收到一个病毒邮件，诸位检测下。

zmzcy

金山 kill

倾枫锝渔♂

seehere

毒霸报了

hx1997

DefenseWall log file

10.28.2011  00:09:33，模块 D:\WINDOWS\system32\svchost.exe， Attempt to set value AppData within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

10.28.2011  00:09:33，模块 D:\WINDOWS\system32\svchost.exe， 5:Attempt to open protected file C:\AUTOEXEC.BAT (资源隔离)

10.28.2011  00:09:33，模块 D:\WINDOWS\system32\svchost.exe， Attempt to set value AppData within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

10.28.2011  00:09:33，模块 D:\WINDOWS\system32\svchost.exe， Attempt to set value ProxyEnable within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ (注册表)

10.28.2011  00:09:33，模块 D:\WINDOWS\system32\svchost.exe， Attempt to set value SavedLegacySettings within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\ (注册表)

10.28.2011  00:09:33，模块 D:\WINDOWS\system32\svchost.exe， 5:Attempt to open protected file C:\AUTOEXEC.BAT (资源隔离)

10.28.2011  00:08:58，模块 D:\WINDOWS\system32\svchost.exe， Attempt to access protected storage (资源隔离)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to access protected storage (资源隔离)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to access protected storage (资源隔离)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to access protected storage (资源隔离)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to access protected storage (资源隔离)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to access protected storage (资源隔离)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to access protected storage (资源隔离)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to set value Local AppData within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to set value Personal within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\WINDOWS\system32\csrss.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\WINDOWS\system32\winlogon.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\WINDOWS\system32\services.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\WINDOWS\system32\lsass.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\WINDOWS\system32\svchost.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\WINDOWS\system32\svchost.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\WINDOWS\system32\svchost.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\WINDOWS\system32\svchost.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\WINDOWS\system32\svchost.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\WINDOWS\system32\spoolsv.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\WINDOWS\system32\defensewall_serv.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process E:\Program Files\ESET\ekrn.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\WINDOWS\system32\IPROSetMonitor.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to read memory of the process D:\WINDOWS\system32\alg.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\WINDOWS\explorer.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process E:\Program Files\ESET\egui.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\Program Files\DefenseWall\defensewall.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\WINDOWS\system32\ctfmon.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open process D:\WINDOWS\system32\wbem\wmiprvse.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to read memory of the process D:\Program Files\Opera\opera.exe (进程)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open protected key HKCU\Software\Yahoo\Pager\ (资源隔离)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to open protected key HKCU\Software\Yahoo\Pager\ (资源隔离)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， 5:Attempt to open protected file C:\AUTOEXEC.BAT (资源隔离)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to set value AppData within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， 10:Attempt to open protected file D:\Program Files\Opera\ (资源隔离)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， 10:Attempt to open protected file D:\Program Files\Opera\ (资源隔离)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to set value Cache within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to set value Cookies within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to set value History within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， 10:Attempt to open protected file D:\Documents and Settings\Administrator\Cookies\ (资源隔离)

10.28.2011  00:08:28，模块 D:\WINDOWS\system32\svchost.exe， Attempt to set value Common AppData within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

10.28.2011  00:08:20，模块 D:\WINDOWS\system32\svchost.exe， Attempt to set value AppData within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

10.28.2011  00:08:20，模块 D:\WINDOWS\system32\svchost.exe， Attempt to create new key HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ (注册表)

10.28.2011  00:08:20，模块 D:\WINDOWS\system32\svchost.exe， Attempt to create new key HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ (注册表)

10.28.2011  00:08:20，模块 D:\WINDOWS\system32\svchost.exe， Attempt to set value ESET within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ (注册表)

10.28.2011  00:08:20，模块 D:\WINDOWS\system32\svchost.exe， 1:Process is running untrusted now (进程)

10.28.2011  00:08:17，模块 D:\Documents and Settings\Administrator\桌面\Invoice_copy.exe， 1:Process is running untrusted now (进程)

夜ㄝ殇

liulangzhecgr

小动作可不少啊！

xljbxx

nis2012  kill

lotnhiro

KIS kill

qq541471559

2011-10-14 20:05:08    读文件    允许
进程: c:\documents and settings\administrator\桌面\invoice_copy.exe
目标: C:\WINDOWS\system32\mdhook.dll
规则: [应用程序]* -> [文件组]运行请求

2011-10-14 20:05:11    创建新进程    阻止
进程: c:\documents and settings\administrator\桌面\invoice_copy.exe
目标: c:\windows\system32\svchost.exe
命令行: svchost.exe
规则: [应用程序]* -> [子应用程序]c:\windows\*

港岛妹妹

FortiClient Endpoint Security启发 virus=W32/Yakes.B!