这个也是恶意软件吗？

杀毒粉丝

，为啥G data的A引擎报了小a却不报？

尘潇

下载不了？

fatezero

因为那个GD的A引擎是卡巴或者BD

KIS
Trojan-Downloader.Win32.Delf.alln

瓜皮猫

是病毒。
右键没反应，在沙盘运行时报了生成物。
http://camas.comodo.com/cgi-bin/ ... 2c71f8708faf4a546aa
to eset

留侯

大蜘蛛clean，已上报！

恋亿晓

to avast!

8887

solstice1988

红伞54，上报红伞

zuo

2010-12-24 21:40:49    创建新进程    允许
进程: c:\documents and settings\administrator\桌面\setup[1]\setup.exe
目标: c:\documents and settings\administrator\local settings\temp\is-c26mb.tmp\is-4otp6.tmp
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-C26MB.tmp\is-4OTP6.tmp" /SL4 $F03F8 "C:\Documents and Settings\Administrator\桌面\setup[1]\setup.exe" 1807491 52224
规则: [应用程序组]所有程序规则-外部程序执行规则 -> [应用程序]* -> [子应用程序]*temp\*.tmp

2010-12-24 21:40:51    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-c26mb.tmp\is-4otp6.tmp
目标: C:\Program Files\Sum520\InstallDll.dll
规则: [文件组]文件安全读写规则(询问创建) -> [文件]*\program files\*; *.dll

2010-12-24 21:40:55    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-c26mb.tmp\is-4otp6.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-24 21:40:56    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-c26mb.tmp\is-4otp6.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2010-12-24 21:40:56    删除注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-c26mb.tmp\is-4otp6.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@explorer.exe,-7024
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache; @*

2010-12-24 21:40:56    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-c26mb.tmp\is-4otp6.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\LangID
值: 04 08
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2010-12-24 21:40:56    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-c26mb.tmp\is-4otp6.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\Regedit.exe
值: Registry Editor
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache

2010-12-24 21:40:56    创建新进程    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-c26mb.tmp\is-4otp6.tmp
目标: c:\windows\regedit.exe
命令行: "C:\WINDOWS\Regedit.exe"  -s "C:\Program Files\Sum520\info.desc"
规则: [应用程序组]所有程序规则-系统程序执行规则 -> [应用程序]* -> [子应用程序]c:\windows\regedit.exe

2010-12-24 21:40:56    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-c26mb.tmp\is-4otp6.tmp
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\WINDOWS\Fonts\test.txt \??\C:\WINDOWS\baiduhi
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SYSTEM\*ControlSet*\Control\Session Manager; *FileRenameOperations

2010-12-24 21:40:56    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-c26mb.tmp\is-4otp6.tmp
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\WINDOWS\baiduhi \??\C:\Documents and Settings\All Users\「开始」菜单\程序\启动\baiduhi
规则: [注册表组]系统关键设置保护(阻止) -> [注册表]*\SYSTEM\*ControlSet*\Control\Session Manager; *FileRenameOperations

2010-12-24 21:40:57    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-c26mb.tmp\is-4otp6.tmp
目标: C:\WINDOWS\Install.tmp
规则: [文件组]文件安全读写规则(询问创建) -> [文件]c:\windows; *.*

2010-12-24 21:40:57    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-c26mb.tmp\is-4otp6.tmp
目标: C:\WINDOWS\Install.tmp
规则: [文件组]文件安全读写规则(询问创建) -> [文件]c:\windows; *.*

2010-12-24 21:40:58    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-c26mb.tmp\is-4otp6.tmp
目标: C:\WINDOWS\Install.tmp
规则: [文件组]文件安全读写规则(询问创建) -> [文件]c:\windows; *.*

2010-12-24 21:40:59    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-c26mb.tmp\is-4otp6.tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2010-12-24 21:40:59    从其他进程复制句柄    阻止
进程: c:\windows\system32\svchost.exe
目标: c:\documents and settings\administrator\local settings\temp\is-c26mb.tmp\is-4otp6.tmp
句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
规则: [应用程序]c:\windows\system32\svchost.exe

2010-12-24 21:41:00    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-c26mb.tmp\is-4otp6.tmp
目标: TCP [本机 : 1575] ->  [122.224.9.113 : 8022]
规则: [应用程序组]4D规则-安装进程例外规则 -> [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

s8706042

已上報趨勢嚕~