VT 1 / 46 999.dll 三九胃泰荣誉归来~~改进版，安全模式锁屏！！N 家杀软主防测试

firefox3

katatlove 发表于 2013-1-14 05:13
我觉得有几个很关键的地方想不通，首先我遇到的2次安全模式被锁，之前都是可以成功进入安全模式的，也就是 ...

重启归来，岁月静好，现世安稳 等会我测试一下OA

刚才测试的进程截图

蓝核

firefox3 发表于 2013-1-14 11:58
重启归来，岁月静好，现世安稳 等会我测试一下OA

刚才测试的进程截图

手机党表示看的过瘾，大明湖畔的tf和妈妈图了？表示愿意人气相赠～看来看去，还是老牌子比较奇葩。。。咖啡和诺顿想不到啊。果然手动比较。。。。

firefox3

蓝核 发表于 2013-1-14 12:10
手机党表示看的过瘾，大明湖畔的tf和妈妈图了？表示愿意人气相赠～看来看去，还是老牌子比较奇葩。。。咖 ...

联系K同学吧

firefox3

katatlove 发表于 2013-1-14 05:13
我觉得有几个很关键的地方想不通，首先我遇到的2次安全模式被锁，之前都是可以成功进入安全模式的，也就是 ...

win7 64位 SBie中运行三九胃泰，OA监控，全程无启动项拦截，OA防御失败，查看启动项，无添加三九胃泰启动项，SBie3.46防御成功！

蓝核

katatlove 发表于 2013-1-14 05:13
我觉得有几个很关键的地方想不通，首先我遇到的2次安全模式被锁，之前都是可以成功进入安全模式的，也就是 ...

K同学要不要辛苦测试下TF和妈妈图？给人气思密达~

firefox3

蓝核 发表于 2013-1-14 12:10
手机党表示看的过瘾，大明湖畔的tf和妈妈图了？表示愿意人气相赠～看来看去，还是老牌子比较奇葩。。。咖 ...

Mamutu 未拦截到SBie内运行的三九胃泰添加启动项，锁屏，重启之后SBie防御成功桌面解锁！

最后一张截图是实机截图，截的是虚拟机被锁屏。第二张截图可以无视。

QQ1620493525

TF求PM

firefox3

katatlove 发表于 2013-1-12 14:42
这个,估计又得灭一大片了. 求PM

文件: C:\Users\Firefox3\Desktop\新建文件夹 (2)\999.dll
大小: 244224 字节
修改时间: 2013年1月14日, 13:45:35
MD5: 27BAA226FC2FCE551B2DD7601D3851AE
SHA1: 597467375AA4B6A58E8DB37AF6EC25ABC28B3CD1
CRC32: 3911096B

三九胃泰又更新了~~

文件: C:\Users\Firefox3\Desktop\999.dll
大小: 253440 字节
修改时间: 2013年1月14日, 12:17:03
MD5: FB0A4D1CCAD1E4DD5536B0566AC4D5D6
SHA1: 272EB0029C6E5B180CACF983F155AF128868644F
CRC32: EC30D650

aice7837

katatlove 发表于 2013-1-14 05:13
我觉得有几个很关键的地方想不通，首先我遇到的2次安全模式被锁，之前都是可以成功进入安全模式的，也就是 ...

求测op

firefox3

aice7837 发表于 2013-1-14 14:15
求测op

我来吧，K同学估计睡觉呢

先给你看看  三九胃泰的兄弟，也是蛮强悍的，毛豆成功防御

2013-01-14 14:12:49         C:\Documents and Settings\Administrator\桌面\31.44.184.51F000015.dll         Sandbox中运行         部分限制
2013-01-14 14:12:50         C:\WINDOWS\system32\rundll32.exe         Sandbox中运行         部分限制
2013-01-14 14:12:50         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\All Users\Application Data\13.pad
2013-01-14 14:12:50         C:\WINDOWS\system32\rundll32.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1609
2013-01-14 14:12:50         C:\Program Files\Internet Explorer\IEXPLORE.EXE         Sandbox中运行         部分限制
2013-01-14 14:12:51         C:\WINDOWS\system32\ctfmon.exe         Sandbox中运行         部分限制
2013-01-14 14:12:51         C:\Program Files\Internet Explorer\IEXPLORE.EXE         Sandbox中运行         部分限制
2013-01-14 14:12:51         C:\WINDOWS\system32\rundll32.exe         Sandbox中运行         部分限制
2013-01-14 14:12:52         C:\Program Files\Internet Explorer\IEXPLORE.EXE         Sandbox中运行         部分限制
2013-01-14 14:12:53         C:\WINDOWS\system32\ctfmon.exe         Sandbox中运行         部分限制
2013-01-14 14:12:53         C:\WINDOWS\system32\rundll32.exe         Sandbox中运行         部分限制
2013-01-14 14:12:54         C:\Program Files\Internet Explorer\IEXPLORE.EXE         Sandbox中运行         部分限制
2013-01-14 14:12:54         C:\Program Files\Internet Explorer\IEXPLORE.EXE         Sandbox中运行         部分限制
2013-01-14 14:12:55         C:\WINDOWS\system32\ctfmon.exe         Sandbox中运行         部分限制
2013-01-14 14:12:55         C:\WINDOWS\system32\rundll32.exe         Sandbox中运行         部分限制
2013-01-14 14:12:55         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:12:55         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:12:55         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:12:55         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:12:55         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{6C75FB27-5E11-11E2-A1E0-506313B49FD4}.dat
2013-01-14 14:12:55         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKLM\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\EventMessageFile
2013-01-14 14:12:55         C:\Documents and Settings\Administrator\桌面\31.44.184.51F000015.dll         访问内存         C:\WINDOWS\system32\ctfmon.exe
2013-01-14 14:12:55         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe
2013-01-14 14:12:55         C:\Documents and Settings\Administrator\桌面\31.44.184.51F000015.dll         访问内存         C:\WINDOWS\system32\ctfmon.exe
2013-01-14 14:12:55         C:\WINDOWS\system32\ctfmon.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe
2013-01-14 14:12:55         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:12:55         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6C75FB28-5E11-11E2-A1E0-506313B49FD4}.dat
2013-01-14 14:12:55         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:12:55         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\All Users\Application Data\13.pad
2013-01-14 14:12:55         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:12:55         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\All Users\Application Data\13.pad
2013-01-14 14:12:55         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:12:55         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\All Users\Application Data\13.pad
2013-01-14 14:12:55         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:12:55         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:12:56         C:\Program Files\Internet Explorer\IEXPLORE.EXE         Sandbox中运行         部分限制
2013-01-14 14:12:56         C:\Program Files\Internet Explorer\IEXPLORE.EXE         Sandbox中运行         部分限制
2013-01-14 14:12:57         C:\WINDOWS\system32\ctfmon.exe         Sandbox中运行         部分限制
2013-01-14 14:12:58         C:\WINDOWS\system32\rundll32.exe         Sandbox中运行         部分限制
2013-01-14 14:12:58         C:\Program Files\Internet Explorer\IEXPLORE.EXE         Sandbox中运行         部分限制
2013-01-14 14:12:58         C:\Program Files\Internet Explorer\IEXPLORE.EXE         Sandbox中运行         部分限制
2013-01-14 14:13:18         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:18         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:13:18         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:13:18         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:13:18         C:\WINDOWS\system32\rundll32.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1609
2013-01-14 14:13:18         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:18         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}\InprocServer32
2013-01-14 14:13:18         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2013-01-14 14:13:18         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
2013-01-14 14:13:18         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:18         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:18         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:13:18         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:18         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:18         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5
2013-01-14 14:13:18         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:13:18         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:13:18         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2013-01-14 14:13:18         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:18         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:13:23         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:13:33         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:33         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:13:33         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:13:33         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:33         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:33         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:13:33         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5
2013-01-14 14:13:33         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe
2013-01-14 14:13:33         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:13:33         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKLM\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\EventMessageFile
2013-01-14 14:13:33         C:\WINDOWS\system32\ctfmon.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe
2013-01-14 14:13:33         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{6DA4C5CE-5E11-11E2-A1E0-506313B49FD4}.dat
2013-01-14 14:13:33         C:\Documents and Settings\Administrator\桌面\31.44.184.51F000015.dll         访问内存         C:\WINDOWS\system32\ctfmon.exe
2013-01-14 14:13:33         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:33         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
2013-01-14 14:13:33         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:33         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:13:33         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:13:33         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:13:33         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6DA4C5CF-5E11-11E2-A1E0-506313B49FD4}.dat
2013-01-14 14:13:42         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\All Users\Application Data\13.pad
2013-01-14 14:13:42         C:\WINDOWS\system32\rundll32.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1609
2013-01-14 14:13:42         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:42         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:13:42         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:13:42         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:42         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:13:42         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:42         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:13:42         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:42         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:42         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:42         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:42         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:13:42         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:13:42         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2013-01-14 14:13:42         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:42         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:42         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5
2013-01-14 14:13:42         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}\InprocServer32
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:50         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:50         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{6EC54258-5E11-11E2-A1E0-506313B49FD4}.dat
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:50         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKLM\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\EventMessageFile
2013-01-14 14:13:59         C:\Documents and Settings\Administrator\桌面\31.44.184.51F000015.dll         访问内存         C:\WINDOWS\system32\ctfmon.exe
2013-01-14 14:13:59         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe
2013-01-14 14:13:59         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:13:59         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:13:59         C:\Documents and Settings\Administrator\桌面\31.44.184.51F000015.dll         访问内存         C:\WINDOWS\system32\ctfmon.exe
2013-01-14 14:13:59         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:59         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
2013-01-14 14:13:59         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:59         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:13:59         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:59         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:13:59         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:59         C:\WINDOWS\system32\ctfmon.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe
2013-01-14 14:13:59         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:13:59         C:\WINDOWS\system32\ctfmon.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Run\internat.exe
2013-01-14 14:13:59         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2013-01-14 14:13:59         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:13:59         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:13:59         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\All Users\Application Data\13.pad
2013-01-14 14:13:59         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:07         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:07         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:07         C:\WINDOWS\system32\rundll32.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1609
2013-01-14 14:14:07         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:07         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:07         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:14:07         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:07         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:14:07         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:07         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:07         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:07         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:07         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5
2013-01-14 14:14:07         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:07         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:07         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:07         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:07         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:07         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:07         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}\InprocServer32
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
2013-01-14 14:14:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:14         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{7017D044-5E11-11E2-A1E0-506313B49FD4}.dat
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKLM\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\EventMessageFile
2013-01-14 14:14:22         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5
2013-01-14 14:14:31         C:\Documents and Settings\Administrator\桌面\31.44.184.51F000015.dll         访问内存         C:\WINDOWS\system32\ctfmon.exe
2013-01-14 14:14:31         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:31         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:31         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:31         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:31         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
2013-01-14 14:14:31         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:31         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:14:31         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:31         C:\WINDOWS\system32\ctfmon.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe
2013-01-14 14:14:31         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:31         C:\WINDOWS\system32\ctfmon.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Run\internat.exe
2013-01-14 14:14:31         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5
2013-01-14 14:14:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:31         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:40         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:40         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\All Users\Application Data\13.pad
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:40         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\All Users\Application Data\13.pad
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5
2013-01-14 14:14:40         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2013-01-14 14:14:49         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:49         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:49         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\All Users\Application Data\13.js
2013-01-14 14:14:49         C:\WINDOWS\system32\rundll32.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1609
2013-01-14 14:14:49         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:49         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:49         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:49         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:49         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:14:49         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:49         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:49         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2013-01-14 14:14:49         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:14:49         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:49         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:49         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:49         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:49         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:49         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:49         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:56         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:56         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2013-01-14 14:14:56         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:56         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:56         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
2013-01-14 14:14:56         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
2013-01-14 14:14:56         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:56         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:56         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:56         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
2013-01-14 14:14:56         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:56         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:56         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\History
2013-01-14 14:14:56         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:56         C:\Program Files\Internet Explorer\iexplore.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2013-01-14 14:14:56         C:\Program Files\Internet Explorer\iexplore.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2013-01-14 14:14:56         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:56         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:56         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:14:56         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:05         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:14         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\Documents and Settings\Administrator\桌面\31.44.184.51F000015.dll         访问内存         C:\WINDOWS\system32\ctfmon.exe
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:22         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:31         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
2013-01-14 14:15:37         C:\WINDOWS\system32\rundll32.exe         修改文件         C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\runctf.lnk
报告结束