setup.exe x1

z2009

金山卫士报木马
过Norton

Mr.XCLK

金山报木马

a445441

360KILL

schumi小粉

回复 10楼 jayavira 的帖子

已经email 了~

jayavira

回复 14楼 schumi小粉 的帖子

嗯
以后请记得在帖子上说明一下

schumi小粉

回复 15楼 jayavira 的帖子

恩，之前已经写上去啦，你没看见来，打下PP

zuo

2011-2-27 20:00:42    创建新进程    允许
进程: c:\documents and settings\administrator\桌面\setupol\setupol\setup(1).exe
目标: c:\documents and settings\administrator\local settings\temp\is-2mj30.tmp\setup(1).tmp
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-2MJ30.tmp\setup(1).tmp" /SL5="$2F026A,1668437,53248,C:\Documents and Settings\Administrator\桌面\setupol\setupol\setup(1).exe"
规则: [应用程序组]所有程序规则-外部程序执行规则 -> [应用程序]* -> [子应用程序]*temp\*.tmp

2011-2-27 20:00:44    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-2mj30.tmp\setup(1).tmp
目标: C:\Program Files\newname\InstallDll.dll
规则: [文件组]文件安全读写规则(询问创建) -> [文件]*\program files\*; *.dll

2011-2-27 20:00:47    创建文件夹    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-2mj30.tmp\setup(1).tmp
目标: C:\WINDOWS\vistaw7
规则: [文件组]系统文件夹写保护(询问创建、修改) -> [文件]c:\windows

2011-2-27 20:00:47    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-2mj30.tmp\setup(1).tmp
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\uic\Shell\Open\Command
值: "Rundll32.exe" "C:\WINDOWS\vistaw7\nwinms.inn" readfile
规则: [应用程序组]4D规则-安装进程例外规则 -> [注册表]HKEY_LOCAL_MACHINE\SOFTWARE\Classes\?*\shell\open\command

2011-2-27 20:00:48    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-2mj30.tmp\setup(1).tmp
目标: C:\WINDOWS\honst.lnk
规则: [文件组]文件安全读写规则(询问创建) -> [文件]c:\windows; *.*

2011-2-27 20:00:49    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-2mj30.tmp\setup(1).tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2011-2-27 20:00:49    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-2mj30.tmp\setup(1).tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2011-2-27 20:00:50    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-2mj30.tmp\setup(1).tmp
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2011-2-27 20:00:52    访问网络    阻止
进程: c:\documents and settings\administrator\local settings\temp\is-2mj30.tmp\setup(1).tmp
目标: TCP [本机 : 1731] ->  [118.123.17.100 : 8080]
规则: [应用程序组]4D规则-安装进程例外规则 -> [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

jayavira

回复 16楼 schumi小粉 的帖子

是啊，确实没有看到啊