查看: 3207|回复: 17
收起左侧

[可疑文件] 魔兽改键,多杀软报。。不敢用,求分析。。。。。

[复制链接]
ning1999
发表于 2010-12-24 23:12:48 | 显示全部楼层 |阅读模式
http://u.115.com/file/t3b8d064d0               
GiBson
发表于 2010-12-24 23:16:13 | 显示全部楼层
卡巴没反应
留侯
发表于 2010-12-24 23:16:49 | 显示全部楼层
大蜘蛛:SMapHack672\VSMapHack\VPlug\VSWarKey.exe 可能已感染:  BACKDOOR.Trojan
这是启发式分析技术作出的判断
ppy0606
发表于 2010-12-24 23:34:16 | 显示全部楼层
2010-12-24 23:30:34    创建新进程    允许
进程: c:\windows\explorer.exe
目标: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vsmh.exe
命令行: "d:\我的文档\viurs test\VSMapHack672\VSMapHack\VSMH.exe"
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]d:\我的文档\*

--------------------------------------------------------------------------------------------
2010-12-24 23:30:47    创建新进程    允许
进程: c:\windows\explorer.exe
目标: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\abcplug.exe
命令行: "d:\我的文档\viurs test\VSMapHack672\VSMapHack\VPlug\abcPlug.exe"
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]d:\我的文档\*

2010-12-24 23:30:47    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\abcplug.exe
目标: \Device\NamedPipe\wkssvc
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:30:47    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\abcplug.exe
目标: \Device\NamedPipe\wkssvc
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:30:47    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\abcplug.exe
目标: \Device\NamedPipe\wkssvc
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:30:47    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\abcplug.exe
目标: \Device\NamedPipe\wkssvc
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:30:48    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\abcplug.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:30:49    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\abcplug.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:30:52    创建新进程    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\abcplug.exe
目标: c:\program files\internet explorer\iexplore.exe
命令行: "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.175yo.com
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]c:\program files\internet explorer\*

--------------------------------------------------------------------------------------------------------------------

2010-12-24 23:30:58    创建新进程    允许
进程: c:\windows\explorer.exe
目标: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
命令行: "d:\我的文档\viurs test\VSMapHack672\VSMapHack\VPlug\VSWarKey.exe"
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]d:\我的文档\*

2010-12-24 23:31:00    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:31:00    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:31:01    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:31:07    安装全局消息钩子    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
钩子类型: WH_KEYBOARD_LL
规则: [应用程序组]威胁提示Ⅱ -> [应用程序]* -> [钩子模块]d:\我的文档\*

2010-12-24 23:31:07    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:31:07    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:31:09    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData
值: C:\Documents and Settings\All Users\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:31:09    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:31:10    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:31:10    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:31:10    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:31:10    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:31:11    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:31:11    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:31:11    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:31:11    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:31:12    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:31:12    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:31:13    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:31:13    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:31:13    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:31:13    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:31:14    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:31:14    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:31:15    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:31:15    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:31:15    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleft[1].js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleft[2].js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleft[3].js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleft[4].js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleft[5].js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleft[6].js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleft[7].js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleft[8].js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleft[9].js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleft[10].js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleft[11].js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQA.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQACAICDUZA.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQACAICDUZACA2YGBNL.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQACAICDUZACA2YGBNLCAKGUJXY.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQACAICDUZACA2YGBNLCAKGUJXYCAWZS7UH.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQACAICDUZACA2YGBNLCAKGUJXYCAWZS7UHCAXLR8Z1.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQACAICDUZACA2YGBNLCAKGUJXYCAWZS7UHCAXLR8Z1CAIS03M5.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQACAICDUZACA2YGBNLCAKGUJXYCAWZS7UHCAXLR8Z1CAIS03M5CA0ME1GO.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQACAICDUZACA2YGBNLCAKGUJXYCAWZS7UHCAXLR8Z1CAIS03M5CA0ME1GOCA51FROH.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQACAICDUZACA2YGBNLCAKGUJXYCAWZS7UHCAXLR8Z1CAIS03M5CA0ME1GOCA51FROHCAKKBMWD.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQACAICDUZACA2YGBNLCAKGUJXYCAWZS7UHCAXLR8Z1CAIS03M5CA0ME1GOCA51FROHCAKKBMWDCAYUQIPR.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQACAICDUZACA2YGBNLCAKGUJXYCAWZS7UHCAXLR8Z1CAIS03M5CA0ME1GOCA51FROHCAKKBMWDCAYUQIPRCAQTO5WW.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQACAICDUZACA2YGBNLCAKGUJXYCAWZS7UHCAXLR8Z1CAIS03M5CA0ME1GOCA51FROHCAKKBMWDCAYUQIPRCAQTO5WWCADJCEC3.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQACAICDUZACA2YGBNLCAKGUJXYCAWZS7UHCAXLR8Z1CAIS03M5CA0ME1GOCA51FROHCAKKBMWDCAYUQIPRCAQTO5WWCADJCEC3CALU4LJ4.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQACAICDUZACA2YGBNLCAKGUJXYCAWZS7UHCAXLR8Z1CAIS03M5CA0ME1GOCA51FROHCAKKBMWDCAYUQIPRCAQTO5WWCADJCEC3CALU4LJ4CAIUHC3Q.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQACAICDUZACA2YGBNLCAKGUJXYCAWZS7UHCAXLR8Z1CAIS03M5CA0ME1GOCA51FROHCAKKBMWDCAYUQIPRCAQTO5WWCADJCEC3CALU4LJ4CAIUHC3QCAX0UMCP.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\lJSFleftCA38HHQACAICDUZACA2YGBNLCAKGUJXYCAWZS7UHCAXLR8Z1CAIS03M5CA0ME1GOCA51FROHCAKKBMWDCAYUQIPRCAQTO5WWCADJCEC3CALU4LJ4CAIUHC3QCAX0UMCPCA52AUUG.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\JSFleftCA38HHQACAICDUZACA2YGBNLCAKGUJXYCAWZS7UHCAXLR8Z1CAIS03M5CA0ME1GOCA51FROHCAKKBMWDCAYUQIPRCAQTO5WWCADJCEC3CALU4LJ4CAIUHC3QCAX0UMCPCA52AUUGCAQWP8S3.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\A38HHQACAICDUZACA2YGBNLCAKGUJXYCAWZS7UHCAXLR8Z1CAIS03M5CA0ME1GOCA51FROHCAKKBMWDCAYUQIPRCAQTO5WWCADJCEC3CALU4LJ4CAIUHC3QCAX0UMCPCA52AUUGCAQWP8S3CALMHO32.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\AICDUZACA2YGBNLCAKGUJXYCAWZS7UHCAXLR8Z1CAIS03M5CA0ME1GOCA51FROHCAKKBMWDCAYUQIPRCAQTO5WWCADJCEC3CALU4LJ4CAIUHC3QCAX0UMCPCA52AUUGCAQWP8S3CALMHO32CA9T6NYD.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\A2YGBNLCAKGUJXYCAWZS7UHCAXLR8Z1CAIS03M5CA0ME1GOCA51FROHCAKKBMWDCAYUQIPRCAQTO5WWCADJCEC3CALU4LJ4CAIUHC3QCAX0UMCPCA52AUUGCAQWP8S3CALMHO32CA9T6NYDCABCSKA1.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\AKGUJXYCAWZS7UHCAXLR8Z1CAIS03M5CA0ME1GOCA51FROHCAKKBMWDCAYUQIPRCAQTO5WWCADJCEC3CALU4LJ4CAIUHC3QCAX0UMCPCA52AUUGCAQWP8S3CALMHO32CA9T6NYDCABCSKA1CA65TCKN.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\AWZS7UHCAXLR8Z1CAIS03M5CA0ME1GOCA51FROHCAKKBMWDCAYUQIPRCAQTO5WWCADJCEC3CALU4LJ4CAIUHC3QCAX0UMCPCA52AUUGCAQWP8S3CALMHO32CA9T6NYDCABCSKA1CA65TCKNCAKL0CGV.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\AXLR8Z1CAIS03M5CA0ME1GOCA51FROHCAKKBMWDCAYUQIPRCAQTO5WWCADJCEC3CALU4LJ4CAIUHC3QCAX0UMCPCA52AUUGCAQWP8S3CALMHO32CA9T6NYDCABCSKA1CA65TCKNCAKL0CGVCAHCY2HG.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\AIS03M5CA0ME1GOCA51FROHCAKKBMWDCAYUQIPRCAQTO5WWCADJCEC3CALU4LJ4CAIUHC3QCAX0UMCPCA52AUUGCAQWP8S3CALMHO32CA9T6NYDCABCSKA1CA65TCKNCAKL0CGVCAHCY2HGCAK9L822.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\A0ME1GOCA51FROHCAKKBMWDCAYUQIPRCAQTO5WWCADJCEC3CALU4LJ4CAIUHC3QCAX0UMCPCA52AUUGCAQWP8S3CALMHO32CA9T6NYDCABCSKA1CA65TCKNCAKL0CGVCAHCY2HGCAK9L822CA2LT9OY.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\A51FROHCAKKBMWDCAYUQIPRCAQTO5WWCADJCEC3CALU4LJ4CAIUHC3QCAX0UMCPCA52AUUGCAQWP8S3CALMHO32CA9T6NYDCABCSKA1CA65TCKNCAKL0CGVCAHCY2HGCAK9L822CA2LT9OYCAWEZDFL.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\AKKBMWDCAYUQIPRCAQTO5WWCADJCEC3CALU4LJ4CAIUHC3QCAX0UMCPCA52AUUGCAQWP8S3CALMHO32CA9T6NYDCABCSKA1CA65TCKNCAKL0CGVCAHCY2HGCAK9L822CA2LT9OYCAWEZDFLCAAILN3S.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\AYUQIPRCAQTO5WWCADJCEC3CALU4LJ4CAIUHC3QCAX0UMCPCA52AUUGCAQWP8S3CALMHO32CA9T6NYDCABCSKA1CA65TCKNCAKL0CGVCAHCY2HGCAK9L822CA2LT9OYCAWEZDFLCAAILN3SCA6BKB2S.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\AQTO5WWCADJCEC3CALU4LJ4CAIUHC3QCAX0UMCPCA52AUUGCAQWP8S3CALMHO32CA9T6NYDCABCSKA1CA65TCKNCAKL0CGVCAHCY2HGCAK9L822CA2LT9OYCAWEZDFLCAAILN3SCA6BKB2SCAX3PAGM.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\ADJCEC3CALU4LJ4CAIUHC3QCAX0UMCPCA52AUUGCAQWP8S3CALMHO32CA9T6NYDCABCSKA1CA65TCKNCAKL0CGVCAHCY2HGCAK9L822CA2LT9OYCAWEZDFLCAAILN3SCA6BKB2SCAX3PAGMCAARLFWY.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\ALU4LJ4CAIUHC3QCAX0UMCPCA52AUUGCAQWP8S3CALMHO32CA9T6NYDCABCSKA1CA65TCKNCAKL0CGVCAHCY2HGCAK9L822CA2LT9OYCAWEZDFLCAAILN3SCA6BKB2SCAX3PAGMCAARLFWYCAU4MQVD.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\AIUHC3QCAX0UMCPCA52AUUGCAQWP8S3CALMHO32CA9T6NYDCABCSKA1CA65TCKNCAKL0CGVCAHCY2HGCAK9L822CA2LT9OYCAWEZDFLCAAILN3SCA6BKB2SCAX3PAGMCAARLFWYCAU4MQVDCA7XDZX0.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\AX0UMCPCA52AUUGCAQWP8S3CALMHO32CA9T6NYDCABCSKA1CA65TCKNCAKL0CGVCAHCY2HGCAK9L822CA2LT9OYCAWEZDFLCAAILN3SCA6BKB2SCAX3PAGMCAARLFWYCAU4MQVDCA7XDZX0CAMJUXU6.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\A52AUUGCAQWP8S3CALMHO32CA9T6NYDCABCSKA1CA65TCKNCAKL0CGVCAHCY2HGCAK9L822CA2LT9OYCAWEZDFLCAAILN3SCA6BKB2SCAX3PAGMCAARLFWYCAU4MQVDCA7XDZX0CAMJUXU6CA73VIQY.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\AQWP8S3CALMHO32CA9T6NYDCABCSKA1CA65TCKNCAKL0CGVCAHCY2HGCAK9L822CA2LT9OYCAWEZDFLCAAILN3SCA6BKB2SCAX3PAGMCAARLFWYCAU4MQVDCA7XDZX0CAMJUXU6CA73VIQYCAK1XR94.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\ALMHO32CA9T6NYDCABCSKA1CA65TCKNCAKL0CGVCAHCY2HGCAK9L822CA2LT9OYCAWEZDFLCAAILN3SCA6BKB2SCAX3PAGMCAARLFWYCAU4MQVDCA7XDZX0CAMJUXU6CA73VIQYCAK1XR94CAKMENTI.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\A9T6NYDCABCSKA1CA65TCKNCAKL0CGVCAHCY2HGCAK9L822CA2LT9OYCAWEZDFLCAAILN3SCA6BKB2SCAX3PAGMCAARLFWYCAU4MQVDCA7XDZX0CAMJUXU6CA73VIQYCAK1XR94CAKMENTICAZDIENZ.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:15    创建文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\7BVUJITC\ABCSKA1CA65TCKNCAKL0CGVCAHCY2HGCAK9L822CA2LT9OYCAWEZDFLCAAILN3SCA6BKB2SCAX3PAGMCAARLFWYCAU4MQVDCA7XDZX0CAMJUXU6CA73VIQYCAK1XR94CAKMENTICAZDIENZCADPMLP2.js
规则: [文件组]文件阻止及保护 -> [文件]*; *.js

2010-12-24 23:31:16    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Favorites
值: d:\我的文档\收藏夹
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:31:25    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:31:27    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:31:30    修改注册表值    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2010-12-24 23:31:30    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2010-12-24 23:31:30    修改文件    阻止
进程: d:\我的文档\viurs test\vsmaphack672\vsmaphack\vplug\vswarkey.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

----------------------------------------------

闪人..
F-secure2009
发表于 2010-12-24 23:35:25 | 显示全部楼层
360报了两个,EXE 文件和DLL文件
d4875163
发表于 2010-12-25 08:26:53 | 显示全部楼层
病毒: Gen:Trojan.Heur.LP.IK8@aqMcV5ab (Engine-A)

下载网页内容时发现病毒。

地址: 29.bak.115cdn.com
状态:         访问被拒绝。
cpdcrusaderin
发表于 2010-12-25 09:26:29 | 显示全部楼层

avira found

d:\temp\VSMapHack672.rar
Date: 25.12.2010 Time: 09:23:43  Size: 2027787
ALERT: [TR/VB.Downloader.Gen] d:\temp\VSMapHack672.rar --> VSMapHack\VPlug\abcPlug.exe <<< Is the Trojan horse TR/VB.Downloader.Gen
ALERT: [TR/Spy.562688.1] d:\temp\VSMapHack672.rar --> VSMapHack\VPlug\W3Knight.dll <<< Is the Trojan horse TR/Spy.562688.1
ALERT: [TR/Crypt.XPACK.Gen] d:\temp\VSMapHack672.rar --> VSMapHack\VSMH.exe <<< Is the Trojan horse TR/Crypt.XPACK.Gen

ning1999
 楼主| 发表于 2010-12-25 10:14:34 | 显示全部楼层
回复 4楼 ppy0606 的帖子

看不懂啊。。。这是病毒木马么?
ppy0606
发表于 2010-12-25 10:26:25 | 显示全部楼层
回复 9楼 ning1999 的帖子

对于这种软件  只能说少用为好
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-6-14 18:04 , Processed in 0.140971 second(s), 19 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表