收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 病毒样本 分享&分析区 › 一支好马 微点来
123下一页
返回列表 发新帖
查看: 4497|回复: 25
收起左侧

[病毒样本] 一支好马 微点来

[复制链接]
Nblock
发表于 2008-7-26 11:50:19 | 显示全部楼层 |阅读模式
第二次再测测？
Kaspersky Anti-Virus Found Trojan-Spy.Win32.KeyLogger.apf

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

baerzake
发表于 2008-7-26 11:56:06 | 显示全部楼层
要密码啊
回复

举报

The EQs
发表于 2008-7-26 11:57:47 | 显示全部楼层
密码就是文件名
回复

举报

baerzake
发表于 2008-7-26 12:01:37 | 显示全部楼层
2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\Administrator\桌面\mp14
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Program Files\ThreatFire\TFWAH.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe



2008-07-26 11:57:08    加载库文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Program Files\ThreatFire\TFWAH.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Program Files\ThreatFire\TFWAH.dll.2.Manifest
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Program Files\ThreatFire\TFWAH.dll.2.Config
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\IMM32.DLL
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe






2008-07-26 11:57:08    加载库文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\imm32.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\LPK.DLL
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    加载库文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\lpk.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\USP10.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    加载库文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\usp10.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    修改注册表内容      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG
注册表名称:Seedﾧ塰
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\kernel32.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\ADVAPI32.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\kernel32.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\USER32.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\kernel32.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\USER32.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\ntdll.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\kernel32.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\USER32.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\ntdll.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\ADVAPI32.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\USER32.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\wuaueng.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    修改注册表内容      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG
注册表名称:Seedﾕ
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    修改注册表内容      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG
注册表名称:Seed
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    修改注册表内容      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG
注册表名称:Seed
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    修改注册表内容      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG
注册表名称:Seed
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    修改注册表内容      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG
注册表名称:Seed
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    修改注册表内容      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG
注册表名称:Seed
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    修改注册表内容      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG
注册表名称:Seed
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\wuauclt1.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:09    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:09    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\wuauclt1.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:09    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\user32.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:09    修改文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\wuaueng.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\Administrator\桌面\mp14\tmp.bat
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\Administrator\桌面\mp14\tmp.bat
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\Administrator\桌面\mp14\tmp.bat
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\Apphelp.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\Apphelp.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    加载库文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\apphelp.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\AppPatch\sysmain.sdb
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\AppPatch\systest.sdb
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\Administrator\桌面\mp14\
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:10    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\Administrator\
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:11    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\Administrator\桌面\
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:11    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\Administrator\桌面\mp14\
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:11    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\Administrator\
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:11    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\Administrator\桌面\
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:11    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\Administrator\桌面\mp14\
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:11    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\Administrator\
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:11    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\Administrator\桌面\
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:11    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Documents and Settings\Administrator\桌面\mp14\
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:11    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\cmd.exe
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:11    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\cmd.exe.Manifest
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:11    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c "C:\Documents and Settings\Administrator\桌面\mp14\tmp.bat"
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:11    修改其它进程内存      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
目标进程:C:\WINDOWS\system32\cmd.exe
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:11    修改其它进程内存      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
目标进程:C:\WINDOWS\system32\cmd.exe
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:11    修改其它进程内存      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
目标进程:C:\WINDOWS\system32\cmd.exe
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:11    修改其它进程内存      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
目标进程:C:\WINDOWS\system32\cmd.exe
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:11    修改其它进程内存      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
目标进程:C:\WINDOWS\system32\cmd.exe
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe
回复

举报

Kitman
发表于 2008-7-26 12:03:29 | 显示全部楼层
Begin scan in 'C:\Documents and Settings\Administrator\桌面\mp14'


End of the scan: 2008年7月26日  12:02
Used time: 00:03 Minute(s)

The scan has been done completely.

      1 Scanning directories
      4 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes
回复

举报

JY-YZX714
发表于 2008-7-26 12:03:53 | 显示全部楼层
so good！UG ok！红伞miss！

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

baerzake
发表于 2008-7-26 12:05:20 | 显示全部楼层
微点现在也可疑了？不报未知木马了？
回复

举报

电影结束了
发表于 2008-7-26 12:06:05 | 显示全部楼层
局长...
EQ+TF
回复

举报

baerzake
发表于 2008-7-26 12:13:56 | 显示全部楼层

回复 8楼 电影结束了 的帖子

你怎么知道的？
回复

举报

电影结束了
发表于 2008-7-26 12:17:12 | 显示全部楼层
原帖由 baerzake 于 2008-7-26 12:13 发表
你怎么知道的？

2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Program Files\ThreatFire\TFWAH.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe



2008-07-26 11:57:08    加载库文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Program Files\ThreatFire\TFWAH.dll
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Program Files\ThreatFire\TFWAH.dll.2.Manifest
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe


2008-07-26 11:57:08    读取文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\mp14\1.exe
文件路径:C:\Program Files\ThreatFire\TFWAH.dll.2.Config
触发规则:应用程序规则->跟踪模式->C:\Documents and Settings\Administrator\桌面\*.exe

你自己贴的...
我晚上也来试试TF+EQ的感觉...
估计不太会...
回复

举报

下一页 »
123下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-5-7 17:11 , Processed in 0.131812 second(s), 18 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表