误报率非常高的东西

woyoujj

瑞星报了

幻影bing

不知道怎么样，金山沙盒讲安全的

ppy0606

自己干自己...[:26:]




2010-12-16 18:47:45    创建新进程    允许
进程: c:\windows\explorer.exe
目标: d:\我的文档\viurs test\uninstall\uninstall.exe
命令行: "D:\我的文档\viurs test\Uninstall\Uninstall.exe"
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]d:\我的文档\*

2010-12-16 18:47:51    创建新进程    允许
进程: d:\我的文档\viurs test\uninstall\uninstall.exe
目标: c:\documents and settings\administrator\local settings\temp\tdu.tmp
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tdu.tmp"   _?=D:\我的文档\viurs test\Uninstall\
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]?:\documents and settings\*\local settings\temp\*

2010-12-16 18:47:53    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\tdu.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal
值: d:\我的文档
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-16 18:47:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\tdu.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Local AppData
值: C:\Documents and Settings\Administrator\Local Settings\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-16 18:47:56    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\tdu.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop
值: C:\Documents and Settings\Administrator\桌面
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-16 18:47:56    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\tdu.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Programs
值: C:\Documents and Settings\Administrator\「开始」菜单\程序
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-16 18:48:03    创建文件    允许
进程: c:\documents and settings\administrator\local settings\temp\tdu.tmp
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\nss44.tmp\detect.dll
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.dll

2010-12-16 18:48:04    创建文件    允许
进程: c:\documents and settings\administrator\local settings\temp\tdu.tmp
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\nss44.tmp\progress.dll
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.dll

2010-12-16 18:48:08    修改文件    允许
进程: c:\documents and settings\administrator\local settings\temp\tdu.tmp
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\nss44.tmp\detect.dll
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.dll

2010-12-16 18:48:13    创建文件    允许
进程: c:\documents and settings\administrator\local settings\temp\tdu.tmp
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\nss44.tmp\System.dll
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.dll

2010-12-16 18:48:20    删除文件    允许
进程: c:\documents and settings\administrator\local settings\temp\tdu.tmp
目标: D:\我的文档\viurs test\Uninstall\Uninstall.exe
规则: [文件组]Documents and Settings_阻止 -> [文件]d:\我的文档\*; *.exe

2010-12-16 18:48:37    删除文件    允许
进程: c:\documents and settings\administrator\local settings\temp\tdu.tmp
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\nss44.tmp\detect.dll
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.dll

2010-12-16 18:48:39    删除文件    允许
进程: c:\documents and settings\administrator\local settings\temp\tdu.tmp
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\nss44.tmp\progress.dll
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.dll

2010-12-16 18:48:40    删除文件    允许
进程: c:\documents and settings\administrator\local settings\temp\tdu.tmp
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\nss44.tmp\System.dll
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.dll

猪头大队

360网盾报了
红伞无视了

hitlefans

nod32 4.2报毒

listen1

红伞没有报
这个没有恶意行为

2010/12/16 19:07:22    创建文件    允许
进程: c:\users\listen\appdata\local\temp\tdu.tmp
目标: C:\Users\listen\AppData\Local\Temp\nsb49AF.tmp\detect.dll
规则: [应用程序]* -> [文件]c:\users\*\appdata\*\temp\*.tmp; *.dll

2010/12/16 19:07:26    创建文件    允许
进程: c:\users\listen\appdata\local\temp\tdu.tmp
目标: C:\Users\listen\AppData\Local\Temp\nsb49AF.tmp\progress.dll
规则: [应用程序]* -> [文件]c:\users\*\appdata\*\temp\*.tmp; *.dll

2010/12/16 19:07:44    修改文件    阻止
进程: c:\users\listen\appdata\local\temp\tdu.tmp
目标: C:\Users\listen\AppData\Local\Temp\nsb49AF.tmp\detect.dll
规则: [应用程序]* -> [文件]c:\users\*\appdata\*\temp\*.tmp; *.dll

2010/12/16 19:07:51    修改文件    阻止
进程: c:\users\listen\appdata\local\temp\tdu.tmp
目标: C:\Users\listen\AppData\Local\Temp\nsb49AF.tmp\detect.dll
规则: [应用程序]* -> [文件]c:\users\*\appdata\*\temp\*.tmp; *.dll

2010/12/16 19:08:15    创建文件    允许
进程: c:\users\listen\appdata\local\temp\tdu.tmp
目标: C:\Users\listen\AppData\Local\Temp\nsb49AF.tmp\System.dll
规则: [应用程序]* -> [文件]c:\users\*\appdata\*\temp\*.tmp; *.dll

2010/12/16 19:08:23    删除文件    允许
进程: c:\users\listen\appdata\local\temp\tdu.tmp
目标: D:\病毒测试\Uninstall\Uninstall.exe
规则: [文件组][A]所有执行文件 -> [文件]*; *.exe

2010/12/16 19:08:30    删除文件    允许
进程: c:\users\listen\appdata\local\temp\tdu.tmp
目标: C:\Users\listen\AppData\Local\Temp\nsb49AF.tmp\detect.dll
规则: [应用程序]* -> [文件]c:\users\*\appdata\*\temp\*.tmp; *.dll

2010/12/16 19:08:32    删除文件    允许
进程: c:\users\listen\appdata\local\temp\tdu.tmp
目标: C:\Users\listen\AppData\Local\Temp\nsb49AF.tmp\progress.dll
规则: [应用程序]* -> [文件]c:\users\*\appdata\*\temp\*.tmp; *.dll

2010/12/16 19:08:34    删除文件    允许
进程: c:\users\listen\appdata\local\temp\tdu.tmp
目标: C:\Users\listen\AppData\Local\Temp\nsb49AF.tmp\System.dll
规则: [应用程序]* -> [文件]c:\users\*\appdata\*\temp\*.tmp; *.dll

z13667152750

卸载程序
加那么多壳干嘛？

huangqian202

bluelily

fatezero 发表于 2010-12-16 12:12
上次vc下的游戏也是这卸载程序

呵呵 同道中人

yangpinghero

金山网盾和mse都说安全