1x

hddu

2009-11-29 08:19:35    创建文件      操作:允许
进程路径:E:\6\6.com
文件路径:E:\1.exe
触发规则:应用程序规则->其它文件设置->E:\*->E:\*.exe

2009-11-29 08:19:37    创建文件      操作:允许
进程路径:E:\6\6.com
文件路径:E:\工具猫牧场开通器V2.0.exe
触发规则:应用程序规则->其它文件设置->E:\*->E:\*.exe

2009-11-29 08:19:41    修改注册表内容      操作:阻止并结束进程
进程路径:E:\1.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
注册表名称:userinit
更改后:C:\WINDOWS\system32\userinit.exe,"E:\1.exe"
更改前:C:\WINDOWS\system32\userinit.exe,
触发规则:所有程序规则->WinLogon->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

2009-11-29 08:19:45    加载库文件      操作:阻止
进程路径:E:\工具猫牧场开通器V2.0.exe
文件路径:C:\WINDOWS\system32\dnsapi.dll
触发规则:所有程序规则->联网操作->%windir%\system32\dnsapi.dll

z2665

Begin scan in 'C:\Users\z2665\Desktop\1.exe'
C:\Users\z2665\Desktop\1.exe
Begin scan in 'C:\Users\z2665\Desktop\工具猫牧场开通器V2.0.exe'
    [DETECTION] Is the TR/Dropper.Gen Trojan
Begin scan in 'C:\Users\z2665\Desktop\6.com'
C:\Users\z2665\Desktop\6.com
  [0] Archive type: NSIS
    --> [TempDir]/1.exe
      [DETECTION] Is the TR/Dropper.Gen Trojan

Beginning disinfection:
C:\Users\z2665\Desktop\1.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      The file was deleted!
C:\Users\z2665\Desktop\6.com
    [NOTE]      The file was deleted!
miss1，to

傻猪猪米走鸡

eav miss

angir

微点杀毒软件特征1，miss 2

zhanyuchenbobo

D:\我的文档\My Documents\下载\7\7\1.exe
BackDoor-DRV.gen.c

wliao

微点

尤金卡巴斯基

To KL

尤金卡巴斯基

########V2.0.exe_, 1.exe_, 6.com_

No malicious code were found in these files.

BING126

误报。。