收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 病毒样本 分享&分析区 › FAKE VIRUS
12下一页
返回列表 发新帖
查看: 2477|回复: 12
收起左侧

[可疑文件] FAKE VIRUS

[复制链接]
kurakimai
发表于 2011-4-28 17:44:45 | 显示全部楼层 |阅读模式
麻烦看看行为

是不是误报

谢谢

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

bluelily
发表于 2011-4-28 17:52:02 | 显示全部楼层
过IK 红伞
回复

举报

minchaovip
发表于 2011-4-28 17:53:42 | 显示全部楼层
回复 1楼 kurakimai 的帖子

看

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

594157544
发表于 2011-4-28 18:05:00 | 显示全部楼层
本帖最后由 594157544 于 2011-4-28 18:08 编辑

2011-04-28 18:03:09 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\WINDOWS\system32\imm32.dll C:\WINDOWS\system32\imm32.dll
2011-04-28 18:03:09 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\WINDOWS\system32\imm32.dll C:\WINDOWS\system32\imm32.dll
2011-04-28 18:03:09 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\WINDOWS\system32\lpk.dll C:\WINDOWS\system32\lpk.dll
2011-04-28 18:03:09 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\WINDOWS\system32\usp10.dll C:\WINDOWS\system32\usp10.dll
2011-04-28 18:03:09 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
2011-04-28 18:03:09 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll C:\Program Files\Common Files\Kingsoft\kiscommon\security\ksde\kisdcom.dll
2011-04-28 18:03:09 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\WINDOWS\system32\uxtheme.dll C:\WINDOWS\system32\uxtheme.dll
2011-04-28 18:03:09 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\kwsui.dll C:\Program Files\Common Files\Kingsoft\kiscommon\kwsui.dll
2011-04-28 18:03:09 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\WINDOWS\system32\psapi.dll C:\WINDOWS\system32\psapi.dll
2011-04-28 18:03:09 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\WINDOWS\system32\winmm.dll C:\WINDOWS\system32\winmm.dll
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\Program Files\Common Files\Kingsoft\kiscommon\kswebshield.dll C:\Program Files\Common Files\Kingsoft\kiscommon\kswebshield.dll
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\WINDOWS\system32\ws2_32.dll C:\WINDOWS\system32\ws2_32.dll
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\WINDOWS\system32\ws2help.dll C:\WINDOWS\system32\ws2help.dll
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件D:\Program Files\KSafe\ksfmon.dll D:\Program Files\KSafe\ksfmon.dll
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\WINDOWS\system32\MSCTF.dll C:\WINDOWS\system32\MSCTF.dll
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\WINDOWS\system32\shfolder.dll C:\WINDOWS\system32\shfolder.dll
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\WINDOWS\system32\setupapi.dll C:\WINDOWS\system32\setupapi.dll
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b663-70db-11e0-a395-806d6172696f}\ HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b663-70db-11e0-a395-806d6172696f}\
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b663-70db-11e0-a395-806d6172696f} HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b663-70db-11e0-a395-806d6172696f}
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b662-70db-11e0-a395-806d6172696f}\ HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b662-70db-11e0-a395-806d6172696f}\
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b662-70db-11e0-a395-806d6172696f} HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b662-70db-11e0-a395-806d6172696f}
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b666-70db-11e0-a395-806d6172696f}\ HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b666-70db-11e0-a395-806d6172696f}\
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b666-70db-11e0-a395-806d6172696f} HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b666-70db-11e0-a395-806d6172696f}
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b665-70db-11e0-a395-806d6172696f}\ HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b665-70db-11e0-a395-806d6172696f}\
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b665-70db-11e0-a395-806d6172696f} HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b665-70db-11e0-a395-806d6172696f}
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b664-70db-11e0-a395-806d6172696f}\ HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b664-70db-11e0-a395-806d6172696f}\
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b664-70db-11e0-a395-806d6172696f} HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b664-70db-11e0-a395-806d6172696f}
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b660-70db-11e0-a395-806d6172696f}\ HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b660-70db-11e0-a395-806d6172696f}\
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b660-70db-11e0-a395-806d6172696f} HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3dc3b660-70db-11e0-a395-806d6172696f}
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F1.tmp C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F1.tmp
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F1.tmp C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F1.tmp
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\WINDOWS\system32\riched20.dll C:\WINDOWS\system32\riched20.dll
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\WINDOWS\system32\MSCTFIME.IME C:\WINDOWS\system32\MSCTFIME.IME
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\nsDialogs.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\nsDialogs.dll
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\nsDialogs.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\nsDialogs.dll
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\nsDialogs.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\nsDialogs.dll
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\nsDialogs.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\nsDialogs.dll
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe发送消息C:\Program Files\Common Files\Kingsoft\kiscommon\ksandbox.exe C:\Program Files\Common Files\Kingsoft\kiscommon\ksandbox.exe
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe发送消息C:\WINDOWS\explorer.exe C:\WINDOWS\explorer.exe
2011-04-28 18:03:10 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe发送消息C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\ctfmon.exe
2011-04-28 18:03:20 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe发送消息C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\ESET\ESET Smart Security\egui.exe
2011-04-28 18:03:20 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe发送消息C:\WINDOWS\explorer.exe C:\WINDOWS\explorer.exe
2011-04-28 18:03:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe发送消息C:\Program Files\Common Files\Kingsoft\kiscommon\ksandbox.exe C:\Program Files\Common Files\Kingsoft\kiscommon\ksandbox.exe
2011-04-28 18:03:28 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\rfa.dat C:\Documents and Settings\CSIOSI\Local Settings\Temp\rfa.dat
2011-04-28 18:03:28 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\rfa.dat C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\rfa.dat
2011-04-28 18:03:28 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\rfaproc.dat C:\Documents and Settings\CSIOSI\Local Settings\Temp\rfaproc.dat
2011-04-28 18:03:28 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\rfaproc.dat C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\rfaproc.dat
2011-04-28 18:03:28 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProc.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProc.dll
2011-04-28 18:03:28 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProc.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProc.dll
2011-04-28 18:03:28 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProc.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProc.dll
2011-04-28 18:03:28 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProc.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProc.dll
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillAntivirusLive.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillAntivirusLive.dll
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillAntivirusLive.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillAntivirusLive.dll
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillAntivirusLive.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillAntivirusLive.dll
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProcRand.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProcRand.dll
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProcRand.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProcRand.dll
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProcRand.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProcRand.dll
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProcRand.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProcRand.dll
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\killprocbypath.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\killprocbypath.dll
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\killprocbypath.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\killprocbypath.dll
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\killprocbypath.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\killprocbypath.dll
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\killprocbypath.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\killprocbypath.dll
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\killprocbypath.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\killprocbypath.dll
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll
2011-04-28 18:03:39 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll
2011-04-28 18:03:41 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe发送消息C:\Documents and Settings\CSIOSI\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\CSIOSI\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
2011-04-28 18:03:41 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll
2011-04-28 18:03:42 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll
2011-04-28 18:03:49 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe发送消息C:\Program Files\Common Files\Kingsoft\kiscommon\ksandbox.exe C:\Program Files\Common Files\Kingsoft\kiscommon\ksandbox.exe
2011-04-28 18:03:49 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll
2011-04-28 18:03:49 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\Registry.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\Registry.dll
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\Registry.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\Registry.dll
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe加载库文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\Registry.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\Registry.dll


回复

举报

留侯
发表于 2011-4-28 18:07:25 | 显示全部楼层
大蜘蛛clean，文件加了壳：
Remove Fake Antivirus.exe - archive NSIS

Remove Fake Antivirus.exe/___\KillProc.dll packed by UPX
回复

举报

594157544
发表于 2011-4-28 18:08:35 | 显示全部楼层
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\Registry.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\Registry.dll
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Control Panel\don't load HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Control Panel\don't load
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Policies\System HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Policies\System
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\Registry.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\Registry.dll
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除注册表键值HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\InprocServer32 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\InprocServer32
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除注册表键值HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000} HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除注册表键值HKEY_LOCAL_MACHINE\SOFTWARE\Program Groups HKEY_LOCAL_MACHINE\SOFTWARE\Program Groups
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建文件C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\Registry.dll C:\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\Registry.dll
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Internet Explorer\Download HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Internet Explorer\Download
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Internet Explorer\Download HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Internet Explorer\Download
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_LOCAL_MACHINE\SOFTWARE\kingsoft\KSBReg\C75AD9AC\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc HKEY_LOCAL_MACHINE\SOFTWARE\kingsoft\KSBReg\C75AD9AC\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_LOCAL_MACHINE\SOFTWARE\kingsoft\KSBReg\C75AD9AC\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc HKEY_LOCAL_MACHINE\SOFTWARE\kingsoft\KSBReg\C75AD9AC\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_LOCAL_MACHINE\SOFTWARE\kingsoft\KSBReg\C75AD9AC\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc HKEY_LOCAL_MACHINE\SOFTWARE\kingsoft\KSBReg\C75AD9AC\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:23 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_USERS\S-1-5-21-725345543-1580818891-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\rfa.dat C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\rfa.dat
2011-04-28 18:04:24 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\rfaproc.dat C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\rfaproc.dat
2011-04-28 18:04:36 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe发送消息C:\Documents and Settings\CSIOSI\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\CSIOSI\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
2011-04-28 18:05:35 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe发送消息C:\WINDOWS\explorer.exe C:\WINDOWS\explorer.exe
2011-04-28 18:05:40 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe发送消息C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\ctfmon.exe
2011-04-28 18:05:40 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe发送消息C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\ESET\ESET Smart Security\egui.exe
2011-04-28 18:05:40 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe发送消息C:\WINDOWS\explorer.exe C:\WINDOWS\explorer.exe
2011-04-28 18:05:45 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillAntivirusLive.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillAntivirusLive.dll
2011-04-28 18:05:45 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProc.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProc.dll
2011-04-28 18:05:45 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\killprocbypath.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\killprocbypath.dll
2011-04-28 18:05:45 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProcRand.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\KillProcRand.dll
2011-04-28 18:05:45 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\md5dll.dll
2011-04-28 18:05:45 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\nsDialogs.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\nsDialogs.dll
2011-04-28 18:05:45 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\Registry.dll C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp\Registry.dll
2011-04-28 18:05:45 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager
2011-04-28 18:05:45 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
2011-04-28 18:05:45 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe删除文件C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp C:\KSafeBox\C75AD9AC\Documents and Settings\CSIOSI\Local Settings\Temp\nsq81F2.tmp
2011-04-28 18:05:45 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe创建注册表键值HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager
2011-04-28 18:05:45 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe写注册表HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
2011-04-28 18:05:45 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe发送消息C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\ctfmon.exe
2011-04-28 18:05:45 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe发送消息C:\WINDOWS\explorer.exe C:\WINDOWS\explorer.exe
2011-04-28 18:05:45 C:\Documents and Settings\CSIOSI\My Documents\Downloads\Remove Fake Antivirus\Remove Fake Antivirus.exe发送消息C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\ESET\ESET Smart Security\egui.exe
回复

举报

kurakimai
 楼主| 发表于 2011-4-28 18:13:26 | 显示全部楼层
只要改注册表

我就觉得不好
回复

举报

kurakimai
 楼主| 发表于 2011-4-28 18:17:17 | 显示全部楼层
回复 6楼 594157544 的帖子

感觉行为和那两个很像
回复

举报

kurakimai
 楼主| 发表于 2011-4-28 18:18:07 | 显示全部楼层
回复 5楼 留侯 的帖子

上报了吗？
回复

举报

留侯
发表于 2011-4-28 18:22:51 | 显示全部楼层
回复 9楼 kurakimai 的帖子

已上报！
回复

举报

下一页 »
12下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-6-14 13:48 , Processed in 0.141666 second(s), 18 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表