网通客户端文件，微点、42%杀软报毒

Hantaool

我这的微点没有报毒 啊

baixiliang

360SD未报，不是病毒吧？

zuo

2010-12-11 11:28:24    删除注册表值    阻止
进程: c:\program files\winrar\winrar.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@explorer.exe,-7024
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache; @*

2010-12-11 11:28:24    修改注册表值    阻止
进程: c:\program files\winrar\winrar.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\LangID
值: 04 08
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2010-12-11 11:28:33    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usrat.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-11 11:28:34    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usrat.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2010-12-11 11:28:34    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usrat.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2010-12-11 11:28:34    删除注册表值    阻止
进程: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usrat.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@explorer.exe,-7024
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache; @*

2010-12-11 11:28:34    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usrat.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\LangID
值: 04 08
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2010-12-11 11:28:34    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usrat.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@xpsp3res.dll,-20001
值: 诊断连接问题...
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache; @*

2010-12-11 11:28:35    从其他进程复制句柄    阻止
进程: c:\windows\system32\svchost.exe
目标: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usrat.exe
句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
规则: [应用程序]c:\windows\system32\svchost.exe

2010-12-11 11:28:35    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usrat.exe
目标: TCP [本机 : 1255] ->  [202.102.110.204 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-11 11:28:35    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usrat.exe
目标: TCP [本机 : 1256] ->  [202.111.128.122 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-11 11:28:55    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usratex.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-11 11:28:55    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usratex.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2010-12-11 11:28:56    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usratex.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2010-12-11 11:28:57    删除注册表值    阻止
进程: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usratex.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@explorer.exe,-7024
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache; @*

2010-12-11 11:28:57    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usratex.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\LangID
值: 04 08
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2010-12-11 11:28:57    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usratex.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@xpsp3res.dll,-20001
值: 诊断连接问题...
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache; @*

2010-12-11 11:28:58    从其他进程复制句柄    阻止
进程: c:\windows\system32\svchost.exe
目标: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usratex.exe
句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
规则: [应用程序]c:\windows\system32\svchost.exe

2010-12-11 11:28:58    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usratex.exe
目标: TCP [本机 : 1258] ->  [202.102.110.204 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-11 11:28:58    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\微点报42%报毒\新建文件夹 (2)\usratex.exe
目标: TCP [本机 : 1259] ->  [202.111.128.122 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

久远寺有珠

介个和我的联通客户端不一样...