winbdux.dll + Uninstall.exe

wptyh73hm

2009-6-29 20:15:23    创建文件    允许
进程: f:\program files\7-zip\7zfm.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\7zO114.tmp\Uninstall.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2009-6-29 20:15:25    创建新进程    允许
进程: f:\program files\7-zip\7zfm.exe
目标: c:\documents and settings\administrator\local settings\temp\7zo114.tmp\uninstall.exe
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7zO114.tmp\Uninstall.exe"
规则: [应用程序]*

2009-6-29 20:15:29    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo114.tmp\uninstall.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\6FF8BE64FFF544ED8B527A40A984156C.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2009-6-29 20:15:31    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo114.tmp\uninstall.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\6FF8BE64FFF544ED8B527A40A984156C.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2009-6-29 20:15:33    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo114.tmp\uninstall.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\6FF8BE64FFF544ED8B527A40A984156C.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2009-6-29 20:15:34    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo114.tmp\uninstall.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\F:\Program Files\KSWebShieldSVC\KWSReUpd\KSWBC.dll !\??\F:\Program Files\KSWebShieldSVC\KSWBC.dll \??\F:\Program Files\KSWebShieldSVC\KWSReUpd\kswebshield.dll !\??\F:\Program Files\KSWebShieldSVC\kswebshield.dll \??\F:\Program Files\KSWebShieldSVC\KWSReUp
规则: [注册表组]自动运行程序所在位置 -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager; PendingFileRenameOperations

2009-6-29 20:15:42    删除文件    允许
进程: f:\program files\7-zip\7zfm.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\7zO114.tmp\Uninstall.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe