java

显示全部楼层 · 发表于 2013-5-3 14:11:34

2013-05-03 14:04:07 C:\Documents and Settings\All Users\Application Data\Shared Space\arpukku\wsnilyxs.exe Sandboxed As Partially Limited

2013-05-03 14:04:19 C:\Documents and Settings\All Users\Application Data\Shared Space\arpukku\wsnilyxs.exe Modify Key HKUS\S-1-5-21-1390067357-492894223-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run\java

显示全部楼层 · 发表于 2013-5-3 14:20:38

显示全部楼层 · 发表于 2013-5-3 14:35:31

QVM05

显示全部楼层 · 发表于 2013-5-3 14:46:21

本帖最后由倾枫锝渔♂ 于 2013-5-3 14:53 编辑

添加启动项

然后就拼命的查找窗口

http://fireeye.ijinshan.com/anal ... 2e1&type=1#full

显示全部楼层 · 发表于 2013-5-3 20:11:24

显示全部楼层 · 发表于 2013-5-3 20:16:26

GD 2014

During Close the file "C:\Users\abc\Downloads\wsnilyxs.part1\wsnilyxs.exe" the "Gen:Variant.Graftor.33872 (Engine A)" virus was detected. Access denied.

The file was disinfected.

File: C:\Users\abc\Downloads\wsnilyxs.part1\wsnilyxs.exe
Virus: Gen:Variant.Graftor.33872 (Engine A)

[病毒样本] java

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源