VIRUS

Mr.舞步

2011-04-16 19:01:50 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\system32\imm32.dll C:\WINDOWS\system32\imm32.dll
2011-04-16 19:01:50 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\system32\imm32.dll C:\WINDOWS\system32\imm32.dll
2011-04-16 19:01:50 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll
2011-04-16 19:01:50 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\system32\mscoree.dll C:\WINDOWS\system32\mscoree.dll
2011-04-16 19:01:50 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\Program Files\KSafe\ksfmon.dll C:\Program Files\KSafe\ksfmon.dll
2011-04-16 19:01:50 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\kwsui.dll C:\Program Files\Common Files\Kingsoft\kiscommon\kwsui.dll
2011-04-16 19:01:50 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
2011-04-16 19:01:50 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\kswebshield.dll C:\Program Files\Common Files\Kingsoft\kiscommon\kswebshield.dll
2011-04-16 19:01:50 C:\Documents and Settings\Administrator\桌面\123.exe创建注册表键值HKEY_USERS\S-1-5-21-861567501-562591055-1417001333-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_USERS\S-1-5-21-861567501-562591055-1417001333-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
2011-04-16 19:01:51 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\system32\MSCTF.dll C:\WINDOWS\system32\MSCTF.dll
2011-04-16 19:01:51 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
2011-04-16 19:01:51 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll
2011-04-16 19:01:51 C:\Documents and Settings\Administrator\桌面\123.exe创建注册表键值HKEY_USERS\S-1-5-21-861567501-562591055-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_USERS\S-1-5-21-861567501-562591055-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2011-04-16 19:01:51 C:\Documents and Settings\Administrator\桌面\123.exe创建注册表键值HKEY_USERS\S-1-5-21-861567501-562591055-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-861567501-562591055-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-16 19:01:51 C:\Documents and Settings\Administrator\桌面\123.exe写注册表HKEY_USERS\S-1-5-21-861567501-562591055-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-861567501-562591055-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-16 19:01:51 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\dd1c3bc03126c64696ace94bb6231f5a\mscorlib.ni.dll C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\dd1c3bc03126c64696ace94bb6231f5a\mscorlib.ni.dll
2011-04-16 19:01:52 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\system32\rsaenh.dll C:\WINDOWS\system32\rsaenh.dll
2011-04-16 19:01:53 C:\Documents and Settings\Administrator\桌面\123.exe创建注册表键值HKEY_USERS\S-1-5-21-861567501-562591055-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_USERS\S-1-5-21-861567501-562591055-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2011-04-16 19:01:53 C:\Documents and Settings\Administrator\桌面\123.exe创建注册表键值HKEY_USERS\S-1-5-21-861567501-562591055-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-861567501-562591055-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-16 19:01:53 C:\Documents and Settings\Administrator\桌面\123.exe写注册表HKEY_USERS\S-1-5-21-861567501-562591055-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-861567501-562591055-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-16 19:01:54 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
2011-04-16 19:01:54 C:\Documents and Settings\Administrator\桌面\123.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
2011-04-16 19:01:54 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\380d6373f0c4c245979c872b9b70076c\System.ni.dll C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\380d6373f0c4c245979c872b9b70076c\System.ni.dll
2011-04-16 19:01:54 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\aa8f1b87fbd17944a95a78e8938370a5\System.Drawing.ni.dll C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\aa8f1b87fbd17944a95a78e8938370a5\System.Drawing.ni.dll
2011-04-16 19:01:54 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d73646bb758373439eead4e8dcc8c161\System.Windows.Forms.ni.dll C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d73646bb758373439eead4e8dcc8c161\System.Windows.Forms.ni.dll
2011-04-16 19:01:58 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll
2011-04-16 19:01:59 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
2011-04-16 19:01:59 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\system32\faultrep.dll C:\WINDOWS\system32\faultrep.dll
2011-04-16 19:01:59 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\system32\winsta.dll C:\WINDOWS\system32\winsta.dll
2011-04-16 19:01:59 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\system32\netapi32.dll C:\WINDOWS\system32\netapi32.dll
2011-04-16 19:01:59 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\system32\wtsapi32.dll C:\WINDOWS\system32\wtsapi32.dll
2011-04-16 19:01:59 C:\Documents and Settings\Administrator\桌面\123.exe加载库文件C:\WINDOWS\system32\setupapi.dll C:\WINDOWS\system32\setupapi.dll
2011-04-16 19:01:59 C:\Documents and Settings\Administrator\桌面\123.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Microsoft\PCHealth\ErrorReporting HKEY_LOCAL_MACHINE\Software\Microsoft\PCHealth\ErrorReporting
2011-04-16 19:02:00 C:\Documents and Settings\Administrator\桌面\123.exe删除注册表键值HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW
2011-04-16 19:02:00 C:\Documents and Settings\Administrator\桌面\123.exe创建注册表键值HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting\ExclusionList HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting\ExclusionList
2011-04-16 19:02:00 C:\Documents and Settings\Administrator\桌面\123.exe创建注册表键值HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting\InclusionList HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting\InclusionList
2011-04-16 19:02:01 C:\Documents and Settings\Administrator\桌面\123.exe发送消息C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\ctfmon.exe
2011-04-16 19:02:01 C:\Documents and Settings\Administrator\桌面\123.exe发送消息C:\WINDOWS\explorer.exe C:\WINDOWS\explorer.exe
2011-04-16 19:02:01 结束进程C:\Documents and Settings\Administrator\桌面\123.exe C:\Documents and Settings\Administrator\桌面\123.exe

kinkids

掃瞄偵測為【】，
已進行隔離/刪除動作。

掃瞄偵測到【】個惡意檔案，【】個 Kaspersky Cloud，【】個啟發，【】個特徵碼，
一隻病毒一條特徵碼，傻眼，囧rz，
剩餘【1】個可疑文件MISS，無威脅存在，已提交至 Kaspersky 分析行為。

jason_jiang

to sophos

F-secure2009

TP干掉