态防御杀

神辅助……