setup(1).exe

显示全部楼层 · 发表于 2010-12-6 17:42:52

2010-12-6 17:40:32 创建新进程允许
进程: c:\windows\explorer.exe
目标: d:\我的文档\viurs test\setup(1)\setup(1).exe
命令行: "D:\我的文档\viurs test\setup(1)\setup(1).exe"
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]d:\我的文档\*

2010-12-6 17:40:34 创建新进程允许
进程: d:\我的文档\viurs test\setup(1)\setup(1).exe
目标: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-U8V6T.tmp\setup(1).tmp" /SL5="$4C051E,110299,54272,D:\我的文档\viurs test\setup(1)\setup(1).exe"
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]?:\documents and settings\*\local settings\temp\*

2010-12-6 17:40:36 创建文件允许
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\is-J21SC.tmp\_isetup\_shfoldr.dll
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.dll

2010-12-6 17:40:38 修改注册表值阻止
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Programs
值: C:\Documents and Settings\Administrator\「开始」菜单\程序
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-6 17:40:41 修改注册表值阻止
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Programs
值: C:\Documents and Settings\All Users\「开始」菜单\程序
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-6 17:40:43 创建文件夹阻止
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: C:\Program Files\guawawa
规则: [文件组]全局写入询问 -> [文件]?:\program files\*

2010-12-6 17:40:48 修改注册表值阻止
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Desktop
值: C:\Documents and Settings\All Users\桌面
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-6 17:40:48 修改注册表值阻止
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttctype\shell\open\command
值: F:\PROGRA~1\MOZILL~1\firefox.exe
规则: [注册表组]文件关联设置 -> [注册表]*\Classes\*\shell\*\command*

2010-12-6 17:40:48 修改注册表值阻止
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\type\shell\open\command
值: rundll32.exe "C:\Program Files\guawawa\erp.ee" erp
规则: [注册表组]文件关联设置 -> [注册表]*\Classes\*\shell\*\command*

2010-12-6 17:40:49 修改注册表值阻止
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-6 17:40:49 修改注册表值阻止
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-6 17:40:50 创建新进程阻止
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: c:\windows\system32\rundll32.exe
命令行: "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\guawawa\uid.uu" uid
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]c:\windows\*

2010-12-6 17:40:51 创建新进程阻止
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: c:\windows\system32\rundll32.exe
命令行: "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\guawawa\mpc.mm" mpc
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]c:\windows\*

2010-12-6 17:40:52 创建新进程阻止
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: c:\windows\system32\rundll32.exe
命令行: "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\guawawa\gsu.gg" gsu
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]c:\windows\*

2010-12-6 17:40:52 创建新进程阻止
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: c:\windows\system32\rundll32.exe
命令行: "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\guawawa\cycle.dll" openUrl
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]c:\windows\*

2010-12-6 17:40:53 删除文件阻止
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\is-J21SC.tmp\_isetup\_shfoldr.dll
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.dll

2010-12-6 17:40:54 删除文件阻止
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\is-J21SC.tmp\_isetup\_shfoldr.dll
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.dll

2010-12-6 17:40:54 删除文件阻止
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\is-J21SC.tmp\_isetup\_shfoldr.dll
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.dll

2010-12-6 17:40:55 删除文件阻止
进程: c:\documents and settings\administrator\local settings\temp\is-u8v6t.tmp\setup(1).tmp
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\is-J21SC.tmp\_isetup\_shfoldr.dll
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.dll

显示全部楼层 · 发表于 2010-12-6 18:15:39

金山卫士就报，没微点啥事

LZ实机试毒，本来就是玩火，什么防护也不敢实机尝试

显示全部楼层 · 发表于 2010-12-6 19:09:59

2010-12-6 19:07:24 读文件夹阻止
进程: i:\virus\setup(1).exe
目标: I:\virus
规则: [文件]*

2010-12-6 19:07:24 读文件夹阻止
进程: i:\virus\setup(1).exe
目标: C:\WINDOWS
规则: [文件]*

2010-12-6 19:07:24 读文件夹阻止
进程: i:\virus\setup(1).exe
目标: C:
规则: [文件]*

2010-12-6 19:07:24 读文件夹阻止
进程: i:\virus\setup(1).exe
目标: C:
规则: [文件]*

2010-12-6 19:07:24 创建新进程阻止
进程: i:\virus\setup(1).exe
目标: c:\documents and settings\administrator\local settings\temp\is-f883e.tmp\setup(1).tmp
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-F883E.tmp\setup(1).tmp" /SL5="$120CE0,110299,54272,I:\virus\setup(1).exe"
规则: [应用程序]*

显示全部楼层 · 发表于 2010-12-6 20:54:25

下载文件：setup(1).rar
木马名称：Win32.Troj.Adware.rj.(kclou...
这个木马可能破坏您的电脑系统，窃取账号密码

保存路径：C:\Documents and Settings\Admini...
下载工具：谷歌浏览器

显示全部楼层 · 发表于 2010-12-6 20:57:42

to avg

显示全部楼层 · 发表于 2010-12-6 22:37:07

已上報趨勢嚕~

显示全部楼层 · 发表于 2010-12-8 17:04:47

金山毒霸干掉

显示全部楼层 · 发表于 2010-12-8 17:14:28

360 WD 拦截

显示全部楼层 · 发表于 2010-12-9 11:35:00

fatezero 发表于 2010-12-6 13:34
3/43 (7.0%)

流氓软件一个，意思不大。

显示全部楼层 · 发表于 2010-12-9 12:00:40

微点主防可牛抽风

毒霸杀之

[可疑文件] setup(1).exe