YZF.exe

sxchenn

mse杀之

蓝天二号

sanhu35 发表于 2012-2-28 09:36
我知道微点杀毒，但弹窗还是第一次见。

微点杀毒功能之间有冲突，，目前正在解决中。。。。

liulangzhecgr

ADSLgg 发表于 2012-2-28 08:58
你的规则是哪个的？还是自己创建的？

我自己做的全局询问规则 ！

hx1997

Write to file [C:\Documents and Settings\Administrator\桌面\YZF.exe   -> \\.\PIPE\wkssvc]

Write to file [C:\Documents and Settings\Administrator\桌面\YZF.exe   -> \\.\PIPE\lsarpc]

Write to file [C:\Documents and Settings\Administrator\桌面\YZF.exe   -> \\.\PIPE\lsarpc]

Adjust Privileges [C:\Documents and Settings\Administrator\桌面\YZF.exe  ]

Adjust Privileges [C:\Documents and Settings\Administrator\桌面\YZF.exe  ]

Execute [C:\Documents and Settings\Administrator\桌面\YZF.exe   (1988) -> C:\WINDOWS\system32\verclsid.exe (0)]
Command-line: /S /C {92B1E825-2EEF-44E5-8748-7639C7C9935F} /I {00000000-0000-0000-C000-000000000046} /X 0x401

Execute [C:\Documents and Settings\Administrator\桌面\YZF.exe   (1988) -> C:\Documents and Settings\Administrator\Application Data\Microsoft.exe (584)]
Command-line: "C:\Documents and Settings\Administrator\Application Data\Microsoft.exe"

Process C:\Documents and Settings\Administrator\桌面\YZF.exe   has terminated.

Write to file [C:\Documents and Settings\Administrator\Application Data\Microsoft.exe -> C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat]

Write to file [C:\Documents and Settings\Administrator\Application Data\Microsoft.exe -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat]

Write to file [C:\Documents and Settings\Administrator\Application Data\Microsoft.exe -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat]

Write to file [C:\Documents and Settings\Administrator\Application Data\Microsoft.exe -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Cookies\index.dat]

Write to file [C:\Documents and Settings\Administrator\Application Data\Microsoft.exe -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Cookies\index.dat]

Write to file [C:\Documents and Settings\Administrator\Application Data\Microsoft.exe -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\History\History.IE5\index.dat]

Write to file [C:\Documents and Settings\Administrator\Application Data\Microsoft.exe -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\History\History.IE5\index.dat]

Write to file [C:\Documents and Settings\Administrator\Application Data\Microsoft.exe -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat]

Write to file [C:\Documents and Settings\Administrator\Application Data\Microsoft.exe -> \\.\PIPE\lsarpc]

Write to file [C:\Documents and Settings\Administrator\Application Data\Microsoft.exe -> \\.\PIPE\lsarpc]

Write to file [C:\Documents and Settings\Administrator\Application Data\Microsoft.exe -> \\.\PIPE\lsarpc]

Write to file [C:\Documents and Settings\Administrator\Application Data\Microsoft.exe -> \\.\PIPE\lsarpc]

Write to file [C:\Documents and Settings\Administrator\Application Data\Microsoft.exe -> \\.\PIPE\lsarpc]

Write to file [C:\Documents and Settings\Administrator\Application Data\Microsoft.exe -> \\.\PIPE\lsarpc]

Write to file [C:\Documents and Settings\Administrator\Application Data\Microsoft.exe -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\CE5PLIMJ\xyus[1].gif]

Write to file [C:\Documents and Settings\Administrator\Application Data\Microsoft.exe -> C:\Documents and Settings\Administrator\Application Data\617211769.dll]

Process C:\Documents and Settings\Administrator\Application Data\Microsoft.exe has terminated.

hddu

2012-02-29 17:02:46    创建文件      操作:允许
进程路径:F:\virus\YZF\YZF.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Sensaura.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2012-02-29 17:02:46    创建文件      操作:允许
进程路径:F:\virus\YZF\YZF.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Sensaura.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2012-02-29 17:02:51    创建注册表值      操作:允许
进程路径:F:\virus\YZF\YZF.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
注册表名称:Sensaura
触发规则:所有程序规则->自动运行->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*


2012-02-29 17:02:52    创建注册表值      操作:阻止
进程路径:F:\virus\YZF\YZF.exe
注册表路径:HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
注册表名称:[Key]
触发规则:所有程序规则->自动运行->*\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run*


2012-02-29 17:02:52    创建注册表值      操作:阻止
进程路径:F:\virus\YZF\YZF.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
注册表名称:[Key]
触发规则:所有程序规则->自动运行->*\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run*


2012-02-29 17:02:57    创建注册表值      操作:允许
进程路径:F:\virus\YZF\YZF.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
注册表名称:Sensaura
触发规则:所有程序规则->网络保护->HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List


2012-02-29 17:03:00    创建注册表值      操作:允许
进程路径:F:\virus\YZF\YZF.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
注册表名称:Sensaura
触发规则:所有程序规则->网络保护->HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List


2012-02-29 17:03:02    创建注册表值      操作:允许
进程路径:F:\virus\YZF\YZF.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
注册表名称:Sensaura
触发规则:所有程序规则->网络保护->HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List


2012-02-29 17:03:04    创建注册表值      操作:允许
进程路径:F:\virus\YZF\YZF.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
注册表名称:Sensaura
触发规则:所有程序规则->自动运行->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*


2012-02-29 17:03:04    创建注册表值      操作:阻止并结束进程
进程路径:F:\virus\YZF\YZF.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
注册表名称:Shell
触发规则:应用程序规则->WinLogon设置->?:\*->HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon


2012-02-29 17:03:04    创建注册表值      操作:阻止
进程路径:F:\virus\YZF\YZF.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
注册表名称:Sensaura
触发规则:所有程序规则->自动运行->*\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run*