感染型，请双击运行测杀软防御

Tomin2009

动作太多




Created:      2012/9/11 星期二 9:27:18
Summary:      Program Guard: kernel event
Description:  OADriver: OB_OPERATION_HANDLE_CREATE, 4500 -> 1712, Mask: 100 - 100000
Event type:   Kernel event(26)
Event action: None(1)
Processes:
  PID:    1712        Name: OAcat.exe
  PID:    4500        Name: memorymaster.exe

Created:      2012/9/11 星期二 9:26:10
Summary:      Program Guard: 9.exe -> LPK.dll
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe(4000) wants to write memory in \KnownDlls\LPK.dll(4)
Event type:   Program Guard(9)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:51
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files I:\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:51
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files F:\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:51
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files H:\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:51
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Sandbox\Senior\DefaultBox\drive\C\Windows\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:51
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files D:\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:51
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files E:\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:51
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Users\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:51
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\ProgramData\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:51
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Sandbox\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\xfplay\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\锐捷网
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Wise\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\WOT\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Windows Sidebar\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\WinRAR\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Windows Photo Viewer\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Windows Portable Devices\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Windows Media Player\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Windows NT\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Windows Journal\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Windows Mail\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\VS Revo Group\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Windows Defender\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\USB Camera\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Tencent\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\TweakCube3\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Reference Assemblies\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Sandboxie\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Process Lasso\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Realtek\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\NVIDIA Corporation\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\MSECache\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\MSBuild\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Microsoft Office\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Microsoft.NET\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Microsoft Engkoo Pinyin\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Microsoft Games\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Microsoft ActiveSync\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Malwarebytes' Anti-Malware\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Meitu\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\MagicTray\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\kingsoft\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Lenovo\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Internet Explorer\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Internet Download Manager\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\InstallShield Installation Information\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Intel\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\HeroBravo\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\DVD Maker\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Foxit Software\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Detong\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Diskeeper Corporation\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\CONEXANT\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\Tencent\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\System\Ole DB\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\System\zh-CN\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\System\msadc\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\System\ado\zh-CN\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\System\en-US\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\SpeechEngines\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\Services\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\postureAgent\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\microsoft shared\Web Server Extensions\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\microsoft shared\Web Folders\2052\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\microsoft shared\THEMES11\COMPASS\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\microsoft shared\THEMES11\CNSEA\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\microsoft shared\THEMES11\CNPEACH\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\microsoft shared\THEMES11\CNLOVE\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\microsoft shared\THEMES11\CNLUCK\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\microsoft shared\THEMES11\CNFLOWER\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\microsoft shared\THEMES11\CASCADE\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\microsoft shared\THEMES11\CAPSULES\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\microsoft shared\THEMES11\BREEZE\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:50
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\microsoft shared\THEMES11\CANYON\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:49
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\microsoft shared\ink\tr-TR\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:49
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:48
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Users\Senior\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:48
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Users\Senior\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:48
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Users\Senior\Searches\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:48
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Users\Senior\AppData\Roaming\Microsoft\Windows\Recent\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:48
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Users\Senior\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:48
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Users\Senior\Documents\Tencent Files\1679180371\FileRecv\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:47
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Users\Senior\AppData\Roaming\Microsoft\Windows\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:47
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Users\Senior\AppData\Roaming\Microsoft\SystemCertificates\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:47
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Users\Senior\AppData\Roaming\Microsoft\Protect\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:47
Summary:      Program Guard: 9.exe
Description:  C:\Users\Senior\Downloads\Compressed\9\9.exe wants to get a list of the files C:\Users\Senior\AppData\Roaming\Microsoft\Proof\*
Event type:   File enumeration(27)
Event action: Blocked(3)

Created:      2012/9/11 星期二 9:25:01
Summary:      Program Guard: kernel event
Description:  OADriver: Registry, PID: 4432, Act:  8, Idn: 0, Mask: \REGISTRY\USER\SANDBOX_SENIOR_DEFAULTBOX\machine\software\Classes\exefile\shell\open\command\ - Deny (rule)
Event type:   Kernel event(26)
Event action: None(1)
Processes:
  PID:    4432        Name: 9.exe

liulangzhecgr

谢谢分享样本---根据情况会加强ntfs权限设置的哦！
2012-9-11 09:30:43    创建新进程    允许
进程: c:\windows\explorer.exe
目标: e:\downloads\管理员\9\9.exe
命令行: "E:\downloads\管理员\9\9.exe"
规则: [应用程序]*

2012-9-11 09:30:45    创建文件    允许
进程: e:\downloads\管理员\9\9.exe
目标: C:\WINDOWS\svchost.com
规则: [应用程序]* -> [文件]*

2012-9-11 09:31:08    修改文件    阻止
进程: e:\downloads\管理员\9\9.exe
目标: E:\downloads\不允许\CLT\clt.exe
规则: [应用程序]* -> [文件]*

2012-9-11 09:31:24    修改文件    阻止
进程: e:\downloads\管理员\9\9.exe
目标: F:\MyTools\FixTools\arswp3_x86\arswp3\exts\KChrome.exe
规则: [应用程序]* -> [文件]*

2012-9-11 09:31:29    创建文件    允许
进程: e:\downloads\管理员\9\9.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\tmp5023.tmp
规则: [应用程序]* -> [文件]*


算啦！让样本无处可发挥...

xiaozi55

EQ测试是针对QQ感染的

371567828

测试哈

00000q

liulangzhecgr

00000q 发表于 2012-9-19 19:48

不知道现在还有效不？！

蓝天二号

瑞星

00000q

liulangzhecgr 发表于 2012-9-19 20:10
不知道现在还有效不？！

感谢分享，有时间跑跑看。

宵河

liulangzhecgr 发表于 2012-9-19 20:10
不知道现在还有效不？！

有空试试。

liulangzhecgr

宵河 发表于 2012-9-20 10:18
有空试试。

你有没有全盘感染可执行文件的样本？！ 能否分享。。。