一个疑似U盘病毒

悠柚

Avira TR/Crypt.FKM.Gen 特洛伊木马

Vbs.Newlove

熊猫kill

闪闪的夜空

金山kill，微点右键杀

蓝天二号

卡巴

xiuzhiguo

拒绝访问
无法访问该网页

请求对象位于网址：

http://bbs.kafan.cn/forum.php?mod=
attachment&aid=MTU3MTI0OXxiN2JhYWMzZnwxM
zMxOTgxMjQ5fDY1Mjk3MHwxMjQzMTg3

检测到威胁：

对象已感染病毒Trojan-Dropper.Win32.Agent.fpmh

hx1997

Level 1 - C:\Users\Gateway\Desktop\1.exe (108156) attempted to START NEW PROCESS  (0) - allowed.
Command-line: cacls C:\Users\Gateway\AppData\Local\Temp\ /e /p everyone:f
cacls "C:\Windows" /e /p everyone:f
The window of the new process is invisible. (Suspicious)
Start a protected process with command-line parameters. (Suspicious)

Level 8 - C:\Users\Gateway\Desktop\1.exe (108156) attempted to START NEW PROCESS  (88160) - allowed.
Command-line: cmd /c sc config ekrn start= disabled
Silent start of a CMD process. (Suspicious)
The window of the new process is invisible. (Suspicious)
Start a protected process with command-line parameters. (Suspicious)

Level 18 - C:\Users\Gateway\Desktop\1.exe (108156) attempted to START NEW PROCESS  (60552) - allowed.
Command-line: cmd /c taskkill /im ekrn.exe /f
Silent start of a CMD process. (Suspicious)
The window of the new process is invisible. (Suspicious)
Start a protected process with command-line parameters. (Suspicious)

Level 28 - C:\Users\Gateway\Desktop\1.exe (108156) attempted to START NEW PROCESS  (69772) - allowed.
Command-line: cmd /c taskkill /im egui.exe /f
Silent start of a CMD process. (Suspicious)
The window of the new process is invisible. (Suspicious)
Start a protected process with command-line parameters. (Suspicious)

Level 38 - C:\Users\Gateway\Desktop\1.exe (108156) attempted to START NEW PROCESS  (57412) - allowed.
Command-line: cmd /c taskkill /im 360sd.exe /f
Silent start of a CMD process. (Suspicious)
The window of the new process is invisible. (Suspicious)
Start a protected process with command-line parameters. (Suspicious)

Level 48 - C:\Windows\SysWOW64\WerFault.exe (71832) attempted to OPEN PROCESS E:\Windows\SysWOW64\taskkill.exe (81868) - allowed.

Level 49 - C:\Users\Gateway\Desktop\1.exe (108156) attempted to START NEW PROCESS  (75168) - allowed.
Command-line: cmd /c taskkill /im 360sd_se.exe /f
Silent start of a CMD process. (Suspicious)
The window of the new process is invisible. (Suspicious)
Start a protected process with command-line parameters. (Suspicious)

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 59 - C:\Windows\SysWOW64\taskkill.exe (18596) attempted to TERMINATE PROCESS E:\Program Files\ESET\ESET Smart Security\egui.exe (4348) - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 60 - C:\Windows\SysWOW64\WerFault.exe (71832) attempted to OPEN PROCESS E:\Windows\SysWOW64\taskkill.exe (81868) - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 61 - C:\Windows\SysWOW64\WerFault.exe (71832) attempted to OPEN PROCESS E:\Windows\SysWOW64\taskkill.exe (81868) - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 61.1 - C:\Users\Gateway\Desktop\1.exe attempted to WRITE TO FILE C:\Windows\system32\a18467stva41a.dll - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 62.1 - C:\Users\Gateway\Desktop\1.exe (108156) attempted to START NEW PROCESS  (105984) - allowed.
Command-line: rundll32.exe C:\Windows\system32\a18467stva41a.dll, droqp
The window of the new process is invisible. (Suspicious)
Start a protected process with command-line parameters. (Suspicious)

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 68.2 - C:\Windows\SysWOW64\rundll32.exe attempted to WRITE TO FILE C:\Users\Gateway\AppData\Local\Temp\pci.sys - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 68.3 - C:\Windows\SysWOW64\rundll32.exe attempted to WRITE TO FILE \\.\CMusic - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 68.4 - C:\Users\Gateway\Desktop\1.exe attempted to WRITE TO FILE C:\Windows\def26500aab6334ccd.dll - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 69.4 - C:\Windows\SysWOW64\WerFault.exe (107664) attempted to OPEN PROCESS E:\Windows\SysWOW64\rundll32.exe (105984) - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 69.5 - C:\Users\Gateway\Desktop\1.exe attempted to WRITE TO FILE C:\Windows\system32\drivers\pcidump.sys - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 70.5 - C:\Windows\SysWOW64\WerFault.exe (107664) attempted to OPEN PROCESS E:\Windows\SysWOW64\rundll32.exe (105984) - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 73.5 - C:\Users\Gateway\Desktop\1.exe attempted to WRITE TO PROTECTED FILE C:\Windows\system32\drivers\etc\hosts - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 74.5 - C:\Windows\SysWOW64\WerFault.exe (107664) attempted to OPEN PROCESS E:\Windows\SysWOW64\rundll32.exe (105984) - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 75.5 - C:\Users\Gateway\Desktop\1.exe (108156) attempted to START NEW PROCESS  (0) - allowed.
Command-line: ipconfig /all
The window of the new process is invisible. (Suspicious)
Start a protected process with command-line parameters. (Suspicious)

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 84.5 - C:\Users\Gateway\Desktop\1.exe attempted to WRITE TO PROTECTED FILE C:\autorun.inf - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 84.6 - C:\Users\Gateway\Desktop\1.exe attempted to WRITE TO FILE C:\Users\Gateway\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 85.6 - C:\Windows\SysWOW64\WerFault.exe (67176) attempted to OPEN PROCESS E:\Users\Gateway\Desktop\1.exe (108156) - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 85.7 - C:\Users\Gateway\Desktop\1.exe attempted to WRITE TO FILE C:\Users\Gateway\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 86.7 - C:\Windows\SysWOW64\WerFault.exe (67176) attempted to OPEN PROCESS E:\Users\Gateway\Desktop\1.exe (108156) - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 86.8 - C:\Users\Gateway\Desktop\1.exe attempted to WRITE TO FILE C:\Users\Gateway\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 87.8 - C:\Windows\SysWOW64\WerFault.exe (67176) attempted to OPEN PROCESS E:\Users\Gateway\Desktop\1.exe (108156) - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

Level 87.8999999999999 - C:\Users\Gateway\Desktop\1.exe attempted to WRITE TO FILE E:\autorun.inf - allowed.

ATTENTION! Suspected Win32.Malware.Generic was found on your system!

fireold

-oAo-

木马

schumi小粉

Dropper~

萧逆水

Avast 金山也杀