求鉴 1X

显示全部楼层 · 发表于 2010-12-25 18:43:48

红伞无视，上报

显示全部楼层 · 发表于 2010-12-25 18:56:16

2010-12-25 18:55:03 创建文件阻止
进程: c:\documents and settings\administrator\桌面\ksqd\ksqd.exe
目标: C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\__tmp_rar_sfx_access_check_934663
规则: [文件组]系统文件夹写保护(询问创建、修改) -> [文件]c:\*\microsoft\internet explorer\quick launch\*

2010-12-25 18:55:04 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\ksqd\ksqd.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-25 18:55:04 修改注册表值阻止
进程: c:\documents and settings\administrator\桌面\ksqd\ksqd.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

显示全部楼层 · 发表于 2010-12-25 21:32:24

大蜘蛛clean，有点流氓吧！

显示全部楼层 · 发表于 2010-12-25 23:16:05

2010-12-25 23:13:27 修改文件    操作:使用任务隔离区操作
进程路径:F:\virus\ksqd\ksqd.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer
触发规则:所有程序规则->Documents and Settings设置（二）->*\Int*Exp*

2010-12-25 23:13:27 修改文件    操作:阻止
进程路径:F:\virus\ksqd\ksqd.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch
触发规则:所有程序规则->Documents and Settings设置（一）->?:\Documents and Settings\*\Application Data\Microsoft\Internet Explorer\*

2010-12-25 23:13:27 修改文件    操作:阻止
进程路径:F:\virus\ksqd\ksqd.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk
触发规则:所有程序规则->Documents and Settings设置（一）->?:\Documents and Settings\*\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk

2010-12-25 23:13:27 修改文件    操作:阻止
进程路径:F:\virus\ksqd\ksqd.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk
触发规则:所有程序规则->Documents and Settings设置（一）->?:\Documents and Settings\*\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk

2010-12-25 23:13:27 创建文件    操作:使用任务隔离区操作
进程路径:F:\virus\ksqd\ksqd.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\我的电脑.lnk
触发规则:所有程序规则->Documents and Settings设置（一）->?:\Documents and Settings\*\Application Data\Microsoft\Internet Explorer\Quick Launch\*.lnk

2010-12-25 23:13:27 修改文件    操作:阻止
进程路径:F:\virus\ksqd\ksqd.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\显示桌面.scf
触发规则:所有程序规则->Documents and Settings设置（一）->?:\Documents and Settings\*\Application Data\Microsoft\Internet Explorer\Quick Launch\显示桌面.scf

2010-12-25 23:13:27 修改文件    操作:阻止
进程路径:F:\virus\ksqd\ksqd.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\显示桌面.scf
触发规则:所有程序规则->Documents and Settings设置（一）->?:\Documents and Settings\*\Application Data\Microsoft\Internet Explorer\Quick Launch\显示桌面.scf

显示全部楼层 · 发表于 2010-12-25 23:55:50

已上報趨勢嚕~

显示全部楼层 · 发表于 2010-12-26 10:46:27

过a2
过mse

[病毒样本] 求鉴 1X

浏览过的版块