收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 病毒样本 分享&分析区 › 网购木马（二 三）
12345下一页
返回列表 发新帖
楼主: guidanba
 收起左侧

[病毒样本] 网购木马（二 三）

  [复制链接]
Nocria
发表于 2012-4-8 23:15:08 | 显示全部楼层

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

留侯
发表于 2012-4-8 23:16:18 | 显示全部楼层
大蜘蛛Clean，文件加了壳：
360BackupUI.dll - packed by FLY-CODE
已上报！
回复

举报

hx1997
发表于 2012-4-8 23:22:42 | 显示全部楼层
DefenseWall log file

04.08.2012  23:21:14，模块 C:\WINDOWS\system32\calc.exe， Attempt to set value Directory within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\ (注册表)

04.08.2012  23:21:14，模块 C:\WINDOWS\system32\calc.exe， Attempt to set value Cookies within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

04.08.2012  23:21:14，模块 C:\WINDOWS\system32\calc.exe， Attempt to set value History within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

04.08.2012  23:21:15，模块 C:\WINDOWS\system32\calc.exe， 10:Attempt to open protected file C:\Documents and Settings\HX\Cookies\ (资源隔离)

04.08.2012  23:21:15，模块 C:\WINDOWS\system32\calc.exe， 10:Attempt to open protected file C:\Documents and Settings\HX\Cookies\ (资源隔离)

04.08.2012  23:21:15，模块 C:\WINDOWS\system32\calc.exe， 8:Attempt to open protected file C:\Documents and Settings\HX\Cookies\index.dat (资源隔离)

04.08.2012  23:21:14，模块 C:\WINDOWS\system32\calc.exe， Attempt to set value Cache within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value Description within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1b55460a-c650-4bb7-ad7a-63a629dc7d3a}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value ItemData within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1b55460a-c650-4bb7-ad7a-63a629dc7d3a}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value SaferFlags within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1b55460a-c650-4bb7-ad7a-63a629dc7d3a}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value LastModified within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{4314e86b-b31e-4da7-96d7-1cd29b762e9d}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value Description within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{4314e86b-b31e-4da7-96d7-1cd29b762e9d}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value ItemData within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{4314e86b-b31e-4da7-96d7-1cd29b762e9d}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value SaferFlags within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{4314e86b-b31e-4da7-96d7-1cd29b762e9d}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value LastModified within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{ae7f3361-2633-4b6b-839c-276bb5038de3}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value Description within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{ae7f3361-2633-4b6b-839c-276bb5038de3}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value ItemData within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{ae7f3361-2633-4b6b-839c-276bb5038de3}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value SaferFlags within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{ae7f3361-2633-4b6b-839c-276bb5038de3}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value LastModified within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{b0826656-dcb6-494f-884c-f0134a30d9ac}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value Description within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{b0826656-dcb6-494f-884c-f0134a30d9ac}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value ItemData within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{b0826656-dcb6-494f-884c-f0134a30d9ac}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value SaferFlags within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{b0826656-dcb6-494f-884c-f0134a30d9ac}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value LastModified within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{d7df96ae-4176-4f8b-a5ae-12da83f4ded3}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value Description within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{d7df96ae-4176-4f8b-a5ae-12da83f4ded3}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value ItemData within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{d7df96ae-4176-4f8b-a5ae-12da83f4ded3}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value SaferFlags within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{d7df96ae-4176-4f8b-a5ae-12da83f4ded3}\ (注册表)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value TransparentEnabled within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\ (注册表)

04.08.2012  23:21:09，模块 C:\WINDOWS\system32\calc.exe， 1:Process is running untrusted now (进程)

04.08.2012  23:21:09，模块 C:\WINDOWS\system32\calc.exe， 1:Process is running untrusted now (进程)

04.08.2012  23:21:09，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value LastModified within the key HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1b55460a-c650-4bb7-ad7a-63a629dc7d3a}\ (注册表)

04.08.2012  23:21:06，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to set value ExpressPrint within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ (注册表)

04.08.2012  23:21:06，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to overwrite file (overwrite_if) C:\Program Files\a.\synec.txt (文件 )

04.08.2012  23:21:06，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to overwrite file (overwrite_if) C:\Program Files\a\synec.txt (文件 )

04.08.2012  23:21:06，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to overwrite file (overwrite_if) C:\Program Files\a\synec.txt (文件 )

04.08.2012  23:21:06，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to overwrite file (overwrite_if) C:\Program Files\a\synec.txt (文件 )

04.08.2012  23:21:06，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to query kernel module list (系统)

04.08.2012  23:21:06，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to query kernel module list (系统)

04.08.2012  23:21:06，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to query kernel module list (系统)

04.08.2012  23:21:06，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to query kernel module list (系统)

04.08.2012  23:21:06，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to query kernel module list (系统)

04.08.2012  23:21:06，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to query kernel module list (系统)

04.08.2012  23:21:06，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to query kernel module list (系统)

04.08.2012  23:21:06，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to query kernel module list (系统)

04.08.2012  23:21:06，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to query kernel module list (系统)

04.08.2012  23:21:06，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Attempt to query kernel module list (系统)

04.08.2012  23:21:05，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， Loading untrusted/untrusted created module C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupUI.dll. Process is untrusted now. (进程)

04.08.2012  23:21:05，模块 C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe， 2:Process is running untrusted now (进程)
回复

举报

hx1997
发表于 2012-4-8 23:27:09 | 显示全部楼层
2012-04-08 23:25:53    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
注册表名称:ExpressPrint
触发规则:所有程序规则->015_×¢Òâx->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*


2012-04-08 23:25:59    创建注册表值      操作:阻止
进程路径:C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1b55460a-c650-4bb7-ad7a-63a629dc7d3a}
注册表名称:[Key]
触发规则:所有程序规则->010_ÐÐΪ·ÀÓùx->HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\*


2012-04-08 23:26:11    修改其它进程内存      操作:阻止
进程路径:C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe
目标进程:C:\WINDOWS\system32\calc.exe
触发规则:所有程序规则->085_ÐÐΪ·ÀÓù-·ÀÖ¹×¢ÈëϵͳÎļþx->%windir%\*.EXE

回复

举报

IllusionWing
发表于 2012-4-8 23:27:29 | 显示全部楼层
UGuard 7 扫描日志
扫描在 1 秒 内结束，扫描对象共计 1 个。


K:\IDMDown\Compressed\360BackupUI.zip>>360BackupUI.dll -> Bright.SuspiciousModel

共计 1 个威胁，日志结束。
回复

举报

bbs2811125
发表于 2012-4-8 23:28:21 | 显示全部楼层
IllusionWing 发表于 2012-4-8 23:27
UGuard 7 扫描日志
扫描在 1 秒 内结束，扫描对象共计 1 个。

最近是不是针对这些病毒弄了个分类模型？
回复

举报

IllusionWing
发表于 2012-4-8 23:31:41 | 显示全部楼层
bbs2811125 发表于 2012-4-8 23:28
最近是不是针对这些病毒弄了个分类模型？

上一次引擎更新时间去年九月初
回复

举报

hx1997
发表于 2012-4-8 23:32:04 | 显示全部楼层
4/8/2012 11:31:25 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify state of another application        C:\WINDOWS\system32\calc.exe        blocked        018.防止注入系统进程       
4/8/2012 11:31:25 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\TransparentEnabled        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:25 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{d7df96ae-4176-4f8b-a5ae-12da83f4ded3}\SaferFlags        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:25 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{d7df96ae-4176-4f8b-a5ae-12da83f4ded3}\ItemData        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:25 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{d7df96ae-4176-4f8b-a5ae-12da83f4ded3}\Description        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:24 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{d7df96ae-4176-4f8b-a5ae-12da83f4ded3}\LastModified        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:24 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{b0826656-dcb6-494f-884c-f0134a30d9ac}\SaferFlags        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:24 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{b0826656-dcb6-494f-884c-f0134a30d9ac}\ItemData        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:24 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{b0826656-dcb6-494f-884c-f0134a30d9ac}\Description        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:24 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{b0826656-dcb6-494f-884c-f0134a30d9ac}\LastModified        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:23 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{ae7f3361-2633-4b6b-839c-276bb5038de3}\SaferFlags        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:23 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{ae7f3361-2633-4b6b-839c-276bb5038de3}\ItemData        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:23 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{ae7f3361-2633-4b6b-839c-276bb5038de3}\Description        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:23 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{ae7f3361-2633-4b6b-839c-276bb5038de3}\LastModified        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:23 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{4314e86b-b31e-4da7-96d7-1cd29b762e9d}\SaferFlags        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:23 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{4314e86b-b31e-4da7-96d7-1cd29b762e9d}\ItemData        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:23 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{4314e86b-b31e-4da7-96d7-1cd29b762e9d}\Description        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:22 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{4314e86b-b31e-4da7-96d7-1cd29b762e9d}\LastModified        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:22 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1b55460a-c650-4bb7-ad7a-63a629dc7d3a}\SaferFlags        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:22 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1b55460a-c650-4bb7-ad7a-63a629dc7d3a}\ItemData        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:22 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1b55460a-c650-4bb7-ad7a-63a629dc7d3a}\Description        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:21 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1b55460a-c650-4bb7-ad7a-63a629dc7d3a}\LastModified        blocked        038.Policies_Safer_CodeIdentifiers       
4/8/2012 11:31:16 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Modify registry        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ExpressPrint        blocked        040.自启动项       
4/8/2012 11:31:13 PM        C:\Documents and Settings\HX\Desktop\360BackupApp\360BackupApp.exe        Direct access to disk        \\.\Harddisk0\DR0        blocked        018.直接访问磁盘       
回复

举报

bbs2811125
发表于 2012-4-8 23:33:07 | 显示全部楼层
IllusionWing 发表于 2012-4-8 23:31
上一次引擎更新时间去年九月初

话说对于这些个不走寻常路的倒是个偏方
回复

举报

IllusionWing
发表于 2012-4-8 23:34:02 | 显示全部楼层
bbs2811125 发表于 2012-4-8 23:33
话说对于这些个不走寻常路的倒是个偏方

以不变应万变
回复

举报

下一页 »
12345下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-1-20 17:10 , Processed in 0.092083 second(s), 14 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表