x1，avast!,卫士侦测

alva0203

毒霸kill..

星晨

BitDefender上报

hddu

2010-11-30 18:49:10    创建文件      操作:允许
进程路径:F:\virus\insetup_rsdown\insetup_rsdown.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Application Data\In.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Local Settings\Application Data\*

2010-11-30 18:49:10    创建文件      操作:允许
进程路径:F:\virus\insetup_rsdown\insetup_rsdown.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Application Data\deskstock.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Local Settings\Application Data\*

2010-11-30 18:49:10    运行应用程序      操作:允许
进程路径:F:\virus\insetup_rsdown\insetup_rsdown.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~16.bat "F:\virus\insetup_rsdown\insetup_rsdown.exe"
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe

2010-11-30 18:49:21    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Application Data\deskstock.exe
文件路径:C:\Program Files\DeskStock\DeskStock.exe
触发规则:应用程序规则->Documents and Settings文件夹设置->?:\Documents and Settings\*\Application Data\*.exe->%ProgramFiles%\*.exe

2010-11-30 18:49:24    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Application Data\deskstock.exe
文件路径:C:\Program Files\DeskStock\up.exe
触发规则:应用程序规则->Documents and Settings文件夹设置->?:\Documents and Settings\*\Application Data\*.exe->%ProgramFiles%\*.exe

2010-11-30 18:49:25    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Application Data\deskstock.exe
文件路径:C:\Documents and Settings\Administrator\「开始」菜单\程序\桌面股票
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\*

2010-11-30 18:49:26    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Application Data\deskstock.exe
文件路径:C:\Documents and Settings\Administrator\「开始」菜单\程序\桌面股票\桌面股票.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk

2010-11-30 18:49:27    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Application Data\deskstock.exe
文件路径:C:\Documents and Settings\Administrator\桌面\桌面股票.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\桌面\*.lnk

2010-11-30 18:49:28    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Application Data\deskstock.exe
文件路径:C:\Documents and Settings\Administrator\「开始」菜单\程序\桌面股票\Website.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk

2010-11-30 18:49:30    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Application Data\deskstock.exe
文件路径:C:\Documents and Settings\Administrator\「开始」菜单\程序\桌面股票\Uninstall.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk

2010-11-30 18:49:31    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Application Data\deskstock.exe
文件路径:C:\Program Files\DeskStock\uninst.exe
触发规则:应用程序规则->Documents and Settings文件夹设置->?:\Documents and Settings\*\Application Data\*.exe->%ProgramFiles%\*.exe

2010-11-30 18:49:34    创建文件      操作:阻止
进程路径:C:\Program Files\DeskStock\DeskStock.exe
文件路径:C:\WINDOWS\system32\SkinH_EL.dll
触发规则:应用程序规则->%ProgramFiles%文件设置->%ProgramFiles%\*.exe->%windir%\*.dll

2010-11-30 18:49:34    创建文件      操作:允许
进程路径:C:\Program Files\DeskStock\DeskStock.exe
文件路径:C:\Program Files\DeskStock\SkinH_EL.dll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.dll

2010-11-30 18:49:41    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\WINDOWS\system32\mshta.exe
命令行:vbscript:createobject("wscript.shell").run("""iexplore""http://stat.02933.com/info.mssql/?stat_rsdown",0)(window.close)
触发规则:所有程序规则->系统程序设置->*\mshta.exe

2010-11-30 18:49:41    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\WINDOWS\system32\sc.exe
命令行:config Schedule start= auto
触发规则:所有程序规则->系统程序设置->%windir%\system32\sc.exe

2010-11-30 18:49:41    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\WINDOWS\system32\net.exe
命令行:start "Task Scheduler"
触发规则:所有程序规则->系统程序设置->%windir%\system32\net*.exe

2010-11-30 18:49:43    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\Program Files\Internet Explorer\iexplore.exe
命令行: http://www.07396.com/index2.html?rsdown
触发规则:所有程序规则->非系统进程操作 ->%ProgramFiles%\Internet Explorer\iexplore.exe

2010-11-30 18:49:44    运行应用程序      操作:阻止并结束进程
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\WINDOWS\system32\at.exe
命令行:17:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday  "C:\Documents and Settings\Administrator\Application Data\kwd\ksafe.exe" -install
触发规则:所有程序规则->系统程序设置->%windir%\system32\at.exe

KOI9009

360 WD 拦截

O(∩_∩)O哈哈~

病毒名： Trojan-Dropper
建议： 保存并删除
特征Id: 47124691

--by ikarus

s8706042

已上報趨勢~

qiuzhen1976

EAV杀

hansyu

panda
Trj/CI.A

sound886

AVG确实可以让人放心
哈哈

歌歌的人