BDS/Pcclient.BR.177——（14/42）

O(∩_∩)O哈哈~

a369258147

langzi2009

hx1997

Avira detected.

XE-cj

2010-7-29 21:39:23    创建新进程    允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\xe-cj\my documents\nsetup[1].exe
命令行: "C:\Documents and Settings\XE-CJ\My Documents\nsetup[1].exe"
规则: [应用程序]c:\windows\explorer.exe

2010-7-29 21:39:28    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\nsetup[1].exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\~5E.tmp
规则: [文件]*

2010-7-29 21:39:31    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\nsetup[1].exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\~5E.bat
规则: [文件组]临时目录 -> [文件]c:\documents and settings\xe-cj\local settings\temp; *.bat

2010-7-29 21:39:32    设置文件隐藏属性    阻止
进程: c:\documents and settings\xe-cj\my documents\nsetup[1].exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\~5E.bat
规则: [文件组]临时目录 -> [文件]c:\documents and settings\xe-cj\local settings\temp; *.bat

2010-7-29 21:39:34    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\nsetup[1].exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Application Data\wl0419152.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2010-7-29 21:39:37    创建新进程    阻止
进程: c:\documents and settings\xe-cj\my documents\nsetup[1].exe
目标: c:\windows\system32\cmd.exe
命令行: cmd.exe /c C:\DOCUME~1\XE-CJ\LOCALS~1\Temp\~5E.bat "C:\Documents and Settings\XE-CJ\My Documents\nsetup[1].exe"
规则: [应用程序]*

尤金卡巴斯基

To KL

jayavira

to eset

http://samples.nod32.com.hk/inde ... 0f04f49d6910f528e17

gbs0856

MSE