|
  
- UID
- 112152
- 积分
- 5623
- 金元
- 1391 JY
- 金分
- 22402 JF
- 活跃度
- 14020
           
|
沙发
发表于 2008-2-7 09:52
| 只看该作者
2008-2-7 9:37:54 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.797\Happy new year.exe (PID: 2824): 可疑操作,试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL 值: 数据:)。
2008-2-7 9:38:17 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.797\Happy new year.exe (PID: 2824): 试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL 值: 数据:)被允许。
2008-2-7 9:38:17 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.797\Happy new year.exe (PID: 2824): 可疑操作,试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI 值: 数据:)。
2008-2-7 9:38:26 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.797\Happy new year.exe (PID: 2824): 试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI 值: 数据:)被允许。
2008-2-7 9:38:26 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.797\Happy new year.exe (PID: 2824): 可疑操作,试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS 值: 数据:)。
2008-2-7 9:38:29 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.797\Happy new year.exe (PID: 2824): 试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS 值: 数据:)被允许。
2008-2-7 9:38:29 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.797\Happy new year.exe (PID: 2824): 可疑操作,试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents 值: 数据:)。
2008-2-7 9:38:31 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.797\Happy new year.exe (PID: 2824): 试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents 值: 数据:)被允许。
2008-2-7 9:38:31 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.797\Happy new year.exe (PID: 2824): 可疑操作,试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced 值:ShowSuperHidden 数据:0x00000000 (0))。
2008-2-7 9:38:32 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.797\Happy new year.exe (PID: 2824): 试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced 值:ShowSuperHidden 数据:0x00000000 (0))被允许。
2008-2-7 9:38:32 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.797\Happy new year.exe (PID: 2824): 可疑操作,试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 值:NoDriveTypeAutoRun 数据:0x00000091 (145))。
2008-2-7 9:38:34 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.797\Happy new year.exe (PID: 2824): 试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 值:NoDriveTypeAutoRun 数据:0x00000091 (145))被允许。
2008-2-7 9:38:34 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.797\Happy new year.exe (PID: 2824): 可疑操作,试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden 值:Type 数据:72 00 61 00 64 00 69 00 6f 00 00 00 6f 00 78 00 00 00 00 00 62 00 00 00 6f 00 00 00 78 00 00 00 00 00 00 00 57 00 69 00 6e 00 52 00 41 00 52 00 5c 00 57 00 69 00 6e 00 52 00 41 00 52 00 2e 00 65 00 78 00 65 00 22 00 20 00 22 00 25 00 31 00 22 00 00 00 52 00 00 00 41 00 00 00 52 00 00 00 5c 00 00 00 57 00 00 00 69 00 00 00 6e 00 00 00 52 00 00 00 41 00 00 00 52 00 00 00 2e 00 00 00 65 00 00 00 78 00 00 00 65 00 00 00 22 00 00 00 20 00 00 00 22 00 00 00 25 00 00 00 31 00 00 00 22 00 00 00 00 00 00 00 52 00 00 00 45 00 00 00 2e 00 00 00 45 00 00 00 58 00 00 00 45 00 00 00 22 00 00 00 20 00 00 00 25 00 00 00 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)。
2008-2-7 9:38:41 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.797\Happy new year.exe (PID: 2824): 试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden 值:Type 数据:72 00 61 00 64 00 69 00 6f 00 00 00 6f 00 78 00 00 00 00 00 62 00 00 00 6f 00 00 00 78 00 00 00 00 00 00 00 57 00 69 00 6e 00 52 00 41 00 52 00 5c 00 57 00 69 00 6e 00 52 00 41 00 52 00 2e 00 65 00 78 00 65 00 22 00 20 00 22 00 25 00 31 00 22 00 00 00 52 00 00 00 41 00 00 00 52 00 00 00 5c 00 00 00 57 00 00 00 69 00 00 00 6e 00 00 00 52 00 00 00 41 00 00 00 52 00 00 00 2e 00 00 00 65 00 00 00 78 00 00 00 65 00 00 00 22 00 00 00 20 00 00 00 22 00 00 00 25 00 00 00 31 00 00 00 22 00 00 00 00 00 00 00 52 00 00 00 45 00 00 00 2e 00 00 00 45 00 00 00 58 00 00 00 45 00 00 00 22 00 00 00 20 00 00 00 25 00 00 00 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)被允许。
2008-2-7 9:38:41 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.797\Happy new year.exe (PID: 2824): 可疑操作,试图删除计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C749DF39-AADA-4507-A1CB-21EA09151AE3}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 值: 数据:)。
2008-2-7 9:38:43 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX00.797\Happy new year.exe (PID: 2824): 试图删除计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C749DF39-AADA-4507-A1CB-21EA09151AE3}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 值: 数据:)被允许。
2008-2-7 9:38:46 进程 (PID 2824) 试图访问卡巴斯基反病毒软件进程(PID 1896),该操作已被自我保护功能阻止,您不需要采取任何动作。
2008-2-7 9:38:46 进程 (PID 2824) 试图访问卡巴斯基反病毒软件进程(PID 1072),该操作已被自我保护功能阻止,您不需要采取任何动作。2008-2-7 9:38:50 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\Com\netcfg.dll//PE_Patch.UPX//UPX: 检测到病毒
“Virus.Win32.Xorer.du”。
2008-2-7 9:38:50 已检测到安全威胁,建议您立即进行处理。
2008-2-7 9:39:01 进程 (PID 3700) 试图访问卡巴斯基反病毒软件进程(PID 1896),该操作已被自我保护功能阻止,您不需要采取任何动作。
2008-2-7 9:39:01 进程 (PID 3700) 试图访问卡巴斯基反病毒软件进程(PID 1072),该操作已被自我保护功能阻止,您不需要采取任何动作。
2008-2-7 9:39:06 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\com\smss.exe: 检测到病毒
“Virus.Win32.Xorer.dt”。
2008-2-7 9:39:10 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\Com\netcfg.dll 将在系统重新启动后被删除。
2008-2-7 9:39:17 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\com\smss.exe: 已删除。
2008-2-7 9:39:19 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\com\netcfg.dll//PE_Patch.UPX//UPX: 检测到病毒
“Virus.Win32.Xorer.du”。
2008-2-7 9:39:19 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\com\netcfg.000//PE_Patch.UPX//UPX: 检测到病毒
“Virus.Win32.Xorer.du”。 用户: apple\紫枫, 计算机: localhost。
2008-2-7 9:39:19 已检测到安全威胁,建议您立即进行处理。
2008-2-7 9:39:22 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\com\netcfg.dll: 已删除。
2008-2-7 9:39:22 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\Com\netcfg.000//PE_Patch.UPX//UPX: 检测到病毒
“Virus.Win32.Xorer.du”。
2008-2-7 9:39:24 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\com\netcfg.000: 已删除。
2008-2-7 9:39:26 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\Com\netcfg.000 无法删除。
2008-2-7 9:39:28 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\dnsq.dll//PE_Patch.UPX//UPX: 检测到病毒
“Virus.Win32.Xorer.du”。
2008-2-7 9:39:28 已检测到安全威胁,建议您立即进行处理。
2008-2-7 9:39:31 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\dnsq.dll//PE_Patch.UPX//UPX: 检测到病毒
“Virus.Win32.Xorer.du”。
2008-2-7 9:39:34 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\dnsq.dll: 已删除。
2008-2-7 9:39:34 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\dnsq.dll//PE_Patch.UPX//UPX 无法删除。
嘿嘿,卡巴的自我保护还算不错。清除能力也不错,很期待传说中V8将加入的应对驱动级别高于卡巴的功能。
[ 本帖最后由 sharkkong 于 2008-2-7 09:57 编辑 ] |
|