转自vc52

wliao

2010-8-8 11:00:53    创建新进程    允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\owner\my documents\setup.exe
命令行: "C:\Documents and Settings\Owner\My Documents\setup.exe"
规则: [应用程序]c:\windows\explorer.exe

2010-8-8 11:00:57    创建文件    允许
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temp\nsc5.tmp
规则: [文件]*

2010-8-8 11:00:59    创建文件    允许
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temp\taobao.ico
规则: [文件]*

2010-8-8 11:01:01    创建文件    允许
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temp\batink.bat
规则: [文件组]临时目录 -> [文件]c:\documents and settings\owner\local settings\temp; *.bat

2010-8-8 11:01:03    创建文件    允许
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temp\innorun.dll
规则: [文件组]临时目录 -> [文件]c:\documents and settings\owner\local settings\temp; *.dll

2010-8-8 11:01:05    创建文件    允许
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temp\nsp6.tmp
规则: [文件]*

2010-8-8 11:01:07    创建文件夹    允许
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temp\nsp6.tmp
规则: [文件]*

2010-8-8 11:01:09    创建文件    允许
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temp\nsp6.tmp\System.dll
规则: [文件组]所有执行文件 -> [文件]*; *.dll

2010-8-8 11:01:12    创建文件夹    允许
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\Favorites\常用
规则: [文件]*

2010-8-8 11:01:17    创建文件    阻止
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temp\特价-淘宝网.Html
规则: [文件]*

2010-8-8 11:01:20    创建文件    阻止
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\桌面\特价-淘宝网.hbk
规则: [文件]*

2010-8-8 11:01:24    删除文件    阻止
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\桌面\opera.exe.lnk
规则: [文件组]临时目录 -> [文件]*; *.lnk

2010-8-8 11:01:28    创建文件    阻止
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\桌面\opera.exe.hbk
规则: [文件]*

2010-8-8 11:01:32    删除文件    阻止
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\All Users\桌面\Mozilla Firefox.lnk
规则: [文件组]临时目录 -> [文件]*; *.lnk

2010-8-8 11:01:35    创建文件    阻止
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\All Users\桌面\Mozilla Firefox.hbk
规则: [文件]*

2010-8-8 11:01:39    删除文件    阻止
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
规则: [文件组]临时目录 -> [文件]*; *.lnk

2010-8-8 11:01:42    创建文件    阻止
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.hbk
规则: [文件]*

2010-8-8 11:01:45    删除文件    阻止
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk
规则: [文件组]临时目录 -> [文件]*; *.lnk

2010-8-8 11:01:48    创建文件    阻止
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.hbk
规则: [文件]*

2010-8-8 11:01:51    创建文件    允许
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Program Files\Internet Explorer\SIGNUP\iexplore.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2010-8-8 11:01:55    修改注册表值    阻止
进程: c:\documents and settings\owner\my documents\setup.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\Shell\Open\Command
值: C:\Program Files\Internet Explorer\SIGNUP\iexplore.exe http://www.360000000000.net/yx.html
规则: [注册表组]系统设置 -> [注册表]HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\command

2010-8-8 11:01:59    创建新进程    阻止
进程: c:\documents and settings\owner\my documents\setup.exe
目标: c:\windows\system32\cmd.exe
命令行: cmd /c ""C:\DOCUME~1\Owner\LOCALS~1\Temp\batink.bat" "
规则: [应用程序]*

2010-8-8 11:02:16    向其他进程发送消息    允许
进程: c:\documents and settings\owner\my documents\setup.exe
目标: c:\program files\mozilla firefox\firefox.exe
消息: WM_DDE_EXECUTE
规则: [应用程序]*

2010-8-8 11:02:19    访问网络    允许
进程: c:\documents and settings\owner\my documents\setup.exe
目标: TCP [本机 : 1210] ->  [122.224.9.113 : 8022]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-8-8 11:02:28    创建文件    允许
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\08VPR437\Insertbz[1].htm
规则: [文件]*

2010-8-8 11:02:29    删除文件    允许
进程: c:\documents and settings\owner\my documents\setup.exe
目标: C:\Documents and Settings\Owner\Local Settings\Temp\nsp6.tmp\System.dll
规则: [文件组]所有执行文件 -> [文件]*; *.dll

2342366

金山杯具帝