abc.exe

左手

[mw_shl_code=css,true]2016-9-17 20:29:41    创建新进程 风险级别:未知    允许
进程: c:\documents and settings\administrator\桌面\abc\abc.exe
目标: c:\documents and settings\administrator\桌面\abc\abc.exe
命令行: "C:\Documents and Settings\Administrator\桌面\abc\abc.exe"
规则: [应用程序]??* -> [子应用程序]*\桌面\*

2016-9-17 20:29:42    创建文件夹 风险级别:未知    阻止
进程: c:\documents and settings\administrator\桌面\abc\abc.exe
目标: C:\WINDOWS\M-505045058025025030484340240
规则: [文件组]拦截_只读磁盘 -> [文件]c:\*

2016-9-17 20:29:42    修改注册表值 风险级别:未知    阻止并结束进程
进程: c:\documents and settings\administrator\桌面\abc\abc.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\M-505045058025025030484340240\winmgr.exe
值: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\M-505045058025025030484340240\winmgr.exe:*:Enabled:Microsoft Windows Manager
规则: [注册表组]拦截_Malicious Keys -> [注册表]*\System\CurrentControlSet\Services\Sharedaccess\Parameters\FirewallPolicy\*
[/mw_shl_code]

追影子的十三

BD引擎已入库

FS杀

轩夏

MSE

abc.exe
Infected: Backdoor:Win32/Kirts.A

MelissaBenoist

毒霸09 XP 32下 双击后文件消失