1x

post8

http://2010101122267wd61uzfwz.1uzfwz67wd.dlxiazai.net/_dl/waigua3.0.exe

avira kill -- TR/ATRAPS.Gen2

wangyuli100

to avert  lab(mcafee)

XMonster

to  360

langzi2009

伪装压缩包的应用程序 百锐未启发到风险

XE-cj

2010-10-1 12:57:00    创建新进程    允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\xe-cj\my documents\waigua3.0.exe
命令行: "C:\Documents and Settings\XE-CJ\My Documents\waigua3.0.exe"
规则: [应用程序]c:\windows\explorer.exe

2010-10-1 12:57:05    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\waigua3.0.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\~4E.tmp
规则: [文件]*

2010-10-1 12:57:06    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\waigua3.0.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\~4E.bat
规则: [文件组]临时目录 -> [文件]c:\documents and settings\xe-cj\local settings\temp; *.bat

2010-10-1 12:57:08    设置文件隐藏属性    允许
进程: c:\documents and settings\xe-cj\my documents\waigua3.0.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\~4E.bat
规则: [文件组]临时目录 -> [文件]c:\documents and settings\xe-cj\local settings\temp; *.bat

2010-10-1 12:57:10    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\waigua3.0.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Application Data\In.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2010-10-1 12:57:12    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\waigua3.0.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Application Data\install_a.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2010-10-1 12:57:15    创建新进程    阻止
进程: c:\documents and settings\xe-cj\my documents\waigua3.0.exe
目标: c:\windows\system32\cmd.exe
命令行: cmd.exe /c C:\DOCUME~1\XE-CJ\LOCALS~1\Temp\~4E.bat "C:\Documents and Settings\XE-CJ\My Documents\waigua3.0.exe"
规则: [应用程序]*

2010-10-1 12:57:16    删除文件    阻止
进程: c:\documents and settings\xe-cj\my documents\waigua3.0.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\~4E.bat
规则: [文件组]临时目录 -> [文件]c:\documents and settings\xe-cj\local settings\temp; *.bat

2010-10-1 12:57:18    删除文件    阻止
进程: c:\documents and settings\xe-cj\my documents\waigua3.0.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Application Data\In.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2010-10-1 12:57:19    删除文件    阻止
进程: c:\documents and settings\xe-cj\my documents\waigua3.0.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Application Data\install_a.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

zyx9

comodo5.0 kill
Backdoor.Win32.PcClient.~dy002

kksak3

毒霸毫无压力的杀掉。

njjsxy

jayavira

to eset

http://samples.nod32.com.sg/inde ... a48bc247723e87d2277

fatezero

KIS
Trojan-Downloader.Win32.Agent.eqdj