感染系统文件的小马（流氓桌面图标病毒）

hddu

2011-03-25 20:04:51    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\attrib.exe
命令行:"C:\Documents and Settings\All Users\桌面\购物淘宝.bt" +r +s
触发规则:所有程序规则->系统程序设置->*\attrib.exe


2011-03-25 20:04:51    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\0.15.exe
文件路径:C:\WINDOWS\system32\13584653.exe
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->%WinDir%\system32\*


2011-03-25 20:04:51    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\购物淘宝.bt" /e /c /r Administrators
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:04:51    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\购物淘宝.bt" /e /c Administrators:CI
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:04:51    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\购物淘宝.bt" /e /c /r Administrator
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:04:52    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\购物淘宝.bt" /e /c /r users
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:04:52    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\购物淘宝.bt" /e /c /r system
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:04:53    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\购物淘宝.bt" /e /c /r everyone
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:04:53    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\购物淘宝.bt" /e /c /r user
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:04:54    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\购物淘宝.bt" /e /c /r "Power Users"
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:04:54    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\购物淘宝.bt" /e /c /r "Administrator"
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:04:56    修改注册表内容      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
注册表名称:ShowSuperHidden
触发规则:所有程序规则->资源管理器->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced*


2011-03-25 20:04:56    创建注册表值      操作:阻止
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
注册表名称:Hidden1
触发规则:所有程序规则->资源管理器->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced*


2011-03-25 20:04:56    修改注册表内容      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
注册表名称:HideFileExt
触发规则:所有程序规则->资源管理器->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced*


2011-03-25 20:04:58    创建文件      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\SetWindowsIndex.reg
触发规则:所有程序规则->白名单与黑名单->*\*.reg


2011-03-25 20:05:00    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\regedit.exe
命令行:/s C:\WINDOWS\SetWindowsIndex.reg
触发规则:所有程序规则->系统程序设置->*\regedit.exe


2011-03-25 20:05:00    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\链接\4399小游戏.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:00    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\常用\4399小游戏.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:00    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\4399小游戏.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:00    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\链接\高清电影.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:00    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\常用\高清电影.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:00    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\高清电影.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\链接\无屏蔽搜索.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\常用\无屏蔽搜索.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\无屏蔽搜索.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\链接\百度搜索.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\常用\百度搜索.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\百度搜索.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\链接\起点小说.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\常用\起点小说.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\起点小说.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\链接\淘宝购物.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\常用\淘宝购物.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\淘宝购物.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\链接\网络创业秘籍.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\常用\网络创业秘籍.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\网络创业秘籍.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\链接\网址大全.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\常用\网址大全.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\网址大全.url
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Favorites\*


2011-03-25 20:05:01    创建文件      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\MYShowIeLinkIe6.reg
触发规则:所有程序规则->白名单与黑名单->*\*.reg


2011-03-25 20:05:01    创建文件      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\MyShowIeLinkIe7.reg
触发规则:所有程序规则->白名单与黑名单->*\*.reg


2011-03-25 20:05:04    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\regedit.exe
命令行:/s C:\WINDOWS\MYShowIeLinkIe6.reg
触发规则:所有程序规则->系统程序设置->*\regedit.exe


2011-03-25 20:05:06    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\regedit.exe
命令行:/s C:\WINDOWS\MyShowIeLinkIe7.reg
触发规则:所有程序规则->系统程序设置->*\regedit.exe


2011-03-25 20:05:06    创建文件      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\cdxfhe.vbs
触发规则:所有程序规则->WINDOWS全局设置->%windir%\*


2011-03-25 20:05:06    修改注册表内容      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
注册表路径:HKEY_CLASSES_ROOT\tt\shell\open\command
注册表名称:[Default]
触发规则:所有程序规则->文件类型关联->HKEY_CLASSES_ROOT\*\command*


2011-03-25 20:05:06    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\All Users\桌面\Internet Explorer.tt
触发规则:所有程序规则->Documents and Settings设置（二）->*\Int*Exp*


2011-03-25 20:05:06    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\attrib.exe
命令行:"C:\Documents and Settings\All Users\桌面\Internet Explorer.tt" +r +s
触发规则:所有程序规则->系统程序设置->*\attrib.exe


2011-03-25 20:05:07    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\Internet Explorer.tt" /e /c /r Administrators
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:07    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\Internet Explorer.tt" /e /c Administrators:CI
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:08    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\Internet Explorer.tt" /e /c /r Administrator
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:08    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\Internet Explorer.tt" /e /c /r users
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:08    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\Internet Explorer.tt" /e /c /r system
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:09    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\Internet Explorer.tt" /e /c /r everyone
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:09    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\Internet Explorer.tt" /e /c /r user
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:10    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\Internet Explorer.tt" /e /c /r "Power Users"
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:10    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\Internet Explorer.tt" /e /c /r "Administrator"
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:11    修改注册表内容      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
注册表路径:HKEY_CLASSES_ROOT\css\shell\open\command
注册表名称:[Default]
触发规则:所有程序规则->文件类型关联->HKEY_CLASSES_ROOT\*\command*


2011-03-25 20:05:11    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\Internet Explorer.css
触发规则:所有程序规则->Documents and Settings设置（二）->*\Int*Exp*


2011-03-25 20:05:11    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\attrib.exe
命令行:"C:\Documents and Settings\All Users\「开始」菜单\程序\Internet Explorer.css" +r +s
触发规则:所有程序规则->系统程序设置->*\attrib.exe


2011-03-25 20:05:11    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\「开始」菜单\程序\Internet Explorer.css" /e /c /r Administrators
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:12    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\「开始」菜单\程序\Internet Explorer.css" /e /c Administrators:CI
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:12    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\「开始」菜单\程序\Internet Explorer.css" /e /c /r Administrator
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:13    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\「开始」菜单\程序\Internet Explorer.css" /e /c /r users
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:13    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\「开始」菜单\程序\Internet Explorer.css" /e /c /r system
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:13    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\「开始」菜单\程序\Internet Explorer.css" /e /c /r everyone
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:14    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\「开始」菜单\程序\Internet Explorer.css" /e /c /r user
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:15    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\「开始」菜单\程序\Internet Explorer.css" /e /c /r "Power Users"
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:15    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\「开始」菜单\程序\Internet Explorer.css" /e /c /r "Administrator"
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:15    创建文件      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css
触发规则:所有程序规则->Documents and Settings设置（一）->?:\Documents and Settings\*\Application Data\Microsoft\Internet Explorer\Quick Launch\*Internet*Explorer*


2011-03-25 20:05:15    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\attrib.exe
命令行:"C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" +r +s
触发规则:所有程序规则->系统程序设置->*\attrib.exe


2011-03-25 20:05:16    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r Administrators
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:16    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c Administrators:CI
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:16    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r Administrator
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:17    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r users
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:18    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r system
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:18    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r everyone
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:19    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r user
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:19    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r "Power Users"
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:20    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r "Administrator"
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:21    修改注册表内容      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
注册表路径:HKEY_CLASSES_ROOT\bt\shell\open\command
注册表名称:[Default]
触发规则:所有程序规则->文件类型关联->HKEY_CLASSES_ROOT\*\command*


2011-03-25 20:05:21    创建文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\All Users\桌面\特价购物.bt
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\桌面\*


2011-03-25 20:05:21    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\attrib.exe
命令行:"C:\Documents and Settings\All Users\桌面\特价购物.bt" +r +s
触发规则:所有程序规则->系统程序设置->*\attrib.exe


2011-03-25 20:05:21    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\特价购物.bt" /e /c /r Administrators
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:22    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\特价购物.bt" /e /c Administrators:CI
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:22    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\特价购物.bt" /e /c /r Administrator
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:23    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\特价购物.bt" /e /c /r users
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:24    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\特价购物.bt" /e /c /r system
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:25    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\特价购物.bt" /e /c /r everyone
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:25    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\特价购物.bt" /e /c /r user
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:26    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\特价购物.bt" /e /c /r "Power Users"
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:27    运行应用程序      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\cacls.exe
命令行:"C:\Documents and Settings\All Users\桌面\特价购物.bt" /e /c /r "Administrator"
触发规则:所有程序规则->系统程序设置->*\cacls.exe


2011-03-25 20:05:28    修改注册表内容      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
注册表路径:HKEY_CLASSES_ROOT\shb\shell\open\command
注册表名称:[Default]
触发规则:所有程序规则->文件类型关联->HKEY_CLASSES_ROOT\*\command*


2011-03-25 20:05:28    修改注册表内容      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
注册表名称:ShowSuperHidden
触发规则:所有程序规则->资源管理器->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced*


2011-03-25 20:05:28    创建注册表值      操作:阻止
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
注册表名称:Hidden1
触发规则:所有程序规则->资源管理器->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced*


2011-03-25 20:05:28    修改注册表内容      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
注册表名称:HideFileExt
触发规则:所有程序规则->资源管理器->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced*


2011-03-25 20:05:29    创建文件      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\启动\360vbs.jse
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\程序\启动\*


2011-03-25 20:05:30    创建文件      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\search.reg
触发规则:所有程序规则->白名单与黑名单->*\*.reg


2011-03-25 20:05:33    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\regedit.exe
命令行:/s C:\WINDOWS\search.reg
触发规则:所有程序规则->系统程序设置->*\regedit.exe


2011-03-25 20:05:34    加载库文件      操作:阻止
进程路径:C:\WINDOWS\system32\13584653.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ope27.tmp
触发规则:应用程序规则->加载库文件其他设置(一)->?:\*->?:\Documents and Settings\*\Local Settings\Temp\*


2011-03-25 20:05:34    创建文件      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\.reg
触发规则:所有程序规则->白名单与黑名单->*\*.reg


2011-03-25 20:05:34    修改文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\0.15.exe
文件路径:C:\WINDOWS\system32\drivers\pcidump.sys
触发规则:所有程序规则->驱动文件保护设置->%WinDir%\system32\drivers\*.sys


2011-03-25 20:05:42    创建注册表值      操作:阻止并结束进程
进程路径:C:\WINDOWS\system32\13584653.exe
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
注册表名称:360Soft
触发规则:应用程序规则->WINDOWS文件设置->%windir%\*->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*


2011-03-25 20:05:44    运行应用程序      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\regedit.exe
命令行:/s C:\WINDOWS\.reg
触发规则:所有程序规则->系统程序设置->*\regedit.exe


2011-03-25 20:05:46    模拟键盘鼠标      操作:阻止并结束进程
进程路径:C:\WINDOWS\system32\wscript.exe

触发规则:应用程序规则->系统程序->%windir%\system32\*script.exe


2011-03-25 20:05:46    模拟键盘鼠标      操作:阻止并结束进程
进程路径:C:\WINDOWS\system32\wscript.exe

触发规则:应用程序规则->系统程序->%windir%\system32\*script.exe

hj5abc

熊猫云 秒杀 Suspicious file

ppy0606

回复 11楼 hddu 的帖子

给力0....


比我的还多

shanghaiplmm

诺顿报Backdoor.Trojan

小飞侠.net

shanghaiplmm 发表于 2011-3-25 20:47
诺顿报Backdoor.Trojan

哟，诺顿夫人也在卡饭哇，偶是Crsky的小飞侠.net

hddu

ppy0606 发表于 2011-3-25 20:35
回复 11楼 hddu 的帖子

给力0....

还有几个程序很久无动静，无耐性等下去，手工结束了。

shanghaiplmm

小飞侠.net 发表于 2011-3-25 20:48
哟，诺顿夫人也在卡饭哇，偶是Crsky的小飞侠.net

我一看就是你,我这几天总上来.给诺顿报几个样本.

byxxdrls

C:\277.txt
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF2173.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\~Frm.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\0.15.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\07.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\1300.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\1300.exe.bat
C:\Documents and Settings\Administrator\Local Settings\Temp\306812.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\334046_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\367531_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\372734_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\380703_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\384328_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\390171_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\405281.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\423609_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\474140_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\490156_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\502750_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\508625_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\514625_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\525093_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\531250_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\536593_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\544593_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\559171_xeex.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e316640t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e353125t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e361109t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e367437t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e378375t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e388203t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e398156t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e428593t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e461281t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e477921t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e488296t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e499468t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e510234t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e523156t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e533531t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e542609t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e557437t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e578156t.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\kb076095.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb089375.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb110280.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb110749.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb224007.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb285645.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb378714.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb420824.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb451341.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb498539.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb502451.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb519808.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb543446.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb571366.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb644398.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb684281.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb687631.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb715654.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb743545.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb749536.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb787636.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb842811.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb859830.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb867007.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb898272.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb912844.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb991655.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\kb997728.sve
C:\Documents and Settings\Administrator\Local Settings\Temp\Loader_forqiqi_9179.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\admodule.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\audioswitcher.ax
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\chctrl.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\ckdll.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\client_ap.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\cmdline.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\CommonFuncDll.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\condisp.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\CoreAAC.ax
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\CoreAVC.2.0.0.0.ax
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\CoreAVC.ax
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\crashreporter.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\Favorites
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\filepick.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\FindProcDLL.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\FWUpnp.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\Gallop.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\GdiPlus.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\Hookkernel.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\HTTP_ASF_SOURCE.ax
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\IEBrowser.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\IEProxy.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\ikan-p.ico
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\InetLoad.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\Live.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\mframe.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\mir.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\MngModule.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\MP4Splitter.ax
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\NCList.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\omng.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\OPlayer.ocx
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\peer.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\pnsis.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\PPAP.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\PPChLocalManager.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\PPDialog.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\PPFlvCom.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\PPFrame.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\PPHookShell.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\PPInstallLog.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\PPLive.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\PPLiveU.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\pplugin.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\pplugin2.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\ppopt.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\PPOptions.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\ppp.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\pprepair.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\PPVodDownload.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\ProductUpdate.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\Send_Log_Kernel_Module.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\sop.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\sqlite3.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\System.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\time.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\TipsClient.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\tpi.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\Troubleshooter.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\ui.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\uilib.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\VAProxyD.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsb5.tmp\VSFilter.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\nsl4.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\ope1.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\ope2.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\p19.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\pctools.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.609
C:\Documents and Settings\Administrator\Local Settings\Temp\S2jlGHGO8KQh5bL.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\S2jlGHGO8KQh5bL.exe.bat
C:\Documents and Settings\Administrator\Local Settings\Temp\tempVidio.bat
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp.tmp
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\078XSN29\rk05[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\078XSN29\rk15[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6VK3MBOV\dnf[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6VK3MBOV\qq[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6VK3MBOV\rk02[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6VK3MBOV\rk09[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6VK3MBOV\rk13[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6VK3MBOV\rk17[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EKX9PIFK\rk03[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EKX9PIFK\rk10[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KXSPCVG7\rk06[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KXSPCVG7\rk08[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KXSPCVG7\rk12[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KXSPCVG7\rk16[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KXSPCVG7\rk23[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KXSPCVG7\rkcs[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KXSPCVG7\wendao[1].exe
C:\Program Files\Common Files\System\kb076095.dla
C:\Program Files\Common Files\System\kb089375.dmp
C:\Program Files\Common Files\System\kb089375.nvv
C:\Program Files\Common Files\System\kb110280.tra
C:\Program Files\Common Files\System\kb110749.rdc
C:\Program Files\Common Files\System\kb224007.tad
C:\Program Files\Common Files\System\kb285645.pfd
C:\Program Files\Common Files\System\kb378714.axt
C:\Program Files\Common Files\System\kb420824.rdc
C:\Program Files\Common Files\System\kb451341.nvv
C:\Program Files\Common Files\System\kb498539.nls
C:\Program Files\Common Files\System\kb502451.bwb
C:\Program Files\Common Files\System\kb502451.srd
C:\Program Files\Common Files\System\kb519808.dla
C:\Program Files\Common Files\System\kb543446.dla
C:\Program Files\Common Files\System\kb571366.CNT
C:\Program Files\Common Files\System\kb571366.tra
C:\Program Files\Common Files\System\kb644398.bwb
C:\Program Files\Common Files\System\kb684281.sve
C:\Program Files\Common Files\System\kb687631.fly
C:\Program Files\Common Files\System\kb715654.tad
C:\Program Files\Common Files\System\kb743545.tmt
C:\Program Files\Common Files\System\kb749536.CNT
C:\Program Files\Common Files\System\kb749536.dla
C:\Program Files\Common Files\System\kb787636.pfd
C:\Program Files\Common Files\System\kb842811.dla
C:\Program Files\Common Files\System\kb859830.cpu
C:\Program Files\Common Files\System\kb867007.srd
C:\Program Files\Common Files\System\kb898272.tmt
C:\Program Files\Common Files\System\kb912844.dmp
C:\Program Files\Common Files\System\kb991655.cpu
C:\Program Files\Common Files\System\kb997728.axe
C:\WINDOWS\20110325\2882rkG8285URBC8\script\reg.bat
C:\WINDOWS\20110325\2882rkG8285URBC8\script\regBHO.reg
C:\WINDOWS\20110325\2882rkG8285URBC8\script\script.exe
C:\WINDOWS\20110325\2882rkG8285URBC8\script\script.exe.bat
C:\WINDOWS\20110325\2882rkG8285URBC8\script\script.vbs
C:\WINDOWS\20110325\2882rkG8285URBC8\script\Script.vbs.bat
C:\WINDOWS\20110325\2882rkG8285URBC8\script\XlKankan.dll
C:\WINDOWS\20110325\8VVQf2W2KJvT8nf5
C:\WINDOWS\20110325\8VVQf2W2KJvT8nf5\smss.exe
C:\WINDOWS\20110325\8VVQf2W2KJvT8nf5\smss.exe.bat
C:\WINDOWS\explorer.exe
C:\WINDOWS\Fonts\pci.sys
C:\WINDOWS\Medie\csrcs.exe
C:\WINDOWS\sestuz.vbs
C:\WINDOWS\system32\312171.exe
C:\WINDOWS\system32\428843.exe
C:\WINDOWS\system32\bhoajessc.exe
C:\WINDOWS\system32\d3d8.dll.dat
C:\WINDOWS\system32\ddraw.dll.COPA
C:\WINDOWS\system32\ddraw.dll.dat
C:\WINDOWS\system32\dllcache
C:\WINDOWS\system32\dllcache\aec.sys.new
C:\WINDOWS\system32\dllcache\asyncmac.sys.new
C:\WINDOWS\system32\dllcache\d3d8.dll
C:\WINDOWS\system32\dllcache\ddraw.dll
C:\WINDOWS\system32\dllcache\dsound.dll
C:\WINDOWS\system32\dllcache\explorer.exe.new
C:\WINDOWS\system32\dllcache\hnetcfg.dll
C:\WINDOWS\system32\dllcache\olepro32.dll
C:\WINDOWS\system32\dllcache\rasadhlp.dll
C:\WINDOWS\system32\drivers\aec.SYS
C:\WINDOWS\system32\drivers\aec.sys.new
C:\WINDOWS\system32\drivers\AsyncMac.sys
C:\WINDOWS\system32\drivers\asyncmac.sys.new
C:\WINDOWS\system32\drivers\etc\hosts
C:\WINDOWS\system32\drivers\pcidump.sys
C:\WINDOWS\system32\drivers\Ra01.hm
C:\WINDOWS\system32\drivers\Ra02.hm
C:\WINDOWS\system32\drivers\Ra03.hm
C:\WINDOWS\system32\drivers\Ra04.hm
C:\WINDOWS\system32\drivers\Ra05.hm
C:\WINDOWS\system32\drivers\Ra06.hm
C:\WINDOWS\system32\drivers\Ra07.hm
C:\WINDOWS\system32\drivers\Ra08.hm
C:\WINDOWS\system32\drivers\Ra09.hm
C:\WINDOWS\system32\drivers\Ra10.hm
C:\WINDOWS\system32\drivers\Ra11.hm
C:\WINDOWS\system32\drivers\Ra13.hm
C:\WINDOWS\system32\drivers\Ra14.hm
C:\WINDOWS\system32\drivers\Ra15.hm
C:\WINDOWS\system32\drivers\Ra16.hm
C:\WINDOWS\system32\drivers\Ra17.hm
C:\WINDOWS\system32\drivers\Ra18.hm
C:\WINDOWS\system32\drivers\Ra26.hm
C:\WINDOWS\system32\dsound.dll
C:\WINDOWS\system32\dsound.dll.dat
C:\WINDOWS\system32\effbhblpc.exe
C:\WINDOWS\system32\hnetcfg.dll.dat
C:\WINDOWS\system32\killdll.dll
C:\WINDOWS\system32\Macromed\Flash
C:\WINDOWS\system32\olepro32.dll.dat
C:\WINDOWS\system32\rasadhlp.dll.dat
C:\WINDOWS\system32\wbem\Logs
C:\WINDOWS\system32\wbem\Logs\wbemcore.log
C:\WINDOWS\system32\wbem\Logs\wmiprov.log
C:\WINDOWS\system32\XlKankan.dll
C:\WINDOWS\system32\xvhost.sb
C:\WINDOWS\tao.ico
C:\WINDOWS\temp
C:\WINDOWS\temp\Explorer.exe
C:\WINDOWS\userid.txt

thtthb

在文件“C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Download\temp\dl_32.tmp”中检测到病毒或
恶意程序“TR/Crypt.ZPACK.Gen [trojan]”。
执行的操作:覆盖文件

jjtony2

回复 1楼 小飞侠.net 的帖子

楼主的天网令我很是惊讶……