6	2008-10-21 21:54	explorer.exe	C:\WINDOWS\	C:\WINDOWS\Explorer.EXE	す砛
6	2008-10-21 21:54	WowARPProtector.exe	C:\Program Files\Wow! ARP Protector\	C:\WINDOWS\Explorer.EXE	す砛
6	2008-10-21 21:54	cmd.exe	C:\WINDOWS\system32\	C:\Program Files\Wow! ARP Protector\WowARPProtector.exe	す砛
6	2008-10-21 21:54	cmd.exe	C:\WINDOWS\system32\	C:\Program Files\Wow! ARP Protector\WowARPProtector.exe	す砛
6	2008-10-21 21:54	explorer.exe	C:\WINDOWS\	C:\WINDOWS\Explorer.EXE	す砛
2	2008-10-21 21:55:03		承ゅン: C:\Documents and Settings\All Users\秨﹍\祘Α栋\币笆\WowARPProtector.lnk
2	2008-10-21 21:55:05		埃ゅン: C:\Documents and Settings\All Users\秨﹍\祘Α栋\币笆\desktop.ini
2	2008-10-21 22:22:44		埃ゅン: C:\WINDOWS\system32\nvwsrsr.dll
2	2008-10-21 22:23:24		埃ゅン: C:\WINDOWS\system32\sysytt.dll
5	2008-10-22 08:07	C:\Program Files\AST\update.exe	218.93.16.104	80	す砛
5	2008-10-22 08:07	C:\Program Files\AST\update.exe	61.152.116.95	8080	す砛
5	2008-10-22 08:07	C:\Program Files\AST\update.exe	220.162.244.166	80	す砛
5	2008-10-22 08:07	C:\Program Files\AST\update.exe	61.155.5.126	80	す砛
5	2008-10-22 08:07	C:\Program Files\AST\update.exe	211.144.68.46	8080	す砛
5	2008-10-22 08:07	C:\Program Files\AST\update.exe	220.162.244.172	80	す砛
5	2008-10-22 08:07	C:\Program Files\AST\update.exe	211.144.87.122	8080	す砛
5	2008-10-22 08:07	C:\Program Files\AST\update.exe	211.152.56.139	8080	す砛
5	2008-10-22 08:07	C:\Program Files\AST\update.exe	60.12.160.90	80	す砛
5	2008-10-22 08:07	C:\Program Files\AST\update.exe	202.65.202.222	88	す砛
5	2008-10-22 08:07	C:\Program Files\AST\update.exe	222.222.65.70	80	す砛
5	2008-10-22 08:07	C:\Program Files\AST\update.exe	221.231.139.136	80	す砛
5	2008-10-22 08:09	C:\Program Files\AST\update.exe	220.162.244.166	80	す砛
5	2008-10-22 08:10	C:\Program Files\AST\update.exe	220.162.244.166	80	す砛
5	2008-10-22 08:11	C:\Program Files\AST\update.exe	220.162.244.166	80	す砛
5	2008-10-22 08:11	C:\Program Files\AST\update.exe	220.162.244.172	80	す砛
5	2008-10-22 08:11	C:\Program Files\AST\update.exe	202.65.202.222	88	す砛
5	2008-10-22 08:11	C:\Program Files\AST\update.exe	61.155.5.126	80	す砛
5	2008-10-22 08:11	C:\Program Files\AST\update.exe	222.222.65.70	80	す砛
5	2008-10-22 08:12	C:\Program Files\AST\update.exe	60.12.160.90	80	す砛
5	2008-10-22 08:12	C:\Program Files\AST\update.exe	218.93.16.104	80	す砛
5	2008-10-22 08:12	C:\Program Files\AST\update.exe	221.231.139.136	80	す砛
5	2008-10-22 08:12	C:\Program Files\AST\update.exe	211.152.56.139	8080	す砛
5	2008-10-22 08:13	C:\Program Files\AST\update.exe	220.162.244.166	80	す砛
5	2008-10-22 08:14	C:\Program Files\AST\update.exe	220.162.244.166	80	す砛
5	2008-10-22 08:15	C:\Program Files\AST\update.exe	220.162.244.166	80	す砛
5	2008-10-22 08:16	C:\Program Files\AST\update.exe	220.162.244.166	80	す砛
5	2008-10-22 08:18	C:\Program Files\AST\update.exe	220.162.244.166	80	す砛
5	2008-10-22 08:19	C:\Program Files\AST\update.exe	220.162.244.166	80	す砛
5	2008-10-22 08:20	C:\Program Files\AST\update.exe	220.162.244.166	80	す砛
5	2008-10-22 08:21	C:\Program Files\AST\update.exe	220.162.244.166	80	す砛
5	2008-10-22 08:22	C:\Program Files\AST\update.exe	220.162.244.166	80	す砛
5	2008-10-22 08:24	C:\Program Files\AST\update.exe	220.162.244.166	80	す砛
5	2008-10-22 08:25	C:\Program Files\AST\update.exe	220.162.244.166	80	す砛
5	2008-10-22 08:26	C:\Program Files\AST\update.exe	220.162.244.166	80	す砛
5	2008-10-22 09:18	C:\Program Files\Internet Explorer\iexplore.exe	211.100.76.29	80	允许
5	2008-10-22 09:19	C:\Program Files\Internet Explorer\iexplore.exe	209.85.143.127	80	允许
5	2008-10-22 09:19	C:\Program Files\Internet Explorer\iexplore.exe	211.100.76.28	80	允许
6	2008-10-22 09:20	iexplore.exe	C:\Program Files\Internet Explorer\	C:\WINDOWS\Explorer.EXE	允许
5	2008-10-22 09:20	C:\Program Files\Internet Explorer\iexplore.exe	163.30.71.1	80	允许
5	2008-10-22 09:20	C:\Program Files\Internet Explorer\iexplore.exe	163.30.71.9	80	允许
5	2008-10-22 09:20	C:\Program Files\Internet Explorer\iexplore.exe	72.14.235.99	80	允许
5	2008-10-22 09:20	C:\Program Files\Internet Explorer\iexplore.exe	72.14.235.147	80	允许
5	2008-10-22 09:20	C:\Program Files\Internet Explorer\iexplore.exe	64.233.189.100	80	允许
5	2008-10-22 09:21	C:\Program Files\Internet Explorer\iexplore.exe	72.14.235.147	80	允许
5	2008-10-22 09:21	C:\Program Files\Internet Explorer\iexplore.exe	64.233.189.100	80	允许
5	2008-10-22 09:22	C:\Program Files\Internet Explorer\iexplore.exe	65.55.12.249	80	允许
5	2008-10-22 09:22	C:\Program Files\Internet Explorer\iexplore.exe	163.28.4.21	80	允许
5	2008-10-22 09:22	C:\Program Files\Internet Explorer\iexplore.exe	63.88.212.184	80	允许
5	2008-10-22 09:22	C:\Program Files\Internet Explorer\iexplore.exe	207.46.16.243	80	允许
5	2008-10-22 09:22	C:\Program Files\Internet Explorer\iexplore.exe	163.28.4.24	80	允许
5	2008-10-22 09:23	C:\Program Files\Internet Explorer\iexplore.exe	163.28.4.22	80	允许
6	2008-10-22 09:25	update.exe	d:\2ba0f9354c6c01cae0f9f3e8\update\	C:\Program Files\AST\patch\WindowsXP-KB953155-x86-CHS.exe	允许
5	2008-10-22 09:24	C:\Program Files\Internet Explorer\iexplore.exe	63.88.212.184	80	允许
5	2008-10-22 09:24	C:\Program Files\Internet Explorer\iexplore.exe	65.55.240.12	80	允许
5	2008-10-22 09:24	C:\Program Files\Internet Explorer\iexplore.exe	163.28.4.23	80	允许
5	2008-10-22 09:24	C:\Program Files\Internet Explorer\iexplore.exe	65.55.239.164	80	允许
5	2008-10-22 09:24	C:\Program Files\Internet Explorer\iexplore.exe	65.55.239.188	80	允许
5	2008-10-22 09:24	C:\Program Files\Internet Explorer\iexplore.exe	163.28.4.24	80	允许
5	2008-10-22 09:24	C:\Program Files\Internet Explorer\iexplore.exe	66.235.132.54	80	允许
6	2008-10-22 09:25	update.exe	d:\b53eef526875dcbf04f4cd5a8b83\update\	C:\Program Files\AST\patch\WindowsXP-KB951830-x86-CHS.exe	允许
6	2008-10-22 09:25	update.exe	d:\2813ccb7f5064ed669\update\	C:\Program Files\AST\patch\WindowsXP-KB944043-v3-x86-CHS.exe	允许
6	2008-10-22 09:25	update.exe	d:\74da4bc59302780d5cd9f84bdc\update\	C:\Program Files\AST\patch\WindowsXP-KB950582-x86-CHS.exe	允许
5	2008-10-22 09:27	C:\Program Files\Internet Explorer\iexplore.exe	211.100.76.29	80	允许
5	2008-10-22 09:29	C:\Program Files\Internet Explorer\iexplore.exe	209.85.143.127	80	允许
6	2008-10-22 09:30	uninstall_activeX.exe	C:\WINDOWS\system32\Macromed\Flash\	C:\Program Files\AST\patch\FlashPlayerUpdate.exe	允许
6	2008-10-22 09:30	Au_.exe	C:\TEMP\~nsu.tmp\	C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe	允许
6	2008-10-22 09:30	ns2A.tmp	C:\TEMP\nsd29.tmp\	C:\TEMP\~nsu.tmp\Au_.exe	允许
6	2008-10-22 09:30	ns2B.tmp	C:\TEMP\nsw26.tmp\	C:\Program Files\AST\patch\FlashPlayerUpdate.exe	允许
6	2008-10-22 09:43	wupdmgr.exe	C:\WINDOWS\system32\	C:\WINDOWS\Explorer.EXE	允许
6	2008-10-22 09:44	mmc.exe	C:\WINDOWS\system32\	C:\WINDOWS\Explorer.EXE	允许
5	2008-10-22 09:43	C:\Program Files\Internet Explorer\iexplore.exe	207.46.18.94	80	允许
5	2008-10-22 09:43	C:\Program Files\Internet Explorer\iexplore.exe	65.55.192.93	80	允许
5	2008-10-22 09:43	C:\Program Files\Internet Explorer\iexplore.exe	65.55.25.125	80	允许
5	2008-10-22 09:44	C:\Program Files\Internet Explorer\iexplore.exe	163.28.4.24	80	允许
5	2008-10-22 09:44	C:\Program Files\Internet Explorer\iexplore.exe	207.46.16.243	80	允许
2	2008-10-22 09:46:16		创建了文件: C:\WINDOWS\SchedLgU.Txt
6	2008-10-22 09:48	update.exe	d:\76f89d392b0e874f610f776b1a5c39\update\	C:\WINDOWS\SoftwareDistribution\Download\Install\WindowsXP-KB905474-CHT-x86.exe	允许
2	2008-10-22 09:48:32		创建了文件: C:\WINDOWS\WgaNotify.log
2	2008-10-22 09:48:33		创建了目录: C:\WINDOWS\LastGood
2	2008-10-22 09:48:41		创建了文件: C:\WINDOWS\_000000_.cat
2	2008-10-22 09:48:41		删除文件: C:\WINDOWS\_000000_.tmp.dll
2	2008-10-22 09:48:45		创建了文件: C:\WINDOWS\setupact.log
2	2008-10-22 09:48:45		创建了文件: C:\WINDOWS\setuperr.log
2	2008-10-22 09:48:53		创建了文件: C:\WINDOWS\WgaNotify.cat
2	2008-10-22 09:48:53		删除文件: C:\WINDOWS\_000001_.tmp.dll
2	2008-10-22 09:48:53		创建了文件: C:\WINDOWS\system32\SET8.tmp
2	2008-10-22 09:48:53		删除文件: C:\WINDOWS\system32\SET8.tmp
2	2008-10-22 09:48:53		创建了文件: C:\WINDOWS\system32\SET8.tmp
2	2008-10-22 09:48:53		创建了文件: C:\WINDOWS\updspapi.log
2	2008-10-22 09:48:53		创建了文件: C:\WINDOWS\system32\SET9.tmp
2	2008-10-22 09:48:53		删除文件: C:\WINDOWS\system32\SET9.tmp
2	2008-10-22 09:48:53		创建了文件: C:\WINDOWS\system32\SET9.tmp
2	2008-10-22 09:48:53		创建了文件: C:\WINDOWS\system32\SETA.tmp
2	2008-10-22 09:48:53		删除文件: C:\WINDOWS\system32\SETA.tmp
2	2008-10-22 09:48:53		创建了文件: C:\WINDOWS\system32\SETA.tmp
2	2008-10-22 09:48:53		删除文件: C:\WINDOWS\system32\WgaTray.exe
2	2008-10-22 09:48:54		创建了文件: C:\WINDOWS\system32\SETD.tmp
2	2008-10-22 09:48:54		删除文件: C:\WINDOWS\system32\SETD.tmp
2	2008-10-22 09:48:54		创建了文件: C:\WINDOWS\system32\SETD.tmp
2	2008-10-22 09:48:54		创建了文件: C:\WINDOWS\system32\SETE.tmp
2	2008-10-22 09:48:54		删除文件: C:\WINDOWS\system32\SETE.tmp
2	2008-10-22 09:48:54		创建了文件: C:\WINDOWS\system32\SETE.tmp
2	2008-10-22 09:48:54		创建了文件: C:\WINDOWS\system32\SETF.tmp
2	2008-10-22 09:48:54		删除文件: C:\WINDOWS\system32\SETF.tmp
2	2008-10-22 09:48:54		创建了文件: C:\WINDOWS\system32\SETF.tmp
2	2008-10-22 09:48:54		删除文件: C:\WINDOWS\system32\WgaTray.exe
6	2008-10-22 09:48	spupdsvc.exe	C:\WINDOWS\system32\	d:\76f89d392b0e874f610f776b1a5c39\update\update.exe	允许
2	2008-10-22 09:48:54		创建了文件: C:\WINDOWS\spupdsvc.log
3	2008-10-22 09:48:54	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services	创建了子键: "spupdsvc"	服务被变动，请注意是否是后门木马的修改。
6	2008-10-22 09:48	wgatray.exe	d:\76f89d392b0e874f610f776b1a5c39\	d:\76f89d392b0e874f610f776b1a5c39\update\update.exe	允许
2	2008-10-22 09:48:57		删除文件: C:\WINDOWS\system32\SET8.tmp
2	2008-10-22 09:48:57		删除文件: C:\WINDOWS\system32\SET9.tmp
2	2008-10-22 09:48:57		创建了文件: C:\WINDOWS\system32\HFX12.tmp
2	2008-10-22 09:48:57		创建了文件: C:\WINDOWS\system32\spupdsvc.inf
2	2008-10-22 09:48:57		删除文件: C:\WINDOWS\system32\HFX12.tmp
6	2008-10-22 09:49	setup.exe	d:\90e38720dded6a6de2\	C:\WINDOWS\SoftwareDistribution\Download\Install\NetFx20SP1_x86.exe	允许
6	2008-10-22 09:49	ngen.exe	C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\	d:\90e38720dded6a6de2\setup.exe	允许
5	2008-10-22 09:48	d:\76f89d392b0e874f610f776b1a5c39\wgatray.exe	64.4.52.248	80	允许
2	2008-10-22 09:50:28		删除文件: C:\WINDOWS\system32\mscoree.dll
2	2008-10-22 09:50:28		创建了文件: C:\WINDOWS\system32\mscoree.dll
2	2008-10-22 09:50:41		删除文件: C:\WINDOWS\system32\mscories.dll
2	2008-10-22 09:50:41		创建了文件: C:\WINDOWS\system32\mscories.dll
2	2008-10-22 09:50:41		创建了目录: C:\Program Files\Internet Explorer\MUI
2	2008-10-22 09:50:41		删除文件: C:\WINDOWS\system32\mscorier.dll
2	2008-10-22 09:50:41		创建了文件: C:\WINDOWS\system32\mscorier.dll
2	2008-10-22 09:50:44		删除文件: C:\WINDOWS\system32\dfshim.dll
2	2008-10-22 09:50:44		创建了文件: C:\WINDOWS\system32\dfshim.dll
3	2008-10-22 09:51:06	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	创建了值: "2007"	IE插件，一般流氓软件和第三方IE工具会修改此键值。
6	2008-10-22 09:52	FreeRAM XP Pro.exe	C:\Program Files\FreeRAM\	C:\WINDOWS\Explorer.EXE	允许
3	2008-10-22 09:52:52	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services	删除了子键: "ASP.NET_2.0.50727"	服务被变动，请注意是否是后门木马的修改。
2	2008-10-22 09:53:03		创建了目录: C:\WINDOWS\system32\PerfStringBackup.TMP
2	2008-10-22 09:53:04		删除文件: C:\WINDOWS\system32\PerfStringBackup.TMP
3	2008-10-22 09:53:05	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services	创建了子键: "ASP.NET_2.0.50727"	服务被变动，请注意是否是后门木马的修改。
2	2008-10-22 09:53:06		创建了文件: C:\WINDOWS\system32\PerfStringBackup.TMP
2	2008-10-22 09:53:06		删除文件: C:\WINDOWS\system32\PerfStringBackup.TMP
2	2008-10-22 09:53:07		创建了文件: C:\WINDOWS\system32\PerfStringBackup.TMP
2	2008-10-22 09:53:07		删除文件: C:\WINDOWS\system32\PerfStringBackup.TMP
6	2008-10-22 09:53	minimem1.2.exe	C:\Program Files\Kerkia\Minimem\	C:\WINDOWS\Explorer.EXE	允许
6	2008-10-22 09:54	ngen.exe	C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\	d:\90e38720dded6a6de2\setup.exe	允许
6	2008-10-22 09:54	ngen.exe	C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\	d:\90e38720dded6a6de2\setup.exe	允许
6	2008-10-22 09:54	ngen.exe	C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\	d:\90e38720dded6a6de2\setup.exe	允许
6	2008-10-22 09:54	ngen.exe	C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\	d:\90e38720dded6a6de2\setup.exe	允许
6	2008-10-22 11:12	wupdmgr.exe	C:\WINDOWS\system32\	C:\WINDOWS\Explorer.EXE	允许
5	2008-10-22 11:12	C:\Program Files\Internet Explorer\iexplore.exe	207.46.18.94	80	允许
5	2008-10-22 11:13	C:\Program Files\Internet Explorer\iexplore.exe	65.55.192.29	80	允许
5	2008-10-22 11:13	C:\Program Files\Internet Explorer\iexplore.exe	65.55.200.189	80	允许
5	2008-10-22 11:13	C:\Program Files\Internet Explorer\iexplore.exe	163.28.4.24	80	允许
5	2008-10-22 11:13	C:\Program Files\Internet Explorer\iexplore.exe	207.46.16.243	80	允许
6	2008-10-22 11:26	verclsid.exe	C:\WINDOWS\system32\	C:\WINDOWS\Explorer.EXE	允许
6	2008-10-22 11:26	verclsid.exe	C:\WINDOWS\system32\	C:\WINDOWS\Explorer.EXE	允许
6	2008-10-22 11:26	NOTEPAD.EXE	C:\WINDOWS\system32\	C:\WINDOWS\Explorer.EXE	允许
6	2008-10-22 11:27	NOTEPAD.EXE	C:\WINDOWS\System32\	C:\WINDOWS\Explorer.EXE	允许
5	2008-10-22 11:25	C:\Program Files\Internet Explorer\iexplore.exe	65.55.200.189	80	允许
5	2008-10-22 11:26	C:\Program Files\Internet Explorer\iexplore.exe	207.46.16.243	80	允许
6	2008-10-22 11:27	iexplore.exe	C:\Program Files\Internet Explorer\	C:\WINDOWS\Explorer.EXE	允许
6	2008-10-22 11:27	rundll32.exe	C:\WINDOWS\system32\	C:\WINDOWS\Explorer.EXE	允许
6	2008-10-22 11:27	WINWORD.EXE	C:\Program Files\Microsoft Office\Office10\	C:\WINDOWS\system32\rundll32.exe	允许
5	2008-10-22 11:27	C:\Program Files\Internet Explorer\iexplore.exe	163.30.71.1	80	允许
5	2008-10-22 11:27	C:\Program Files\Internet Explorer\iexplore.exe	163.30.71.9	80	允许
5	2008-10-22 11:27	C:\Program Files\Internet Explorer\iexplore.exe	163.30.71.5	80	允许
3	2008-10-22 11:29:08	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	删除了值: "Anti-Spy Tools"	注册表启动项目，发现此处被修改要留心是否是后门木马。
6	2008-10-22 11:35	update.exe	d:\226fe34b8c5ace65779aa0\update\	C:\Program Files\AST\patch\WindowsXP-KB953155-x86-CHS.exe	す砛
6	2008-10-22 11:35	update.exe	d:\8087b98bbaa1cacf25\update\	C:\Program Files\AST\patch\WindowsXP-KB951830-x86-CHS.exe	す砛
6	2008-10-22 11:35	update.exe	d:\222af383933c5603751d03\update\	C:\Program Files\AST\patch\WindowsXP-KB944043-v3-x86-CHS.exe	す砛
6	2008-10-22 11:35	update.exe	d:\7e14de40a09c0f758bc3097b64a42e\update\	C:\Program Files\AST\patch\WindowsXP-KB950582-x86-CHS.exe	す砛
