setup_GPNSqanK.exe[7a0326]

显示全部楼层 · 发表于 2010-9-29 19:33:34

本帖最后由 XE-cj 于 2010.9.29 19:39 编辑

2010-9-29 19:31:27 创建新进程允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\xe-cj\my documents\setup_gpnsqank.exe
命令行: "C:\Documents and Settings\XE-CJ\My Documents\setup_GPNSqanK.exe"
规则: [应用程序]c:\windows\explorer.exe

2010-9-29 19:31:28 创建文件允许
进程: c:\documents and settings\xe-cj\my documents\setup_gpnsqank.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\~DFC096.tmp
规则: [文件]*

2010-9-29 19:31:30 创建文件允许
进程: c:\documents and settings\xe-cj\my documents\setup_gpnsqank.exe
目标: C:\WH6T1.exe
规则: [文件组]全局FD -> [文件]?:\; *.exe

2010-9-29 19:31:31 设置文件隐藏属性允许
进程: c:\documents and settings\xe-cj\my documents\setup_gpnsqank.exe
目标: C:\WH6T1.exe
规则: [文件组]全局FD -> [文件]?:\; *.exe

2010-9-29 19:31:32 创建新进程允许
进程: c:\documents and settings\xe-cj\my documents\setup_gpnsqank.exe
目标: c:\wh6t1.exe
命令行: C:\WH6T1.exe
规则: [应用程序]*

2010-9-29 19:31:41 创建新进程阻止
进程: c:\wh6t1.exe
目标: c:\windows\system32\cmd.exe
命令行: cmd.exe /c ipconfig /all > c:\WINDOWS\Temp\2020.tmp
规则: [应用程序]*

2010-9-29 19:31:43 创建文件允许
进程: c:\documents and settings\xe-cj\my documents\setup_gpnsqank.exe
目标: C:\714SVY.exe
规则: [文件组]全局FD -> [文件]?:\; *.exe

2010-9-29 19:31:44 设置文件隐藏属性允许
进程: c:\documents and settings\xe-cj\my documents\setup_gpnsqank.exe
目标: C:\714SVY.exe
规则: [文件组]全局FD -> [文件]?:\; *.exe

2010-9-29 19:31:45 创建新进程允许
进程: c:\documents and settings\xe-cj\my documents\setup_gpnsqank.exe
目标: c:\714svy.exe
命令行: C:\714SVY.exe
规则: [应用程序]*

2010-9-29 19:31:52 创建文件允许
进程: c:\documents and settings\xe-cj\my documents\setup_gpnsqank.exe
目标: C:\Documents and Settings\XE-CJ\My Documents\gwhs.bak.vbs
规则: [文件组]临时目录 -> [文件]c:\documents and settings\xe-cj\my documents

2010-9-29 19:31:53 创建新进程阻止
进程: c:\documents and settings\xe-cj\my documents\setup_gpnsqank.exe
目标: c:\windows\system32\wscript.exe
命令行: WScript.Exe gwhs.bak.vbs
规则: [应用程序]*

显示全部楼层 · 发表于 2010-9-29 20:18:36

显示全部楼层 · 发表于 2010-9-29 20:47:38

to avast!

显示全部楼层 · 发表于 2010-9-30 00:40:52

过诺顿2011

显示全部楼层 · 发表于 2010-9-30 11:29:27

拦截

显示全部楼层 · 发表于 2010-9-30 21:06:32

sonar干掉

显示全部楼层 · 发表于 2010-10-1 21:01:33

咖啡 Artemis!FF5CC5813ABA (特洛伊)

显示全部楼层 · 发表于 2010-10-2 00:39:02

WIN32/VB.phc变种---EAV

显示全部楼层 · 发表于 2010-10-2 06:44:00

瑞星表现不错

[可疑文件] setup_GPNSqanK.exe[7a0326]