收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 病毒样本 分享&分析区 › 金山毒霸上报了一个月都不杀的病毒
1234下一页
返回列表 发新帖
楼主: 12548777
 收起左侧

[病毒样本] 金山毒霸上报了一个月都不杀的病毒

  [复制链接]
wei581314
头像被屏蔽
发表于 2011-1-2 16:51:50 | 显示全部楼层
卡巴杀 金山网盾报安全 悲剧
回复

举报

色色仙人
发表于 2011-1-2 17:07:56 | 显示全部楼层
金山贝壳木马专杀...连未知文件都不是,扫描不出来啊~
回复

举报

h2153204
发表于 2011-1-2 17:31:31 | 显示全部楼层
下载后小A扫描没反应。
回复

举报

zuo
发表于 2011-1-2 17:37:54 | 显示全部楼层
2011-1-2 17:36:26    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\ras\ras.exe
目标: C:\Program Files\Common Files\Exist.ini
规则: [文件组]系统文件夹写保护(阻止创建) -> [文件]c:\program files\common files

2011-1-2 17:36:27    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2011-1-2 17:36:27    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2011-1-2 17:36:28    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2011-1-2 17:36:28    从其他进程复制句柄    阻止
进程: c:\windows\system32\svchost.exe
目标: c:\documents and settings\administrator\桌面\ras\ras.exe
句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
规则: [应用程序]c:\windows\system32\svchost.exe

2011-1-2 17:36:29    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\ras\ras.exe
目标: TCP [本机 : 1495] ->  [202.102.110.204 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2011-1-2 17:36:29    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\ras\ras.exe
目标: TCP [本机 : 1496] ->  [61.164.109.137 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2011-1-2 17:36:29    创建新进程    阻止
进程: c:\documents and settings\administrator\桌面\ras\ras.exe
目标: c:\windows\system32\cmd.exe
命令行: C:\WINDOWS\system32\cmd.exe /c ping 127.0.0.1 -n 3&del /q "C:\Documents and Settings\Administrator\桌面\RAS\RAS.exe"
规则: [应用程序组]所有程序规则-系统程序执行规则 -> [应用程序]* -> [子应用程序]c:\windows\system32\cmd.exe

回复

举报

414447992
发表于 2011-1-2 17:45:50 | 显示全部楼层
要体谅人家人手不够嘛
回复

举报

留侯
发表于 2011-1-2 18:51:56 | 显示全部楼层
大蜘蛛clean，加了壳:
RAS.exe packed by UPX
>>RAS.exe - archive AUTOIT
>>>RAS.exe/DOCUME~1\ADMINI~1\LOCALS~1\Temp\aut5C2F.tmp packed by ASCRIPT
已上报！
回复

举报

贝贝托罗
发表于 2011-1-2 18:52:27 | 显示全部楼层
瑞星秒杀
回复

举报

cwcwcw123321
发表于 2011-1-2 18:54:01 | 显示全部楼层
费尔kill~
回复

举报

ppy0606
发表于 2011-1-2 19:20:52 | 显示全部楼层
2011-01-02 19:14:22    创建新进程    允许
进程: c:\windows\explorer.exe
目标: d:\我的文档\viurs test\ras\ras.exe
命令行: "d:\我的文档\viurs test\RAS\RAS.exe"
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]d:\我的文档\*

2011-01-02 19:14:25    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Program Files\Common Files\Exist.ini
规则: [文件组]全局写入询问 -> [文件]?:\program files\*

2011-01-02 19:14:26    修改注册表值    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2011-01-02 19:14:27    修改注册表值    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2011-01-02 19:14:27    修改注册表值    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2011-01-02 19:14:28    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Cookies\index.dat
规则: [文件组]限制写入组 -> [文件]?:\documents and settings\*\cookies\*

2011-01-02 19:14:28    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:28    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:28    修改注册表值    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData
值: C:\Documents and Settings\All Users\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2011-01-02 19:14:28    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:29    修改注册表值    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2011-01-02 19:14:29    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:29    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:29    修改注册表值    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2011-01-02 19:14:30    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:30    修改注册表值    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2011-01-02 19:14:30    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:30    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:30    修改注册表值    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2011-01-02 19:14:31    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:31    修改注册表值    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2011-01-02 19:14:32    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:32    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:33    修改注册表值    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2011-01-02 19:14:34    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:36    修改注册表值    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2011-01-02 19:14:36    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:36    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:36    修改注册表值    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2011-01-02 19:14:37    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:37    修改注册表值    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2011-01-02 19:14:37    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:37    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:38    修改注册表值    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2011-01-02 19:14:39    修改文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: \Device\NamedPipe\ROUTER
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [文件]\device\namedpipe\*

2011-01-02 19:14:39    修改注册表值    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [注册表组]资源管理器相关设置 -> [注册表]*\Software\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051[1].exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051[2].exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051[3].exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051[4].exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051[5].exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051[6].exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051[7].exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051[8].exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051[9].exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051[10].exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051[11].exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLH.exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57.exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VD.exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1.exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMAD.exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5.exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKB.exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8.exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQ.exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEU.exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJE.exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2H.exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2Z.exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDI.exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3.exe
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7K.ex
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCAN
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\FunshionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCAN
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\hionInstall_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCANX5JN
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\all_C12051CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCANX5JNUCAI6RP5
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\51CA7D6NLHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCANX5JNUCAI6RP5OCA2MH1J
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\LHCAZVQC57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCANX5JNUCAI6RP5OCA2MH1JLCAQNOD8
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\57CAZ6M9VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCANX5JNUCAI6RP5OCA2MH1JLCAQNOD8CCAZKI7V
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\VDCA8E7JA1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCANX5JNUCAI6RP5OCA2MH1JLCAQNOD8CCAZKI7VRCA7IOQY
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\A1CAI8CMADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCANX5JNUCAI6RP5OCA2MH1JLCAQNOD8CCAZKI7VRCA7IOQYGCADH249
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\ADCASAH3J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCANX5JNUCAI6RP5OCA2MH1JLCAQNOD8CCAZKI7VRCA7IOQYGCADH249WCACY86T
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\J5CAAIXPKBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCANX5JNUCAI6RP5OCA2MH1JLCAQNOD8CCAZKI7VRCA7IOQYGCADH249WCACY86THCAVBR8G
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\KBCA05D6E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCANX5JNUCAI6RP5OCA2MH1JLCAQNOD8CCAZKI7VRCA7IOQYGCADH249WCACY86THCAVBR8G5CA4UG11
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\E8CA7H92VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCANX5JNUCAI6RP5OCA2MH1JLCAQNOD8CCAZKI7VRCA7IOQYGCADH249WCACY86THCAVBR8G5CA4UG11QCA5Q919
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\VQCA3K7HEUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCANX5JNUCAI6RP5OCA2MH1JLCAQNOD8CCAZKI7VRCA7IOQYGCADH249WCACY86THCAVBR8G5CA4UG11QCA5Q9192CAG188Y
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\EUCA6UJFJECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCANX5JNUCAI6RP5OCA2MH1JLCAQNOD8CCAZKI7VRCA7IOQYGCADH249WCACY86THCAVBR8G5CA4UG11QCA5Q9192CAG188YZCATRDQC
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\JECAXUYB2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCANX5JNUCAI6RP5OCA2MH1JLCAQNOD8CCAZKI7VRCA7IOQYGCADH249WCACY86THCAVBR8G5CA4UG11QCA5Q9192CAG188YZCATRDQCECAGDQDZ
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\2HCANE7P2ZCAVRFLDICA9JPNW3CA6QIX7KCANX5JNUCAI6RP5OCA2MH1JLCAQNOD8CCAZKI7VRCA7IOQYGCADH249WCACY86THCAVBR8G5CA4UG11QCA5Q9192CAG188YZCATRDQCECAGDQDZPCAR7689
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\2ZCAVRFLDICA9JPNW3CA6QIX7KCANX5JNUCAI6RP5OCA2MH1JLCAQNOD8CCAZKI7VRCA7IOQYGCADH249WCACY86THCAVBR8G5CA4UG11QCA5Q9192CAG188YZCATRDQCECAGDQDZPCAR7689CCA24C7J
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\DICA9JPNW3CA6QIX7KCANX5JNUCAI6RP5OCA2MH1JLCAQNOD8CCAZKI7VRCA7IOQYGCADH249WCACY86THCAVBR8G5CA4UG11QCA5Q9192CAG188YZCATRDQCECAGDQDZPCAR7689CCA24C7J4CAC1EN8
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\W3CA6QIX7KCANX5JNUCAI6RP5OCA2MH1JLCAQNOD8CCAZKI7VRCA7IOQYGCADH249WCACY86THCAVBR8G5CA4UG11QCA5Q9192CAG188YZCATRDQCECAGDQDZPCAR7689CCA24C7J4CAC1EN8RCADKF0L
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\7KCANX5JNUCAI6RP5OCA2MH1JLCAQNOD8CCAZKI7VRCA7IOQYGCADH249WCACY86THCAVBR8G5CA4UG11QCA5Q9192CAG188YZCATRDQCECAGDQDZPCAR7689CCA24C7J4CAC1EN8RCADKF0LFCATJZ48
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\NUCAI6RP5OCA2MH1JLCAQNOD8CCAZKI7VRCA7IOQYGCADH249WCACY86THCAVBR8G5CA4UG11QCA5Q9192CAG188YZCATRDQCECAGDQDZPCAR7689CCA24C7J4CAC1EN8RCADKF0LFCATJZ48GCAYDK9E
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:45    创建文件    阻止
进程: d:\我的文档\viurs test\ras\ras.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\TNBEBY90\5OCA2MH1JLCAQNOD8CCAZKI7VRCA7IOQYGCADH249WCACY86THCAVBR8G5CA4UG11QCA5Q9192CAG188YZCATRDQCECAGDQDZPCAR7689CCA24C7J4CAC1EN8RCADKF0LFCATJZ48GCAYDK9EWCAB1U74
规则: [文件组]IE Cache -> [文件]*\temporary internet files\*; *.exe

2011-01-02 19:14:48    创建文件    允许
进程: d:\我的文档\viurs test\ras\ras.exe
目标: D:\我的文档\viurs test\RAS\FunshionInstall_C12051.exe
规则: [文件组]Documents and Settings_阻止 -> [文件]d:\我的文档\*; *.exe

2011-01-02 19:16:59    创建新进程    允许
进程: c:\windows\explorer.exe
目标: d:\我的文档\viurs test\ras\funshioninstall_c12051.exe
命令行: "d:\我的文档\viurs test\RAS\FunshionInstall_C12051.exe"
规则: [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]d:\我的文档\*

------------------------------------------------------------------------------------------




本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

lnbxdjh
发表于 2011-1-2 19:22:10 | 显示全部楼层
卡巴秒杀
回复

举报

下一页 »
1234下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-2-9 07:09 , Processed in 0.095123 second(s), 15 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表