操作                            时间                            进程名称                                                                                                                                                                                                                                                       操作数据                                                                                                                                                                                                                                                       
试图启动远程线程                2008-09-14 23:13:21             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\EXPLORER.EXE                                                                                                                                                                                                                                        
试图启动远程线程                2008-09-14 23:13:21             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\CSRSS.EXE                                                                                                                                                                                                                                  
试图启动远程线程                2008-09-14 23:13:21             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\WINLOGON.EXE                                                                                                                                                                                                                               
试图启动远程线程                2008-09-14 23:13:21             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\SERVICES.EXE                                                                                                                                                                                                                               
试图启动远程线程                2008-09-14 23:13:21             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\LSASS.EXE                                                                                                                                                                                                                                  
试图启动远程线程                2008-09-14 23:13:21             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\SVCHOST.EXE                                                                                                                                                                                                                                
试图启动远程线程                2008-09-15 00:16:56             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\CSRSS.EXE                                                                                                                                                                                                                                  
试图启动远程线程                2008-09-15 00:16:56             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\WINLOGON.EXE                                                                                                                                                                                                                               
试图启动远程线程                2008-09-15 00:16:56             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\SERVICES.EXE                                                                                                                                                                                                                               
试图启动远程线程                2008-09-15 00:16:56             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\LSASS.EXE                                                                                                                                                                                                                                  
试图启动远程线程                2008-09-15 00:16:56             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\SVCHOST.EXE                                                                                                                                                                                                                                
试图启动远程线程                2008-09-15 00:16:56             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\EXPLORER.EXE                                                                                                                                                                                                                                        
试图启动远程线程                2008-09-15 00:35:51             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\CSRSS.EXE                                                                                                                                                                                                                                  
试图启动远程线程                2008-09-15 00:35:51             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\WINLOGON.EXE                                                                                                                                                                                                                               
试图启动远程线程                2008-09-15 00:35:51             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\SERVICES.EXE                                                                                                                                                                                                                               
试图启动远程线程                2008-09-15 00:35:51             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\LSASS.EXE                                                                                                                                                                                                                                  
试图启动远程线程                2008-09-15 00:35:51             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\SVCHOST.EXE                                                                                                                                                                                                                                
试图启动远程线程                2008-09-15 00:35:51             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\EXPLORER.EXE                                                                                                                                                                                                                                        
试图启动远程线程                2008-09-15 11:38:53             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\CSRSS.EXE                                                                                                                                                                                                                                  
试图启动远程线程                2008-09-15 11:38:53             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\WINLOGON.EXE                                                                                                                                                                                                                               
试图启动远程线程                2008-09-15 11:38:53             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\SERVICES.EXE                                                                                                                                                                                                                               
试图启动远程线程                2008-09-15 11:38:53             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\LSASS.EXE                                                                                                                                                                                                                                  
试图启动远程线程                2008-09-15 11:38:53             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\SYSTEM32\SVCHOST.EXE                                                                                                                                                                                                                                
试图启动远程线程                2008-09-15 11:38:53             C:\DOCUME~1\DELL\LOCALS~1\TEMP\~RS.TMP                                                                                                                                                                                                                         C:\WINDOWS\EXPLORER.EXE