setup.exe

左手

2010-11-15 08:07:44    读文件    阻止
进程: c:\documents and settings\administrator\桌面\test\setup.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-15 08:07:44    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\test\setup.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-15 08:07:45    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\test\setup.exe
目标: C:\Documents and Settings\Administrator\Application Data\Tencent\QQWubi\local.stat
规则: [文件]*

2010-11-15 08:08:07    读文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-15 08:08:07    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-15 08:08:07    向其他进程发送消息    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: c:\documents and settings\administrator\桌面\test\setup.exe
消息: 0x0496
规则: [应用程序]*

2010-11-15 08:08:07    读文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-15 08:08:07    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: UDP [本机 : 1384] ->  [61.191.63.9 : 8901]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-11-15 08:08:58    创建注册表项    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_LOCAL_MACHINE\SOFTWARE\ATI
规则: [注册表]*

2010-11-15 08:08:58    创建注册表项    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_LOCAL_MACHINE\SOFTWARE\ATI
规则: [注册表]*

2010-11-15 08:08:58    创建注册表项    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_LOCAL_MACHINE\SOFTWARE\ATI
规则: [注册表]*

2010-11-15 08:08:58    创建注册表项    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_LOCAL_MACHINE\SOFTWARE\ATI
规则: [注册表]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
规则: [注册表]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1\CacheLimit
值: 0x00007d04(32004)
规则: [注册表]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-15 08:08:58    读文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-15 08:08:58    读文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-15 08:08:58    读文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-15 08:08:58    修改文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: C:\WINDOWS\Debug\UserMode\userenv.log
规则: [文件]*

2010-11-15 08:08:58    修改文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: C:\WINDOWS\Debug\UserMode\userenv.log
规则: [文件]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData
值: C:\Documents and Settings\All Users\Application Data
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-15 08:08:58    读文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-15 08:08:58    读文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-15 08:08:58    修改文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: C:\WINDOWS\Debug\UserMode\userenv.log
规则: [文件]*

2010-11-15 08:08:58    修改文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: C:\WINDOWS\Debug\UserMode\userenv.log
规则: [文件]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy
值: 0x00000001(1)
规则: [注册表]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
值: 0x00000000(0)
规则: [注册表]*

2010-11-15 08:08:58    删除注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
规则: [注册表]*

2010-11-15 08:08:58    删除注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
规则: [注册表]*

2010-11-15 08:08:58    删除注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
规则: [注册表]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable
值: 0x00000000(0)
规则: [注册表]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
值: 3c 00 00 00 94 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 10 10 52 15 fd d6 ca 01 01 00 00 00 c0 a8 01 74 00 00 00 00 00 00 00 00
规则: [注册表]*

2010-11-15 08:08:58    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: TCP [本机 : 1385] ->  [122.228.197.162 : 21000]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-11-15 08:08:58    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: TCP [本机 : 1386] ->  [61.191.63.7 : 21000]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-11-15 08:08:58    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: TCP [本机 : 1387] ->  [122.225.196.140 : 21000]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-11-15 08:08:58    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: TCP [本机 : 1388] ->  [122.225.196.219 : 21000]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-11-15 08:08:58    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: C:\Program Files\Common Files\DcomServer\DcomServer.exe
规则: [文件组][S]系统文件夹 -> [文件]?:\program files\*\*; *.exe

2010-11-15 08:08:58    读文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: \Device\NamedPipe\wkssvc
规则: [文件]*

2010-11-15 08:08:58    读文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-15 08:08:58    读文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-15 08:08:58    读文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: \Device\NamedPipe\lsarpc
规则: [文件]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ee1312a2-42ee-11df-9422-806d6172696f}\BaseClass
值: Drive
规则: [注册表]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ee1312a3-42ee-11df-9422-806d6172696f}\BaseClass
值: Drive
规则: [注册表]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ee1312a5-42ee-11df-9422-806d6172696f}\BaseClass
值: Drive
规则: [注册表]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ee1312a4-42ee-11df-9422-806d6172696f}\BaseClass
值: Drive
规则: [注册表]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ee1312a6-42ee-11df-9422-806d6172696f}\BaseClass
值: Drive
规则: [注册表]*

2010-11-15 08:08:58    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: TCP [本机 : 1389] ->  [122.228.197.162 : 21000]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-11-15 08:08:58    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: TCP [本机 : 1390] ->  [61.191.63.7 : 21000]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-11-15 08:08:58    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: TCP [本机 : 1391] ->  [122.225.196.140 : 21000]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-11-15 08:08:58    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: TCP [本机 : 1392] ->  [122.225.196.219 : 21000]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal
值: C:\Documents and Settings\Administrator\My Documents
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Documents
值: C:\Documents and Settings\All Users\Documents
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop
值: C:\Documents and Settings\Administrator\桌面
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Desktop
值: C:\Documents and Settings\All Users\桌面
规则: [注册表组]注册表保护 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
值: 0x00000001(1)
规则: [注册表]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
值: 0x00000001(1)
规则: [注册表]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000001(1)
规则: [注册表]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
值: 0x00000001(1)
规则: [注册表]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
值: 0x00000001(1)
规则: [注册表]*

2010-11-15 08:08:58    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000001(1)
规则: [注册表]*

2010-11-15 08:08:59    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\LangID
值: 04 08
规则: [注册表]*

2010-11-15 08:08:59    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-L9U5M.tmp/aNqPxXZr.exe
值: aNqPxXZr
规则: [注册表]*

2010-11-15 08:08:59    修改文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-a6his.tmp\setup.tmp
目标: C:\Documents and Settings\Administrator\Application Data\Tencent\QQWubi\local.stat
规则: [文件]*

猪头大队

过VSE，360网盾未知

hansyu

miss,to xandora(panda)

hadg

膜拜楼主啊！竟然几乎完美（网盾未知）过360的同时，还能免杀一部分杀软。
to 360