流氓样本一个

zhousulin5

2011-6-22 16:54:52    读文件    允许
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: C:\Documents and Settings\cwb\Local Settings\Temp\is-2N2FC.tmp\1.tmp
规则: [应用程序]c:\documents and settings\cwb\local settings\temp\*.tmp\1.tmp -> [文件]c:\documents and settings\cwb\local settings\temp\*.tmp; 1.tmp

2011-6-22 16:54:52    向其他进程发送消息    阻止
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: d:\download\1\1\1.exe
消息: 0x0496
规则: [应用程序]* -> [目标应用程序]*

2011-6-22 16:54:52    创建文件夹    允许
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: C:\Documents and Settings\cwb\Local Settings\Temp\is-CUJ20.tmp
规则: [应用程序]c:\documents and settings\cwb\local settings\temp\* -> [文件]c:\documents and settings\cwb\local settings\temp\*

2011-6-22 16:54:52    创建文件夹    允许
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: C:\Documents and Settings\cwb\Local Settings\Temp\is-CUJ20.tmp\_isetup
规则: [应用程序]c:\documents and settings\cwb\local settings\temp\* -> [文件]c:\documents and settings\cwb\local settings\temp\*

2011-6-22 16:54:52    修改文件    阻止
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: \Device\NamedPipe\lsarpc
规则: [应用程序]c:\documents and settings\cwb\local settings\temp\* -> [文件]\device\namedpipe\lsarpc

2011-6-22 16:54:52    修改文件    阻止
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: \Device\NamedPipe\lsarpc
规则: [应用程序]c:\documents and settings\cwb\local settings\temp\* -> [文件]\device\namedpipe\lsarpc

2011-6-22 16:54:52    修改文件    阻止
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: \Device\NamedPipe\lsarpc
规则: [应用程序]c:\documents and settings\cwb\local settings\temp\* -> [文件]\device\namedpipe\lsarpc

2011-6-22 16:54:52    修改文件    阻止
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: \Device\NamedPipe\lsarpc
规则: [应用程序]c:\documents and settings\cwb\local settings\temp\* -> [文件]\device\namedpipe\lsarpc

2011-6-22 16:54:54    创建文件    允许
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: C:\Program Files\prgenerate\unins001.dat
规则: [应用程序组]本地磁盘分区 -> [文件]?:\program files\*

2011-6-22 16:54:54    修改文件    阻止
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: \Device\NamedPipe\SfcApi
规则: [应用程序]c:\documents and settings\cwb\local settings\temp\*.tmp\1.tmp -> [文件]\device\namedpipe\sfcapi

2011-6-22 16:54:54    修改文件    阻止
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: \Device\NamedPipe\SfcApi
规则: [应用程序]c:\documents and settings\cwb\local settings\temp\*.tmp\1.tmp -> [文件]\device\namedpipe\sfcapi

2011-6-22 16:54:54    读文件    允许
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: C:\Documents and Settings\cwb\Local Settings\Temp\is-2N2FC.tmp\1.tmp
规则: [应用程序]c:\documents and settings\cwb\local settings\temp\*.tmp\1.tmp -> [文件]c:\documents and settings\cwb\local settings\temp\*.tmp; 1.tmp

2011-6-22 16:54:58    创建文件    允许
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: C:\Program Files\prgenerate\unins001.exe
规则: [应用程序组]本地磁盘分区 -> [文件]?:\program files\*

2011-6-22 16:54:58    修改文件    阻止
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: \Device\NamedPipe\SfcApi
规则: [应用程序]c:\documents and settings\cwb\local settings\temp\*.tmp\1.tmp -> [文件]\device\namedpipe\sfcapi

2011-6-22 16:55:02    创建文件    允许
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: C:\Program Files\prgenerate\InstallDll.dll
规则: [应用程序组]本地磁盘分区 -> [文件]?:\program files\*

2011-6-22 16:55:02    修改文件    阻止
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: \Device\NamedPipe\SfcApi
规则: [应用程序]c:\documents and settings\cwb\local settings\temp\*.tmp\1.tmp -> [文件]\device\namedpipe\sfcapi

2011-6-22 16:55:02    修改文件    阻止
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: \Device\NamedPipe\SfcApi
规则: [应用程序]c:\documents and settings\cwb\local settings\temp\*.tmp\1.tmp -> [文件]\device\namedpipe\sfcapi

2011-6-22 16:55:02    创建文件    阻止并结束进程
进程: c:\documents and settings\cwb\local settings\temp\is-2n2fc.tmp\1.tmp
目标: C:\WINDOWS\vistaw7\KAV_97_10.exe
规则: [应用程序组]本地磁盘分区 -> [文件组]系统执行文件

AIRSHAPE

瑞星 秒杀

tokthoo

这就是梅XX说的用病毒传播方式来推广自己？

tokthoo

运行后调用rundll32.dll
windows文件夹产生vistaw7文件夹。里面有KAV下载程序合一个不懂什么东西，但是是淘宝的ICON。
程序连接至
61.158.249.13
下载

过程中360卫士毫无反应