★★★发一个超牛的恶意软件加病毒，轻松过微点和瑞星。（已发至搜狐网盘，115网盘）

fatezero

TO KL

ablhr

上报费尔

johnboy888

avast悲剧啊,没反应

帅的请自觉罚站

毒霸 killed

jk58639844

A2秒了

jefffire

lZ被一群扫描党围攻了，悲剧

hddu

2010-07-30 23:12:40    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\All Users\Application Data\wangdun\KSWebShield.exe
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\Application Data\*.exe

2010-07-30 23:12:40    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\All Users\Application Data\wangdun\u.bat
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*.bat

2010-07-30 23:12:41    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\nse2.tmp\ns3.tmp
文件路径:C:\WINDOWS\system32\conime.exe
触发规则:所有程序规则->系统程序设置->*\conime.exe

2010-07-30 23:12:41    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\nse2.tmp\ns3.tmp
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c  "C:\Documents and Settings\All Users\Application Data\wangdun\u.bat"
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe

2010-07-30 23:12:41    删除文件      操作:允许
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\Documents and Settings\All Users\Application Data\wangdun\u.bat
触发规则:应用程序规则->系统程序->%windir%\system32\cmd.exe->*\*.bat

2010-07-30 23:12:41    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\WINDOWS\system32\tb.ico
触发规则:所有程序规则->WINDOWS文件夹全局阻止设置（一）->%windir%\*.ico

2010-07-30 23:12:41    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\WINDOWS\system32\xyx.ico
触发规则:所有程序规则->WINDOWS文件夹全局阻止设置（一）->%windir%\*.ico

2010-07-30 23:12:41    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\WINDOWS\system32\ie.ico
触发规则:所有程序规则->WINDOWS文件夹全局阻止设置（一）->%windir%\*.ico

2010-07-30 23:12:41    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\All Users\桌面\在线小游戏.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\桌面\*.url

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\All Users\桌面\在线小游戏.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\桌面\*.url

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\All Users\桌面\在线小游戏.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\桌面\*.url

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\All Users\桌面\网上淘宝.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\桌面\*.url

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\All Users\桌面\网上淘宝.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\桌面\*.url

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\All Users\桌面\网上淘宝.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\桌面\*.url

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\链接\88yy在线小游戏.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\Favorites\*

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\链接\艾迪深度搜索.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\Favorites\*

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\链接\十一街单机游戏.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\Favorites\*

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\链接\淘宝特卖.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\Favorites\*

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\链接\团购_秒杀网.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\Favorites\*

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\链接\在线言情小说阅读.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\Favorites\*

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\88yy在线小游戏.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\Favorites\*

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\艾迪深度搜索.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\Favorites\*

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\十一街单机游戏.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\Favorites\*

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\淘宝特卖.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\Favorites\*

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\团购_秒杀网.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\Favorites\*

2010-07-30 23:12:42    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\在线言情小说阅读.url
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\Favorites\*

2010-07-30 23:12:46    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\Program Files\Internet Explorer\IEXPLORE.EXE
命令行: -nohome
触发规则:所有程序规则->非系统进程操作 ->%ProgramFiles%\Internet Explorer\iexplore.exe

2010-07-30 23:12:49    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c ping 127.0.0.1 -n 6 & del "C:\Documents and Settings\Administrator\Local Settings\Temp\RarSFX0\tianjbao17.exe"
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe

2010-07-30 23:12:55    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*

2010-07-30 23:12:56    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器\unins000.exe
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*.exe

2010-07-30 23:12:56    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器\unins000.exe
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*.exe

2010-07-30 23:12:56    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器\JJBrowser.exe
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*.exe

2010-07-30 23:12:56    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器\JJBrowser.exe
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*.exe

2010-07-30 23:12:57    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器\JJBrowser.exe
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*.exe

2010-07-30 23:12:57    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器\JJBrowser.exe
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*.exe

2010-07-30 23:12:58    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器\Plugin\SnapShot\CameraDll.dll
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*.dll

2010-07-30 23:12:58    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器\Plugin\SnapShot\CameraDll.dll
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*.dll

2010-07-30 23:12:58    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器\Plugin\SnapShot\SnapShot.exe
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*.exe

2010-07-30 23:12:58    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器\Plugin\SnapShot\SnapShot.exe
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*.exe

2010-07-30 23:12:58    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器\Plugin\Tools\QuickMute.exe
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*.exe

2010-07-30 23:12:58    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器\Plugin\Tools\QuickMute.exe
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*.exe

2010-07-30 23:12:58    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器\Plugin\Tools\QuickProcess.exe
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*.exe

2010-07-30 23:12:58    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器\Plugin\Tools\QuickProcess.exe
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*.exe

2010-07-30 23:12:58    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器\Plugin\Tools\QuickTools.exe
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*.exe

2010-07-30 23:12:58    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Program Files\安全浏览器\Plugin\Tools\QuickTools.exe
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*.exe

2010-07-30 23:13:02    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\安全浏览器
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\*菜单\*

2010-07-30 23:13:05    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\安全浏览器\4224安全浏览器.lnk
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\*菜单\*

2010-07-30 23:13:07    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Documents and Settings\All Users\桌面\安全浏览器.lnk
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\桌面\*.lnk

2010-07-30 23:13:08    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Documents and Settings\All Users\Templates\安全浏览器.lnk
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\Templates\*

2010-07-30 23:13:12    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-1ERCB.tmp\b.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\安全浏览器.lnk
触发规则:所有程序规则->Documents and Settings文件夹设置（二）->?:\Documents and Settings\*\*菜单\*.lnk

liu5678

下载过后金山网盾就直接拦截了，连压缩包一起被删除了，尸体都没留下。

猪头大队

过SEP,上报铁壳中

kagebaby

杯具了，KIS2011过了~~