红伞等报毒

zplju1

jason_jiang

启发，to xandora(panda)

hj5abc

FS.

天璇诛仙

clear.rar;已删除;Win32.Troj.Malice.dr.(kcloud);2010-08-14 16: 56;
金山网盾下载保护···

submit to mcafee

jayavira

to eset

http://samples.nod32.com.sg/inde ... 1cfaea0b7c0dc4b0b89

zyx1996

avast报毒！连页面都没打开！

jinliang5000

XE-cj

2010-8-14 21:31:38    创建新进程    允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\xe-cj\my documents\clear.exe
命令行: "C:\Documents and Settings\XE-CJ\My Documents\clear.exe"
规则: [应用程序]c:\windows\explorer.exe

2010-8-14 21:31:39    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\clear.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\~16.tmp
规则: [文件]*

2010-8-14 21:31:41    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\clear.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\~16.bat
规则: [文件组]临时目录 -> [文件]c:\documents and settings\xe-cj\local settings\temp; *.bat

2010-8-14 21:31:44    设置文件隐藏属性    阻止
进程: c:\documents and settings\xe-cj\my documents\clear.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\~16.bat
规则: [文件组]临时目录 -> [文件]c:\documents and settings\xe-cj\local settings\temp; *.bat

2010-8-14 21:31:47    创建新进程    阻止
进程: c:\documents and settings\xe-cj\my documents\clear.exe
目标: c:\windows\system32\cmd.exe
命令行: cmd.exe /c C:\DOCUME~1\XE-CJ\LOCALS~1\Temp\~16.bat "C:\Documents and Settings\XE-CJ\My Documents\clear.exe"
规则: [应用程序]*


~16.bat

@shift
cls
@echo off

if exist "C:\Program Files\soft\SoftInstMgr.exe" "C:\Program Files\soft\SoftInstMgr.exe"
del "%HOMEPATH%\Local Settings\Temp\*.*" /q /f
del C:\WINDOWS\main\*.* /q /f
rd /s /q C:\WINDOWS\main
del /a /f /q %0