1x

Palkia

RS20091227184810765842

wliao

Files added: 10
--------------------
C:\Documents and Settings\Owner\Local Settings\Temp\Rar$EX00.468\Qvodplus_118_soso.exe
C:\Documents and Settings\Owner\「开始」菜单\Internet Explorer.lnk
C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk
C:\Documents and Settings\Owner\Favorites\网址大全.url
C:\Documents and Settings\Owner\Favorites\精彩小游戏.url
C:\Documents and Settings\Owner\Favorites\不死高清电影.url
C:\Documents and Settings\All Users\「开始」菜单\Internet Explorer.lnk
C:\Documents and Settings\All Users\「开始」菜单\程序\Internet Explorer.lnk
C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk
C:\Documents and Settings\All Users\桌面\创业投资好项目.url
Files modified: 31

HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu
  Old: (DWORD) {871C5380-42A0-1069-A2EA-08002B30309D} =0x00000000 (0)
  New: (DWORD) {871C5380-42A0-1069-A2EA-08002B30309D} =0x00000001 (1)

HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
  Old: (DWORD) {871C5380-42A0-1069-A2EA-08002B30309D} =0x00000000 (0)
  New: (DWORD) {871C5380-42A0-1069-A2EA-08002B30309D} =0x00000001 (1)

HKEY_LOCAL_MACHINE\software\Classes\lnkfile
  Deleted: (SZ) IsShortCut =(Null)

Calven

回复 2# wliao

请问你这是用什么软件测出来的？

wliao

回复  wliao

请问你这是用什么软件测出来的？
Calven 发表于 2009-12-27 19:18

Sandboxie沙盘

piaosi

测这个毒，破了我的防御。

Calven

回复 4# wliao


    哦，知道了，谢谢啊

Calven

回复 2# wliao


    Sandboxie好象找不到什么地方能查看运行记录日志的呀

wliao

回复  wliao


    Sandboxie好象找不到什么地方能查看运行记录日志的呀
Calven 发表于 2009-12-27 19:34

http://bbs.kafan.cn/redirect.php ... 11&pid=10116129这里有沙盘分析软件

O(∩_∩)O哈哈~

to avast!

Calven

回复 8# wliao

很感谢！从来没注意过这个，谢谢你！