不知是不是毒，过eav等主流

显示全部楼层 · 发表于 2010-12-24 17:59:35

等楼下测试

显示全部楼层 · 发表于 2010-12-24 18:02:02

红伞54，上报红伞

显示全部楼层 · 发表于 2010-12-24 18:07:15

2010-12-24 18:03:25 创建新进程允许
进程: c:\windows\explorer.exe
目标: d:\我的文档\viurs test\setup_18825\setup_18825.exe
命令行: "d:\我的文档\viurs test\setup_18825\setup_18825.exe"
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]d:\我的文档\*

2010-12-24 18:03:28 创建文件允许
进程: d:\我的文档\viurs test\setup_18825\setup_18825.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\nsw1C.tmp\System.dll
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.dll

2010-12-24 18:03:30 修改注册表值阻止
进程: d:\我的文档\viurs test\setup_18825\setup_18825.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Templates
值: C:\Documents and Settings\Administrator\Templates
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 18:03:33 创建文件允许
进程: d:\我的文档\viurs test\setup_18825\setup_18825.exe
目标: C:\Documents and Settings\Administrator\Templates\setup.exe
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.exe

2010-12-24 18:03:40 修改文件允许
进程: d:\我的文档\viurs test\setup_18825\setup_18825.exe
目标: C:\Documents and Settings\Administrator\Templates\setup.exe
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.exe

2010-12-24 18:03:43 创建文件允许
进程: d:\我的文档\viurs test\setup_18825\setup_18825.exe
目标: C:\Documents and Settings\Administrator\Templates\tp28.exe
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.exe

2010-12-24 18:04:17 创建文件允许
进程: d:\我的文档\viurs test\setup_18825\setup_18825.exe
目标: C:\Documents and Settings\Administrator\Templates\a.bat
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.bat

2010-12-24 18:04:21 创建文件允许
进程: d:\我的文档\viurs test\setup_18825\setup_18825.exe
目标: C:\Documents and Settings\Administrator\Templates\SeFastInstall2_3427.exe
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.exe

2010-12-24 18:04:25 创建新进程阻止
进程: d:\我的文档\viurs test\setup_18825\setup_18825.exe
目标: c:\documents and settings\administrator\templates\sefastinstall2_3427.exe
命令行: "C:\Documents and Settings\Administrator\Templates\SeFastInstall2_3427.exe"
规则: [应用程序]*

2010-12-24 18:04:28 创建文件允许
进程: d:\我的文档\viurs test\setup_18825\setup_18825.exe
目标: C:\Documents and Settings\Administrator\Templates\kksetup.exe
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.exe

2010-12-24 18:04:31 创建新进程允许
进程: d:\我的文档\viurs test\setup_18825\setup_18825.exe
目标: c:\documents and settings\administrator\templates\kksetup.exe
命令行: "C:\Documents and Settings\Administrator\Templates\kksetup.exe"
规则: [应用程序]*

2010-12-24 18:04:33 删除文件允许
进程: d:\我的文档\viurs test\setup_18825\setup_18825.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\nsw1C.tmp\System.dll
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.dll

2010-12-24 18:04:35 创建文件允许
进程: c:\documents and settings\administrator\templates\kksetup.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\nsy1E.tmp\InstallOptions.dll
规则: [文件组]Documents and Settings_阻止 -> [文件]?:\documents and settings\*; *.dll

---------------------------------------------------------------------------------------------------------------------

显示全部楼层 · 发表于 2010-12-24 19:09:56

瑞星2011拦截

显示全部楼层 · 发表于 2010-12-24 19:52:18

红伞毫无反应.

显示全部楼层 · 发表于 2010-12-24 21:29:18

NAV eav4.2 kis主防没拦住

显示全部楼层 · 发表于 2010-12-24 23:09:36

已上報趨勢嚕~

[病毒样本] 不知是不是毒，过eav等主流

评分

本帖子中包含更多资源

浏览过的版块