病毒一个，只有3%的杀软能发现。

hddu

2011-09-01 20:24:55    运行应用程序      操作:允许
进程路径:F:\virus\Virus\Virus\product package design\setup.exe
文件路径:F:\virus\Virus\Virus\product package design\setup.exe
触发规则:应用程序规则->自动创建规则->?:\*


2011-09-01 20:24:58    运行应用程序      操作:允许
进程路径:F:\virus\Virus\Virus\product package design\setup.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
命令行:1
触发规则:所有程序规则->其它程序设置->*\Temp\*


2011-09-01 20:25:11    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
命令行:1
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-09-01 20:25:38    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-09-01 20:25:40    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\Microsoft\*.exe

2011-09-01 20:25:40    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\6A3E.FE1
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-09-01 20:25:40    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\6A3E.FE1
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-09-01 20:25:40    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\6A3E.FE1
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-09-01 20:25:42    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
命令行:startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-09-01 20:26:30    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\D.exe
命令行:check
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-09-01 20:26:42    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\dwm.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-09-01 20:26:46    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
命令行:startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-09-01 20:26:53    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\dwm.exe
触发规则:应用程序规则->自动创建规则->?:\*


2011-09-01 20:27:04    创建注册表值      操作:使用任务隔离区操作
进程路径:C:\Documents and Settings\Administrator\Application Data\dwm.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
注册表名称:Shell
触发规则:应用程序规则->WinLogon设置->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon*


2011-09-01 20:27:05    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\dwm.exe
触发规则:应用程序规则->自动创建规则->?:\*


2011-09-01 20:27:10    创建注册表值      操作:使用任务隔离区操作
进程路径:C:\Documents and Settings\Administrator\Application Data\dwm.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
注册表名称:Shell
触发规则:应用程序规则->WinLogon设置->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon*


2011-09-01 20:27:11    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
命令行:startC:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\csrss.exe%C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-09-01 20:27:32    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\E.exe
命令行:check
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-09-01 20:27:38    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns4.exe
命令行:/I
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-09-01 20:27:41    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\24621.bat"
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe


2011-09-01 20:27:48    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
命令行:startC:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\csrss.exe%C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-09-01 20:27:56    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-09-01 20:27:59    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns4.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns4.exe
命令行:/I
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-09-01 20:28:01    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns4.exe
文件路径:C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Application Policy Service
触发规则:所有程序规则->WINDOWS默认目录设置->%windir%\system32\config\*


2011-09-01 20:28:01    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns4.exe
文件路径:C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Application Policy Service
触发规则:所有程序规则->WINDOWS默认目录设置->%windir%\system32\config\*

2011-09-01 20:28:01    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe

2011-09-01 20:28:03    修改注册表内容      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
注册表名称:Load
更改后:C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\csrss.exe
触发规则:所有程序规则->自动运行->*\Software\Microsoft\Windows nt\Currentversion\Windows

2011-09-01 20:28:48    删除文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
文件路径:C:\Documents and Settings\Administrator\My Documents\My Pictures
触发规则:应用程序规则->%ProgramFiles%文件设置->%ProgramFiles%\*.exe->?:\Documents and Settings\*\My Documents\*

2011-09-01 20:28:48    删除文件      操作:阻止并结束进程
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\管理工具
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\管理工具

2011-09-01 20:29:30    删除文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
文件路径:C:\Documents and Settings\Administrator\My Documents\My Pictures
触发规则:应用程序规则->%ProgramFiles%文件设置->%ProgramFiles%\*.exe->?:\Documents and Settings\*\My Documents\*

2011-09-01 20:29:31    删除文件      操作:阻止并结束进程
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\管理工具
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\管理工具

dalianjhc1986

上报eset

liulangzhecgr

hddu 发表于 2011-8-21 18:50
2011-08-21 18:40:07    运行应用程序      操作:允许
进程路径:F:\virus\Virus\Virus\product package de ...

这个不报毒的话 ... ...该扔？！

c287432622

liulangzhecgr 发表于 2011-9-2 05:57
这个不报毒的话 ... ...该扔？！

确实。。

不规矩动作好多。。。

liulangzhecgr

c287432622 发表于 2011-9-5 21:25
确实。。

不规矩动作好多。。。

看见 样本生成的文件名了吗?!都是起系统文件名啊!

thelordisone

MSE果断杀~