据说是鬼影

辽宁大连~~小海

管家双击无反应,扫描报读

catcat520

不像是鬼影

左手

2014-05-21 17:26:15    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\5A630454.tmp
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:34    向其他进程发送消息 (2)    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: c:\windows\explorer.exe
消息: WM_INPUTLANGCHANGEREQUEST
规则: [应用程序组]主动防御_进程防护 -> [应用程序]* -> [目标应用程序]c:\windows\explorer.exe

2014-05-21 17:26:45    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件组]Namedpipe -> [文件]\device\namedpipe\*

2014-05-21 17:26:45    创建注册表项    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\1AD37E04
规则: [注册表组]拦截_Drivers\Servieces -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Services

2014-05-21 17:26:45    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\drmkaud\ImagePath
值: Base
规则: [注册表组]拦截_Drivers\Servieces -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Services\*; ImagePath

2014-05-21 17:26:45    创建注册表项    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\1AD37E04
规则: [注册表组]拦截_Drivers\Servieces -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Services

2014-05-21 17:26:45    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\1AD37E04.sys
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:45    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件组]Namedpipe -> [文件]\device\namedpipe\*

2014-05-21 17:26:52    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\drmkaud\ImagePath
值: system32\drmkaud.sys
规则: [注册表组]拦截_Drivers\Servieces -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Services\*; ImagePath

2014-05-21 17:26:52    安装驱动程序或服务    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\34DA3114.sys
规则: [应用程序]*

2014-05-21 17:26:52    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\34DA3114.sys
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: \Device\NamedPipe\wkssvc
规则: [文件组]Namedpipe -> [文件]\device\namedpipe\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件组]Namedpipe -> [文件]\device\namedpipe\*

2014-05-21 17:26:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal
值: C:\Documents and Settings\Administrator\My Documents
规则: [注册表组]拦截_Blocked Others -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件组]Namedpipe -> [文件]\device\namedpipe\*

2014-05-21 17:26:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Documents
值: C:\Documents and Settings\All Users\Documents
规则: [注册表组]拦截_Blocked Others -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*

2014-05-21 17:26:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop
值: C:\Documents and Settings\Administrator\桌面
规则: [注册表组]拦截_Blocked Others -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*

2014-05-21 17:26:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Desktop
值: C:\Documents and Settings\All Users\桌面
规则: [注册表组]拦截_Blocked Others -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*

2014-05-21 17:26:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: E:\Local Settings\temporary internet files
规则: [注册表组]拦截_Blocked Others -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*

2014-05-21 17:26:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]拦截_Blocked Others -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*

2014-05-21 17:26:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]拦截_Blocked Others -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*

2014-05-21 17:26:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
值: 0x00000001(1)
规则: [注册表组]拦截_Blocked Others -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\*

2014-05-21 17:26:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
值: 0x00000001(1)
规则: [注册表组]拦截_Blocked Others -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\*

2014-05-21 17:26:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000001(1)
规则: [注册表组]拦截_Blocked Others -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\*

2014-05-21 17:26:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
值: 0x00000001(1)
规则: [注册表组]拦截_Blocked Others -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\*

2014-05-21 17:26:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
值: 0x00000001(1)
规则: [注册表组]拦截_Blocked Others -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\*

2014-05-21 17:26:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
值: 0x00000001(1)
规则: [注册表组]拦截_Blocked Others -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\*

2014-05-21 17:26:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000001(1)
规则: [注册表组]拦截_Blocked Others -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\*

2014-05-21 17:26:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
值: 0x00000001(1)
规则: [注册表组]拦截_Blocked Others -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\*

2014-05-21 17:26:54    创建新进程    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: c:\windows\system32\cmd.exe
命令行: C:\WINDOWS\system32\cmd.exe /c ""C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1b3126da.bat" "
规则: [应用程序组]→终止_降权组件

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\appmgmts.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\qmgr.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\mspmsnsv.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\xmlprov.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\ntmssvc.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\upnphost.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\browser.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\pchsvc.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\regsvc.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\appmgmts.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\qmgr.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\mspmsnsv.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\xmlprov.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\ntmssvc.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\upnphost.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\browser.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\pchsvc.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: C:\WINDOWS\system32\regsvc.dll
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-05-21 17:26:54    安装驱动程序或服务    阻止
进程: c:\documents and settings\administrator\桌面\鬼影7密码：xxbug\xxx.exe
目标: %SystemRoot%\System32\Svchost.exe -k netsvcs
规则: [应用程序]*