win7_xp_share.zip

显示全部楼层 · 发表于 2012-6-16 12:32:57

<html>
<head>
<META http-equiv="Content-Type" content="text/html; charset=UTF-16">
<title>Defense+ 事件</title>
</head>
<body>
<table width="100%" bgcolor="#CFCFE5" border="0">
<tr>
<td>
<font face="Arial" size="+1">COMODO Internet Security Premium - 日志查看器日志</font>
</td>
</tr>
</table>
<table width="100%" cellspacing="0" cellpadding="0" border="0">
<tr>
<td width="0" bgcolor="#EDEDF5"> </td>
<td width="0" bgcolor="#FFFFFF"> </td>
<td width="20%">
<h4>表</h4>
</td>
<td width="0">
<h4>:</h4>
</td>
<td width="*">
<h4>Defense+ 事件</h4>
</td>
</tr>
<tr>
<td width="0" bgcolor="#EDEDF5"> </td>
<td width="0" bgcolor="#FFFFFF"> </td>
<td width="20%">
<h4>日期创建</h4>
</td>
<td width="0">
<h4>:</h4>
</td>
<td width="*">
<h4>2002-01-01 03:19:04</h4>
</td>
</tr>
<tr>
<td width="0" bgcolor="#EDEDF5"> </td>
<td width="0" bgcolor="#FFFFFF"> </td>
<td width="20%">
<h4>记录数</h4>
</td>
<td width="0">
<h4>:</h4>
</td>
<td width="*">
<h4>29</h4>
</td>
</tr>
</table>
<table width="100%" cellspacing="0" cellpadding="0" border="1">
<tr>
<th>日期</th>
<th>应用程序</th>
<th>行为</th>
<th>目标</th>
</tr>
<tr>
<td>2002-01-01 03:15:55

<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改文件
</td>
<td>\Device\NamedPipe\wkssvc
</td>
</tr>
<tr>
<td>2002-01-01 03:16:06
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改注册表项
</td>
<td>HKUS\S-1-5-21-842925246-1935655697-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
</td>
</tr>
<tr>
<td>2002-01-01 03:16:06
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
</td>
</tr>
<tr>
<td>2002-01-01 03:16:06
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改注册表项
</td>
<td>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
</td>
</tr>
<tr>
<td>2002-01-01 03:16:06
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\Local Settings\History
</td>
</tr>
<tr>
<td>2002-01-01 03:16:06
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改注册表项
</td>
<td>HKUS\S-1-5-21-842925246-1935655697-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
</td>
</tr>
<tr>
<td>2002-01-01 03:16:06
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
</td>
</tr>
<tr>
<td>2002-01-01 03:16:06
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改注册表项
</td>
<td>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
</td>
</tr>
<tr>
<td>2002-01-01 03:16:06
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\Local Settings\History
</td>
</tr>
<tr>
<td>2002-01-01 03:16:06
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改注册表项
</td>
<td>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
</td>
</tr>
<tr>
<td>2002-01-01 03:16:06
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\Local Settings\History
</td>
</tr>
<tr>
<td>2002-01-01 03:16:06
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>发送消息
</td>
<td>C:\WINDOWS\system32\csrss.exe
</td>
</tr>
<tr>
<td>2002-01-01 03:16:06
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>创建进程
</td>
<td>C:\Program Files\Comodo\Dragon\dragon.exe
</td>
</tr>
<tr>
<td>2002-01-01 03:16:06
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改注册表项
</td>
<td>HKUS\S-1-5-21-842925246-1935655697-1801674531-500\Software\JYW
</td>
</tr>
<tr>
<td>2002-01-01 03:16:06
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\桌面\works.bat
</td>
</tr>
<tr>
<td>2002-01-01 03:16:23
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改文件
</td>
<td>\Device\NamedPipe\wkssvc
</td>
</tr>
<tr>
<td>2002-01-01 03:16:31
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改文件
</td>
<td>\Device\NamedPipe\wkssvc
</td>
</tr>
<tr>
<td>2002-01-01 03:16:44
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>创建进程
</td>
<td>C:\WINDOWS\system32\shell32.dll
</td>
</tr>
<tr>
<td>2002-01-01 03:16:44
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改文件
</td>
<td>\Device\shadow
</td>
</tr>
<tr>
<td>2002-01-01 03:16:51
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改注册表项
</td>
<td>HKUS\S-1-5-21-842925246-1935655697-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A\BaseClass
</td>
</tr>
<tr>
<td>2002-01-01 03:16:51
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改文件
</td>
<td>\Device\NamedPipe\samr
</td>
</tr>
<tr>
<td>2002-01-01 03:16:51
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改注册表项
</td>
<td>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Documents
</td>
</tr>
<tr>
<td>2002-01-01 03:16:51
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改文件
</td>
<td>\Device\NamedPipe\lsarpc
</td>
</tr>
<tr>
<td>2002-01-01 03:16:51
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改文件
</td>
<td>\Device\NamedPipe\samr
</td>
</tr>
<tr>
<td>2002-01-01 03:16:57
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>修改文件
</td>
<td>\Device\NamedPipe\wkssvc
</td>
</tr>
<tr>
<td>2002-01-01 03:16:57
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>创建进程
</td>
<td>C:\Windows\explorer.exe
</td>
</tr>
<tr>
<td>2002-01-01 03:17:59
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>在线扫描发现恶意程序
</td>
<td>
</td>
</tr>
<tr>
<td>2002-01-01 03:18:06
</td>
<td>C:\Documents and Settings\Administrator\桌面\局域网共享软件.exe
</td>
<td>在线扫描发现恶意程序
</td>
<td>
</td>
</tr>
</table>
<table width="100%" bgcolor="#CFCFE5" border="0">
<tr>
<td>
<font face="Arial" size="+1">报告结束</font>
</td>
</tr>
</table>
</body>
</html>

显示全部楼层 · 发表于 2012-6-16 12:36:52

显示全部楼层 · 发表于 2012-6-16 12:42:10

多余的动作是有点多。

显示全部楼层 · 发表于 2012-6-16 14:54:40

360杀毒，实时防护，干掉

[可疑文件] win7_xp_share.zip

本帖子中包含更多资源