1x

shadowmin

nvhaichina

过了红伞，费尔

深海之星

过avk 2006，强！

mofunzone

to avira

尤金卡巴斯基

2009/7/5 17:12:20        已清除        木马程序 Trojan.Win32.FraudPack.pgr        G:\Temp\Virus\Setup-9ab_02013-1.rar/Setup-9ab_02013-1.exe

aerbeisi

IKARUS - T3SCAN V1.32.10.0 (WIN32)
         T3 V1.01.64
         Copyright (c) 2006 - 2009 by Ikarus Software.
         All rights reserved.

Signature-database from 5.7.2009 08:01:14 (Build: 72979)

e:\Setup-9ab_02013-1.rar:Setup-9ab_02013-1.exe - Signature 'Trojan.Win32.FraudPack' found
e:\Setup-9ab_02013-1.rar - Signature 'Trojan.Win32.FraudPack' found

        2 Files scanned
          (1 Archiv with 1 file)
        2 Signatures found
        0 Suspect code-parts found
        Used time: 0:00.110

wptyh73hm

2009-7-5 20:25:48    创建新进程    允许
进程: f:\program files\7-zip\7zfm.exe
目标: c:\documents and settings\administrator\local settings\temp\7zo6f.tmp\setup-9ab_02013-1.exe
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7zO6F.tmp\Setup-9ab_02013-1.exe"
规则: [应用程序]*

2009-7-5 20:25:52    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo6f.tmp\setup-9ab_02013-1.exe
目标: UDP [本机 : 4133] ->  [127.0.0.1 : 4133]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2009-7-5 20:25:53    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo6f.tmp\setup-9ab_02013-1.exe
目标: TCP [本机 : 4135] ->  [83.133.124.81 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2009-7-5 20:26:15    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo6f.tmp\setup-9ab_02013-1.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\Program Files\PersonalAV\.x
规则: [注册表组]自动运行程序所在位置 -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager; PendingFileRenameOperations

2009-7-5 20:26:16    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo6f.tmp\setup-9ab_02013-1.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\Program Files\PersonalAV\..x
规则: [注册表组]自动运行程序所在位置 -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager; PendingFileRenameOperations

2009-7-5 20:26:18    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo6f.tmp\setup-9ab_02013-1.exe
目标: TCP [本机 : 4137] ->  [72.233.64.146 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2009-7-5 20:26:20    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo6f.tmp\setup-9ab_02013-1.exe
目标: TCP [本机 : 4138] ->  [72.233.64.146 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2009-7-5 20:26:32    访问COM接口    阻止
进程: c:\documents and settings\administrator\local settings\temp\7zo6f.tmp\setup-9ab_02013-1.exe
目标: {4991D34B-80A1-4291-83B6-3328366B9097} Background Intelligent Transfer Control Class 1.0
规则: [应用程序]* -> [COM接口]{4991d34b-80a1-4291-83b6-3328366b9097}

2009-7-5 20:26:40    删除文件    允许
进程: f:\program files\7-zip\7zfm.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\7zO6F.tmp\Setup-9ab_02013-1.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

BING126

to McAfee

song-ci

刚下载就被ik干掉了

dreams521

to mpav