dg.exe

左手

这个是磁碟机？

2010-11-9 17:06:36    底层磁盘操作    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: \Device\Harddisk0\DR0
规则: [应用程序]*

2010-11-9 17:06:36    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: C:\Documents and Settings\Administrator\桌面\test\dg.exe
规则: [文件组]文件保护 -> [文件]c:\documents and settings\*\桌面\*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\12.tmp
规则: [注册表组]注册表保护 -> [注册表]*\System\*ControlSet*\Control\Session Manager\*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
规则: [注册表]*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1\CacheLimit
值: 0x00007d04(32004)
规则: [注册表]*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-9 17:06:36    读文件    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-9 17:06:36    读文件    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-9 17:06:36    读文件    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-9 17:06:36    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: C:\WINDOWS\Debug\UserMode\userenv.log
规则: [文件]*

2010-11-9 17:06:36    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: C:\WINDOWS\Debug\UserMode\userenv.log
规则: [文件]*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData
值: C:\Documents and Settings\All Users\Application Data
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-9 17:06:36    读文件    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-9 17:06:36    读文件    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-9 17:06:36    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: C:\WINDOWS\Debug\UserMode\userenv.log
规则: [文件]*

2010-11-9 17:06:36    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: C:\WINDOWS\Debug\UserMode\userenv.log
规则: [文件]*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
值: 0x00000000(0)
规则: [注册表]*

2010-11-9 17:06:36    删除注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
规则: [注册表]*

2010-11-9 17:06:36    删除注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
规则: [注册表]*

2010-11-9 17:06:36    删除注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
规则: [注册表]*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable
值: 0x00000000(0)
规则: [注册表]*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
值: 3c 00 00 00 09 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 10 10 52 15 fd d6 ca 01 01 00 00 00 c0 a8 01 74 00 00 00 00 00 00 00 00
规则: [注册表]*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000001(1)
规则: [注册表]*

2010-11-9 17:06:36    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: TCP [本机 : 2136] ->  [95.143.193.138 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-11-9 17:06:36    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: C:\Documents and Settings\Administrator\桌面\test\dg.exe
规则: [文件组]文件保护 -> [文件]c:\documents and settings\*\桌面\*

2010-11-9 17:06:36    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\dg.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\13.tmp
规则: [注册表组]注册表保护 -> [注册表]*\System\*ControlSet*\Control\Session Manager\*