病毒一个，只有3%的杀软能发现。

hdzhonghai

刚刚下载，金山提示是病毒了

XMonster

SEP-Bloodhound.Sonar.9

gwsbhqt

360SD 3.0轻松2KILL，

qianyuqx

360 kill

鲔鱼

SYMANTEC 上报

jialin4567

MSE 完全没反应

hddu

2011-08-21 18:40:07    运行应用程序      操作:允许
进程路径:F:\virus\Virus\Virus\product package design\setup.exe
文件路径:F:\virus\Virus\Virus\product package design\setup.exe
触发规则:应用程序规则->自动创建规则->?:\*


2011-08-21 18:40:09    运行应用程序      操作:允许
进程路径:F:\virus\Virus\Virus\product package design\setup.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
命令行:1
触发规则:所有程序规则->其它程序设置->*\Temp\*


2011-08-21 18:40:20    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
命令行:1
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-08-21 18:40:51    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-08-21 18:40:53    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\Microsoft\*.exe


2011-08-21 18:40:53    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\6A3E.FE1
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-08-21 18:40:53    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\6A3E.FE1
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-08-21 18:40:53    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\6A3E.FE1
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-08-21 18:40:55    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
命令行:startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-08-21 18:41:08    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
命令行:startC:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\csrss.exe%C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-08-21 18:41:17    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns4.exe
命令行:/I
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-08-21 18:41:20    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\13137.bat"
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe


2011-08-21 18:41:31    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns4.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns4.exe
命令行:/I
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-08-21 18:41:33    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns4.exe
文件路径:C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Application Policy Service
触发规则:所有程序规则->WINDOWS默认目录设置->%windir%\system32\config\*


2011-08-21 18:41:33    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns4.exe
文件路径:C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Application Policy Service
触发规则:所有程序规则->WINDOWS默认目录设置->%windir%\system32\config\*


2011-08-21 18:41:35    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\C.exe
命令行:check
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-08-21 18:41:46    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
命令行:startC:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\csrss.exe%C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-08-21 18:41:50    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-08-21 18:41:53    修改注册表内容      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
注册表名称:Load
更改后:C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\csrss.exe
触发规则:所有程序规则->自动运行->*\Software\Microsoft\Windows nt\Currentversion\Windows


2011-08-21 18:41:57    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
命令行:startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-08-21 18:44:00    删除文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
文件路径:C:\Documents and Settings\Administrator\My Documents\My Pictures
触发规则:应用程序规则->%ProgramFiles%文件设置->%ProgramFiles%\*.exe->?:\Documents and Settings\*\My Documents\*


2011-08-21 18:44:00    删除文件      操作:阻止并结束进程
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\管理工具
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\管理工具


2011-08-21 18:44:12    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
命令行:startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-08-21 18:44:34    删除文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
文件路径:C:\Documents and Settings\Administrator\My Documents\My Pictures
触发规则:应用程序规则->%ProgramFiles%文件设置->%ProgramFiles%\*.exe->?:\Documents and Settings\*\My Documents\*


2011-08-21 18:44:34    删除文件      操作:阻止并结束进程
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\管理工具
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\管理工具


2011-08-21 18:44:43    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
命令行:startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-08-21 18:46:42    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
命令行:startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-08-21 18:47:03    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\D.exe
命令行:check
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-08-21 18:47:13    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\dwm.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-08-21 18:47:16    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns16.exe
命令行:startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe

陌上~烟雨遥

金山拦截

papaw

强悍的毒

Kevin_Memo

COMODO沙盘果断报……（虚拟机测试木有本地病毒库……）