47

Nocria

ESET kill

C:\Users\TOSHIBA\Desktop\v7xsD.zip > ZIP > v7xsD.exe - Win32/Spy.Zbot.AAN 特洛伊木马

liulangzhecgr

2012-4-18 09:22:51    创建新进程    允许
进程: c:\windows\explorer.exe
目标: e:\downloads\v7xsd\v7xsd.exe
命令行: "E:\downloads\v7xsD\v7xsD.exe"
规则: [应用程序]*

2012-4-18 09:23:28    创建文件    允许
进程: e:\downloads\v7xsd\v7xsd.exe
目标: C:\Documents and Settings\Administrator\Application Data\Vealy
规则: [应用程序]* -> [文件]*

2012-4-18 09:23:48    创建文件    允许
进程: e:\downloads\v7xsd\v7xsd.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\tmp0a93cf98.bat
规则: [应用程序]* -> [文件]*

2012-4-18 09:23:55    修改文件    允许
进程: e:\downloads\v7xsd\v7xsd.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\tmp0a93cf98.bat
规则: [应用程序]* -> [文件]*

2012-4-18 09:24:03    创建新进程    允许
进程: e:\downloads\v7xsd\v7xsd.exe
目标: c:\windows\system32\cmd.exe
命令行: "C:\WINDOWS\system32\cmd.exe" /c "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp0a93cf98.bat"
规则: [应用程序]*

2012-4-18 09:24:12    删除文件    允许
进程: c:\windows\system32\cmd.exe
目标: E:\downloads\v7xsD\v7xsD.exe
规则: [应用程序]* -> [文件]*

2012-4-18 09:24:14    删除文件    允许
进程: c:\windows\system32\cmd.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\tmp0a93cf98.bat
规则: [应用程序]* -> [文件]*