spm1.exe

Sherry.ai

spm1.exe

jason_jiang

启发，to xandora(panda)

jayavira

ess kill

   Win32/Kryptik.FYY 特洛伊木马 的变种

hj5abc

FS
Trojan.Generic.KD.26719

mcafee artemis!

恋亿晓

to avast!

XE-cj

2010-8-15 10:08:46    创建新进程    允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\xe-cj\my documents\spm1.exe
命令行: "C:\Documents and Settings\XE-CJ\My Documents\spm1.exe"
规则: [应用程序]c:\windows\explorer.exe

2010-8-15 10:08:49    创建文件夹    允许
进程: c:\documents and settings\xe-cj\my documents\spm1.exe
目标: C:\Documents and Settings\XE-CJ\Application Data\Tyaza
规则: [文件]*

2010-8-15 10:08:51    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\spm1.exe
目标: C:\Documents and Settings\XE-CJ\Application Data\Tyaza\ornia.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2010-8-15 10:08:52    创建文件夹    允许
进程: c:\documents and settings\xe-cj\my documents\spm1.exe
目标: C:\Documents and Settings\XE-CJ\Application Data\Idgac
规则: [文件]*

2010-8-15 10:08:54    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\spm1.exe
目标: C:\Documents and Settings\XE-CJ\Application Data\Idgac\doviw.koz
规则: [文件]*

2010-8-15 10:08:57    修改文件    允许
进程: c:\documents and settings\xe-cj\my documents\spm1.exe
目标: C:\Documents and Settings\XE-CJ\Application Data\Tyaza\ornia.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2010-8-15 10:08:59    创建新进程    允许
进程: c:\documents and settings\xe-cj\my documents\spm1.exe
目标: c:\documents and settings\xe-cj\application data\tyaza\ornia.exe
命令行: "C:\Documents and Settings\XE-CJ\Application Data\Tyaza\ornia.exe"
规则: [应用程序]*

2010-8-15 10:09:02    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\spm1.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\tmp9f6daa0a.bat
规则: [文件组]临时目录 -> [文件]c:\documents and settings\xe-cj\local settings\temp; *.bat

2010-8-15 10:09:03    修改文件    允许
进程: c:\documents and settings\xe-cj\my documents\spm1.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\tmp9f6daa0a.bat
规则: [文件组]临时目录 -> [文件]c:\documents and settings\xe-cj\local settings\temp; *.bat

2010-8-15 10:09:06    创建新进程    阻止
进程: c:\documents and settings\xe-cj\my documents\spm1.exe
目标: c:\windows\system32\cmd.exe
命令行: "C:\WINDOWS\system32\cmd.exe" /c "C:\DOCUME~1\XE-CJ\LOCALS~1\Temp\tmp9f6daa0a.bat"
规则: [应用程序]*

njjsxy

fatezero

TO KL

XMonster

D:\下载\spm1.rar=>spm1.exe        木马(Win32.Kryptik.FYY)        已删除