金山沙箱运行一样本后，下载的一病毒

414447992

listen1

开始在“D:\病毒测试\103.rar”中扫描
D:\病毒测试\103.rar
  [0] 存档类型: RAR
    --> 103.exe
      [检测]        是 TR/Dldr.Chekafe.A.8 特洛伊木马

留侯

大蜘蛛：103.exe found virus Trojan.Siggen1.63962

久远寺有珠

AVG  已阻止此网页的访问
原因：包含特洛伊木马

XMonster

D:\下载\样本.rar=>qq刷会员.exe        行为和木马比较相似的程序        已删除

zuo

2010-12-25 14:01:11    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\103\103.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-25 14:01:12    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\103\103.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2010-12-25 14:01:13    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\103\103.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2010-12-25 14:01:13    从其他进程复制句柄    阻止
进程: c:\windows\system32\svchost.exe
目标: c:\documents and settings\administrator\桌面\103\103.exe
句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
规则: [应用程序]c:\windows\system32\svchost.exe

2010-12-25 14:01:14    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\103\103.exe
目标: TCP [本机 : 1240] ->  [202.102.110.204 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-25 14:01:14    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\103\103.exe
目标: TCP [本机 : 1241] ->  [208.98.40.88 : 81]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-25 14:01:14    创建新进程    阻止
进程: c:\documents and settings\administrator\桌面\103\103.exe
目标: c:\windows\system32\net.exe
命令行: net stop sharedaccess
规则: [应用程序组]所有程序规则-系统程序执行规则 -> [应用程序]* -> [子应用程序]c:\windows\system32\net.exe

2010-12-25 14:01:14    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\103\103.exe
目标: TCP [本机 : 1242] ->  [208.98.40.88 : 6668]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-25 14:01:31    创建新进程    阻止并结束进程
进程: c:\windows\system32\cmd.exe
目标: c:\windows\system32\cacls.exe
命令行: cacls "C:\Documents and Settings\Administrator\桌面" /g everyone:r
规则: [应用程序组]所有程序规则-系统程序执行规则 -> [应用程序]* -> [子应用程序]*\cacls.exe

2010-12-25 14:01:40    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\103\103.exe
目标: TCP [本机 : 1243] ->  [208.98.40.88 : 6668]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-25 14:01:40    创建新进程    阻止
进程: c:\documents and settings\administrator\桌面\103\103.exe
目标: c:\windows\system32\net.exe
命令行: net stop sharedaccess
规则: [应用程序组]所有程序规则-系统程序执行规则 -> [应用程序]* -> [子应用程序]c:\windows\system32\net.exe

2010-12-25 14:01:40    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\103\103.exe
目标: TCP [本机 : 1244] ->  [208.98.40.88 : 6668]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-25 14:01:40    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\103\103.exe
目标: TCP [本机 : 1245] ->  [208.98.40.88 : 81]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

hansyu

avast!
Win32:Rootkit-gen[Rtk]

jiajia2010

rising 2011 kill

悟心之道

这么多行为！
2010-12-25 14:39:00 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\iphlpapi.dll C:\WINDOWS\system32\iphlpapi.dll
2010-12-25 14:39:00 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\imm32.dll C:\WINDOWS\system32\imm32.dll
2010-12-25 14:39:00 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
2010-12-25 14:39:00 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
2010-12-25 14:39:00 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll
2010-12-25 14:39:00 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\MSCTF.dll C:\WINDOWS\system32\MSCTF.dll
2010-12-25 14:39:00 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件D:\Program Files\Kingsoft\webshield\kwsui.dll D:\Program Files\Kingsoft\webshield\kwsui.dll
2010-12-25 14:39:00 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll
2010-12-25 14:39:00 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件D:\Program Files\Kingsoft\webshield\kswebshield.dll D:\Program Files\Kingsoft\webshield\kswebshield.dll
2010-12-25 14:39:00 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\msimg32.dll C:\WINDOWS\system32\msimg32.dll
2010-12-25 14:39:00 G:\TDDOWNLOAD\VIR测试\103.exe创建进程G:\TDDOWNLOAD\VIR测试\103.exe G:\TDDOWNLOAD\VIR测试\103.exe
2010-12-25 14:39:02 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\iphlpapi.dll C:\WINDOWS\system32\iphlpapi.dll
2010-12-25 14:39:02 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\imm32.dll C:\WINDOWS\system32\imm32.dll
2010-12-25 14:39:02 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
2010-12-25 14:39:02 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
2010-12-25 14:39:02 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll
2010-12-25 14:39:02 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件D:\Program Files\Micropoint\mp110031.dll D:\Program Files\Micropoint\mp110031.dll
2010-12-25 14:39:02 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件D:\Program Files\Kingsoft\webshield\kwsui.dll D:\Program Files\Kingsoft\webshield\kwsui.dll
2010-12-25 14:39:02 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\MSCTF.dll C:\WINDOWS\system32\MSCTF.dll
2010-12-25 14:39:02 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件D:\Program Files\Kingsoft\webshield\kswebshield.dll D:\Program Files\Kingsoft\webshield\kswebshield.dll
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\msimg32.dll C:\WINDOWS\system32\msimg32.dll
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2 HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001 HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe写注册表HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe写注册表HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2010-12-25 14:39:03 G:\TDDOWNLOAD\VIR测试\103.exe写注册表HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2010-12-25 14:39:11 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\rasapi32.dll C:\WINDOWS\system32\rasapi32.dll
2010-12-25 14:39:11 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\rasman.dll C:\WINDOWS\system32\rasman.dll
2010-12-25 14:39:11 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\netapi32.dll C:\WINDOWS\system32\netapi32.dll
2010-12-25 14:39:11 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\rtutils.dll C:\WINDOWS\system32\rtutils.dll
2010-12-25 14:39:11 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\tapi32.dll C:\WINDOWS\system32\tapi32.dll
2010-12-25 14:39:11 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing
2010-12-25 14:39:11 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2010-12-25 14:39:11 G:\TDDOWNLOAD\VIR测试\103.exe打开服务RASMAN RASMAN
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows NT\CurrentVersion\Winlogon HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_LOCAL_MACHINE HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_LOCAL_MACHINE
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_LOCAL_MACHINE\SOFTWARE HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_LOCAL_MACHINE\SOFTWARE
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe写注册表HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe打开服务RASMAN RASMAN
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe打开服务Sens Sens
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe写注册表HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe写注册表HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe打开服务RASMAN RASMAN
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\mswsock.dll C:\WINDOWS\system32\mswsock.dll
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\rasadhlp.dll C:\WINDOWS\system32\rasadhlp.dll
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe打开服务RASMAN RASMAN
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe写注册表HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe写注册表HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe写注册表HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe写注册表HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe写注册表HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe写注册表HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe写注册表HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe写注册表HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe打开服务RASMAN RASMAN
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe写注册表HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_LOCAL_MACHINE\Software\Kingsoft\KSBReg\0DCD59A2\HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe写注册表HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\comres.dll C:\WINDOWS\system32\comres.dll
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\clbcatq.dll C:\WINDOWS\system32\clbcatq.dll
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe打开服务RASMAN RASMAN
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\dnsapi.dll C:\WINDOWS\system32\dnsapi.dll
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe打开服务RASMAN RASMAN
2010-12-25 14:39:12 G:\TDDOWNLOAD\VIR测试\103.exe创建注册表键值HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
2010-12-25 14:39:13 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\hnetcfg.dll C:\WINDOWS\system32\hnetcfg.dll
2010-12-25 14:39:13 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\wshtcpip.dll C:\WINDOWS\system32\wshtcpip.dll
2010-12-25 14:39:14 G:\TDDOWNLOAD\VIR测试\103.exe创建文件C:\KSafeBox\0DCD59A2\Documents and Settings\576992335\Local Settings\Temporary Internet Files\Content.IE5\0H6BS5A9\count[2].htm C:\KSafeBox\0DCD59A2\Documents and Settings\576992335\Local Settings\Temporary Internet Files\Content.IE5\0H6BS5A9\count[2].htm
2010-12-25 14:39:14 G:\TDDOWNLOAD\VIR测试\103.exe删除文件C:\KSafeBox\0DCD59A2\Documents and Settings\576992335\Local Settings\Temporary Internet Files\Content.IE5\0H6BS5A9\count[2].htm C:\KSafeBox\0DCD59A2\Documents and Settings\576992335\Local Settings\Temporary Internet Files\Content.IE5\0H6BS5A9\count[2].htm
2010-12-25 14:39:15 G:\TDDOWNLOAD\VIR测试\103.exe加载库文件C:\WINDOWS\system32\apphelp.dll C:\WINDOWS\system32\apphelp.dll
2010-12-25 14:39:15 G:\TDDOWNLOAD\VIR测试\103.exe创建进程C:\WINDOWS\system32\net.exe C:\WINDOWS\system32\net.exe
2010-12-25 14:39:15 G:\TDDOWNLOAD\VIR测试\103.exe创建文件C:\KSafeBox\0DCD59A2\Winup C:\KSafeBox\0DCD59A2\Winup
2010-12-25 14:39:15 G:\TDDOWNLOAD\VIR测试\103.exe打开服务RASMAN RASMAN
2010-12-25 14:39:15 C:\WINDOWS\system32\net.exe加载库文件C:\WINDOWS\system32\netapi32.dll C:\WINDOWS\system32\netapi32.dll
2010-12-25 14:39:15 C:\WINDOWS\system32\net.exe加载库文件C:\WINDOWS\AppPatch\AcGenral.dll C:\WINDOWS\AppPatch\AcGenral.dll
2010-12-25 14:39:16 C:\WINDOWS\system32\net.exe加载库文件C:\WINDOWS\system32\imm32.dll C:\WINDOWS\system32\imm32.dll
2010-12-25 14:39:16 C:\WINDOWS\system32\net.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Multimedia\Audio HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Multimedia\Audio
2010-12-25 14:39:16 C:\WINDOWS\system32\net.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Multimedia\Audio Compression Manager\ HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Multimedia\Audio Compression Manager\
2010-12-25 14:39:16 C:\WINDOWS\system32\net.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Multimedia\Audio Compression Manager\MSACM HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Multimedia\Audio Compression Manager\MSACM
2010-12-25 14:39:16 C:\WINDOWS\system32\net.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00 HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00
2010-12-25 14:39:16 C:\WINDOWS\system32\net.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
2010-12-25 14:39:16 C:\WINDOWS\system32\net.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll
2010-12-25 14:39:16 C:\WINDOWS\system32\net.exe加载库文件C:\WINDOWS\system32\apphelp.dll C:\WINDOWS\system32\apphelp.dll
2010-12-25 14:39:17 C:\WINDOWS\system32\net.exe创建进程C:\WINDOWS\system32\net1.exe C:\WINDOWS\system32\net1.exe
2010-12-25 14:39:17 G:\TDDOWNLOAD\VIR测试\103.exe创建文件C:\KSafeBox\0DCD59A2\Documents and Settings\576992335\Local Settings\Temporary Internet Files\Content.IE5\0H6BS5A9\g[1].css C:\KSafeBox\0DCD59A2\Documents and Settings\576992335\Local Settings\Temporary Internet Files\Content.IE5\0H6BS5A9\g[1].css
2010-12-25 14:39:17 G:\TDDOWNLOAD\VIR测试\103.exe创建文件C:\KSafeBox\0DCD59A2\Winup\kb93623.exe C:\KSafeBox\0DCD59A2\Winup\kb93623.exe
2010-12-25 14:39:17 C:\WINDOWS\system32\net1.exe加载库文件C:\WINDOWS\system32\netapi32.dll C:\WINDOWS\system32\netapi32.dll
2010-12-25 14:39:17 C:\WINDOWS\system32\net1.exe加载库文件C:\WINDOWS\system32\samlib.dll C:\WINDOWS\system32\samlib.dll
2010-12-25 14:39:17 C:\WINDOWS\system32\net1.exe加载库文件C:\WINDOWS\system32\ntdsapi.dll C:\WINDOWS\system32\ntdsapi.dll
2010-12-25 14:39:17 C:\WINDOWS\system32\net1.exe加载库文件C:\WINDOWS\system32\dnsapi.dll C:\WINDOWS\system32\dnsapi.dll
2010-12-25 14:39:17 C:\WINDOWS\system32\net1.exe加载库文件C:\WINDOWS\system32\netrap.dll C:\WINDOWS\system32\netrap.dll
2010-12-25 14:39:17 C:\WINDOWS\system32\net1.exe加载库文件C:\WINDOWS\AppPatch\AcGenral.dll C:\WINDOWS\AppPatch\AcGenral.dll
2010-12-25 14:39:17 C:\WINDOWS\system32\net1.exe加载库文件C:\WINDOWS\system32\imm32.dll C:\WINDOWS\system32\imm32.dll
2010-12-25 14:39:17 C:\WINDOWS\system32\net1.exe创建注册表键值HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
2010-12-25 14:39:17 C:\WINDOWS\system32\net1.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Multimedia\Audio HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Multimedia\Audio
2010-12-25 14:39:17 C:\WINDOWS\system32\net1.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Multimedia\Audio Compression Manager\ HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Multimedia\Audio Compression Manager\
2010-12-25 14:39:17 C:\WINDOWS\system32\net1.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Multimedia\Audio Compression Manager\MSACM HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Multimedia\Audio Compression Manager\MSACM
2010-12-25 14:39:17 C:\WINDOWS\system32\net1.exe创建注册表键值HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00 HKEY_USERS\S-1-5-21-1220945662-1606980848-1060284298-1001\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00
2010-12-25 14:39:17 C:\WINDOWS\system32\net1.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
2010-12-25 14:39:17 C:\WINDOWS\system32\net1.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll
2010-12-25 14:39:17 C:\WINDOWS\system32\net1.exe打开服务SHAREDACCESS SHAREDACCESS
2010-12-25 14:39:17 C:\WINDOWS\system32\net1.exe加载库文件C:\WINDOWS\system32\netmsg.dll C:\WINDOWS\system32\netmsg.dll
2010-12-25 14:39:17 结束进程C:\WINDOWS\system32\net1.exe C:\WINDOWS\system32\net1.exe
2010-12-25 14:39:17 结束进程C:\WINDOWS\system32\net.exe C:\WINDOWS\system32\net.exe
2010-12-25 14:39:33 G:\TDDOWNLOAD\VIR测试\103.exe发送消息C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\ctfmon.exe
2010-12-25 14:39:33 G:\TDDOWNLOAD\VIR测试\103.exe发送消息C:\WINDOWS\explorer.exe C:\WINDOWS\explorer.exe
2010-12-25 14:39:33 结束进程G:\TDDOWNLOAD\VIR测试\103.exe G:\TDDOWNLOAD\VIR测试\103.exe
2010-12-25 14:39:36 G:\TDDOWNLOAD\VIR测试\103.exe写文件C:\KSafeBox\0DCD59A2\Documents and Settings\576992335\Local Settings\Temporary Internet Files\Content.IE5\0H6BS5A9\g[1].css C:\KSafeBox\0DCD59A2\Documents and Settings\576992335\Local Settings\Temporary Internet Files\Content.IE5\0H6BS5A9\g[1].css
2010-12-25 14:39:37 G:\TDDOWNLOAD\VIR测试\103.exe写文件C:\KSafeBox\0DCD59A2\Winup\kb93623.exe C:\KSafeBox\0DCD59A2\Winup\kb93623.exe
2010-12-25 14:39:37 结束进程G:\TDDOWNLOAD\VIR测试\103.exe G:\TDDOWNLOAD\VIR测试\103.exe

kinkids

Kaspersky Internet Security 2011，
掃瞄偵測為【Trojan-Downloader.Win32.Agent.ecen】，
已進行隔離/刪除動作。

掃瞄偵測到1個可疑檔案，--個 Kaspersky Cloud，--個啟發，1個特徵碼，一隻病毒一條特徵碼，傻眼，囧rz，
剩餘--個文件MISS，無威脅可疑，已提交至 Kaspersky。