QQ接收到一文件 果断接受.没敢双击

小猫种鱼

求分析
http://u.115.com/file/t3874ded6e#
DDZWZ_12918.rar

奥古斯都

应该不是毒。

sfzjn

上传到Virustotal去扫描吧。。。

GiBson

样本呢？？？？？？？？？？？？？？

小猫种鱼

奥古斯都 发表于 2010-12-26 16:21
附件呢？？

来了

猪头无双

没样本建议LZ上传到virustotal去分析下

西风萧雨

卫士下载保护报安全

恋亿晓

过MSE,金山

hddu

2010-12-26 17:09:14    运行应用程序      操作:允许
进程路径:F:\virus\DDZWZ_12918\DDZWZ_12918.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
命令行:/SL5="$260396,9677846,54272,F:\virus\DDZWZ_12918\DDZWZ_12918.exe"
触发规则:所有程序规则->其它程序设置->*\Temp\*

2010-12-26 17:09:30    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*

2010-12-26 17:09:31    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\unins000.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:09:32    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\unins000.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:09:34    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\9158IMSoft
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*

2010-12-26 17:09:37    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\9158IMSoft\9158IM.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:09:38    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\9158IMSoft\9158IM.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:09:41    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\9158IMSoft\head
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*\*

2010-12-26 17:09:42    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\9158IMSoft\IM_RES
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*\*

2010-12-26 17:09:51    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\9158IMSoft\IM_RES\stage\stage.rar
触发规则:所有程序规则->压缩文件设置->*.rar

2010-12-26 17:09:51    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\9158IMSoft\IM_RES\stage\stage.rar
触发规则:所有程序规则->压缩文件设置->*.rar

2010-12-26 17:09:53    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\9158IMSoft\skinres
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*\*

2010-12-26 17:09:56    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\DDVDown.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:09:57    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\DDVDown.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:09:59    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\DDVLobby.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:10:01    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\DDVLobby.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:10:03    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\DDVTool.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:10:04    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\DDVTool.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:10:06    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\GetPPID.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:10:08    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\GetPPID.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:10:10    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\AD
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*\*

2010-12-26 17:10:12    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\DownLoad
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*\*

2010-12-26 17:10:13    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\GameLobby
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*\*

2010-12-26 17:10:15    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\GameLobby\DDVLobby.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:10:17    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\GameLobby\DDVLobby.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:10:48    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\Head
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*\*

2010-12-26 17:10:50    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\Head\DDVLobby.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:10:51    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\Head\DDVLobby.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:10:53    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\ProxyRes
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*\*

2010-12-26 17:10:58    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\RoomPlus
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*\*

2010-12-26 17:11:00    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\ShareDll
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*\*

2010-12-26 17:11:02    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\sound
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*\*

2010-12-26 17:11:05    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\GameRes
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*\*

2010-12-26 17:11:13    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\DDZ.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:11:14    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Program Files\DuoDuoVideoGame\DDZ.exe
触发规则:所有程序规则->%ProgramFiles%设置->%ProgramFiles%\*.exe

2010-12-26 17:11:15    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\多多视频游戏
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\*

2010-12-26 17:11:17    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\多多视频游戏\多多视频游戏.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk

2010-12-26 17:11:19    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\多多视频游戏\卸载 多多视频游戏.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\*.lnk

2010-12-26 17:11:20    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\is-APJDI.tmp\DDZWZ_12918.tmp
文件路径:C:\Documents and Settings\Administrator\桌面\多多视频游戏.lnk
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\桌面\*.lnk

我是新手

无限创建文件。。。。 [:26:]