AV105.exe

Sherry.ai

AV105.exe

hzz2009

管家下载报恶意广告软件

jayavira

cn86li

To BD

ticket number is 2014062506450001

The file shows no signs of malicious activity.

File av105_exe declared CLEAN

mz123456

cn86li 发表于 2014-6-25 14:45
To BD

这一串是啥意思

XywCloud

流氓软件
已经采集

fzshot

Dr.Web

ZhangBo_8

360杀360杀

潘中医

火绒杀

左手

2014-06-25 18:42:54    创建文件夹    允许
进程: c:\documents and settings\administrator\桌面\av105.exe
目标: C:\Program Files\OnlineInstall
规则: [文件]?:\program files

2014-06-25 18:42:54    创建文件夹    阻止
进程: c:\documents and settings\administrator\桌面\av105.exe
目标: C:\Documents and Settings\Administrator\「开始」菜单\程序\OnlineInstall
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-06-25 18:43:00    创建文件    允许
进程: c:\documents and settings\administrator\桌面\av105.exe
目标: C:\Program Files\OnlineInstall\Uninstall.exe
规则: [文件]?:\program files\*\*

2014-06-25 18:43:01    读文件    阻止
进程: c:\documents and settings\administrator\桌面\av105.exe
目标: C:\Documents and Settings\Administrator\Cookies\index.dat
规则: [文件组]木马防御_cookies -> [文件]c:\documents and settings\administrator\cookies; index.dat

2014-06-25 18:43:01    读文件    阻止
进程: c:\documents and settings\administrator\桌面\av105.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\index.dat
规则: [文件组]木马防御_cookies -> [文件]c:\documents and settings\administrator\local settings\temp\cookies; index.dat

2014-06-25 18:43:01    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\av105.exe
目标: C:\Documents and Settings\Administrator\桌面\Intrenet Explorer.lnk
规则: [文件组]只读磁盘 -> [文件]c:\*

2014-06-25 18:43:01    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\av105.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\c:\program files\ksafe\AppData\proc_startup_perf.dat  \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb12.tmp\NsProcess.dll
规则: [注册表组]拦截_Auto Starts -> [注册表]*\System\*ControlSet*\Control\Session Manager; PendingFileRenameOperations

2014-06-25 18:43:01    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\av105.exe
目标: C:\WINDOWS\wininit.ini
规则: [文件组]只读磁盘 -> [文件]c:\*