这个病毒，打开后就管不了它，连任务管理器都喊不出来。。。

dsb2466

超讨厌。。。有谁知到打开它后怎么退出来么？？

zmzcy

完整路径: C:\Users\zmzcy\Desktop\d68dda9d50ec5f965948e8b2d9ad17b9.exe
____________________________
____________________________
开发人员 不可用
版本 3.3.8.0
安装时间 2012/6/16 ( 14:32:40 )
上次使用时间 不可用
启动项目 否
____________________________
____________________________
未知
此程序的崩溃历史记录未知。
____________________________
极少用户信任的文件
诺顿社区中有不到 5 名用户使用了此文件。
____________________________
极新的文件
该文件已在不到 1 周前发行。
____________________________
弱
有一些迹象表明此文件不可信。
____________________________
源文件:
d68dda9d50ec5f965948e8b2d9ad17b9.exe
____________________________
文件指纹 - SHA:
28bf399a594b68b00aeede888e147f1602eede821ec9780418e739f31b3eded6
____________________________
文件指纹 - MD5:
d68dda9d50ec5f965948e8b2d9ad17b9
___________________________  

zmzcy

dg kill

hx1997

ESET killed

C:\Users\Gateway\Desktop\d68dda9d50ec5f965948e8b2d9ad17b9.exe » AUTOIT » script.au3 - Win32/LockScreen.ALJ trojan
C:\Users\Gateway\Desktop\d68dda9d50ec5f965948e8b2d9ad17b9.exe » AUTOIT » script.bin - a variant of Win32/LockScreen.ALJ trojan

对这类 LockScreen 用 Desktops 无鸭梨。

275751198

360下载保护报毒

Dust-;羅錠

大蜘蛛：
d68dda9d50ec5f965948e8b2d9ad17b9.exe.vir infected with Trojan.AVKill.18650

Nocria

AVG killed.

"Trojan horse Generic6_c.DIZ, c:\Documents and Settings\Fujitsu\桌面\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe.vir";"Infected"

846859163

汗 没办法 被小A网页防护拦截

ppy0606

2012/6/16 14:56:05    修改注册表值    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
值: F:\下载\Compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
规则: [应用程序组]『询问』病毒测试 -> [注册表组]WinLogon -> [注册表]*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

2012/6/16 14:56:10    修改注册表值    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\AlternateShell
值: F:\下载\Compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:56:13    创建注册表项    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:56:13    创建注册表项    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:56:15    创建注册表项    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:56:16    创建注册表项    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:56:17    修改注册表值    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
值: 0x00000000(0)
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:56:22    修改文件 (5)    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: \Device\NamedPipe\srvsvc
规则: [应用程序组]『询问』病毒测试 -> [文件]*

2012/6/16 14:56:25    创建文件    允许
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: C:\Users\Choow\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d68dda9d50ec5f965948e8b2d9ad17b9.exe.lnk
规则: [应用程序组]『询问』病毒测试 -> [文件组]保护系统文件

2012/6/16 14:56:52    修改文件    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: \Device\NamedPipe\srvsvc
规则: [应用程序组]『询问』病毒测试 -> [文件]*

2012/6/16 14:56:52    删除注册表值    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:56:52    修改文件    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: \Device\NamedPipe\srvsvc
规则: [应用程序组]『询问』病毒测试 -> [文件]*

2012/6/16 14:56:52    删除注册表值    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:56:52    修改注册表值    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000000(0)
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:56:52    修改文件    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: \Device\NamedPipe\srvsvc
规则: [应用程序组]『询问』病毒测试 -> [文件]*

2012/6/16 14:56:52    修改注册表值    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
值: 0x00000001(1)
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:57:00    删除注册表值    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:57:04    删除注册表值    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:57:06    修改注册表值    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000000(0)
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:57:08    修改注册表值    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
值: 0x00000001(1)
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:57:09    创建注册表项    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\d68dda9d50ec5f965948e8b2d9ad17b9_RASAPI32
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:57:10    创建注册表项    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\d68dda9d50ec5f965948e8b2d9ad17b9_RASAPI32
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:57:11    创建注册表项    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\d68dda9d50ec5f965948e8b2d9ad17b9_RASAPI32
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:57:12    修改注册表值    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
值: 0x00000000(0)
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:57:13    创建注册表项    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\d68dda9d50ec5f965948e8b2d9ad17b9_RASAPI32
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:57:14    修改注册表值    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
值: 46 00 00 00 e5 22 00 00 01 00 00 00 00 00 00 00 05 00 00 00 6c 6f 63 61 6c 00 00 00 00 00 00 00 00 00 00 00 00 c0 ba db bc c7 05 cd 01 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 17 00 00 00 00 00 00 00 fe 80 00 00 00 00 00 00 e1 eb ac 4b 96 d3 39 d1 0b 00 00 00 00 00 00 00 84 51 be 77 48 a5 bd 77 70 30 8c 72 d9 06 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 00 00 00 fe 80 00 00 00 00 00 00 1c 21 08 c5 8e 09 8b 9d 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 c0 a8 01 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 44 00 00 00 41 53 59 43 00 00 00 00 17 00 00 00 00 00 00 00 20 01 00 00 41 37 9e 76 1c 21 08 c5 8e 09 8b 9d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 56 45 00 1d 00 00 1d df fc 00 00 48
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:57:15    创建注册表项    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\d68dda9d50ec5f965948e8b2d9ad17b9_RASMANCS
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:57:16    修改注册表值    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
值: 46 00 00 00 e5 22 00 00 01 00 00 00 00 00 00 00 05 00 00 00 6c 6f 63 61 6c 00 00 00 00 00 00 00 00 00 00 00 00 c0 ba db bc c7 05 cd 01 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 17 00 00 00 00 00 00 00 fe 80 00 00 00 00 00 00 e1 eb ac 4b 96 d3 39 d1 0b 00 00 00 00 00 00 00 84 51 be 77 48 a5 bd 77 70 30 8c 72 d9 06 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 00 00 00 fe 80 00 00 00 00 00 00 1c 21 08 c5 8e 09 8b 9d 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 c0 a8 01 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 44 00 00 00 41 53 59 43 00 00 00 00 17 00 00 00 00 00 00 00 20 01 00 00 41 37 9e 76 1c 21 08 c5 8e 09 8b 9d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 56 45 00 1d 00 00 1d df fc 00 00 48
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:57:27    创建注册表项    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\d68dda9d50ec5f965948e8b2d9ad17b9_RASMANCS
规则: [应用程序组]『询问』病毒测试 -> [注册表]*

2012/6/16 14:57:27    访问网络    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: TCP [本机 : 50135] ->  [95.163.104.80 : 80 (http)]
规则: [应用程序组]『询问』病毒测试 -> [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2012/6/16 14:57:27    结束其他进程    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: c:\windows\system32\taskmgr.exe
规则: [应用程序组]『询问』病毒测试

2012/6/16 14:57:27    访问网络    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: UDP [本机 : 53833] ->  [127.0.0.1 : 53833]
规则: [应用程序组]『询问』病毒测试 -> [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2012/6/16 14:57:35    创建新进程    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: c:\windows\system32\cmd.exe
命令行: C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
规则: [应用程序组]『询问』病毒测试

2012/6/16 14:57:38    结束其他进程    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: c:\windows\system32\taskmgr.exe
规则: [应用程序组]『询问』病毒测试

2012/6/16 14:57:40    创建新进程    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: c:\windows\system32\cmd.exe
命令行: C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
规则: [应用程序组]『询问』病毒测试

2012/6/16 14:57:42    底层键盘操作 (2)    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
规则: [应用程序组]『询问』病毒测试

2012/6/16 14:57:43    结束其他进程    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: c:\windows\system32\taskmgr.exe
规则: [应用程序组]『询问』病毒测试

2012/6/16 14:57:47    创建新进程    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: c:\windows\system32\cmd.exe
命令行: C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
规则: [应用程序组]『询问』病毒测试

2012/6/16 14:57:49    底层键盘操作 (2)    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
规则: [应用程序组]『询问』病毒测试

2012/6/16 14:57:49    结束其他进程    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: c:\windows\system32\taskmgr.exe
规则: [应用程序组]『询问』病毒测试

2012/6/16 14:57:53    创建新进程    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
目标: c:\windows\system32\cmd.exe
命令行: C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
规则: [应用程序组]『询问』病毒测试

2012/6/16 14:57:54    底层键盘操作    阻止
进程: f:\下载\compressed\新建 360压缩\d68dda9d50ec5f965948e8b2d9ad17b9.exe
规则: [应用程序组]『询问』病毒测试

wuyongliang

FS  扫描也KILL
结果: 找到 1 恶意软件

Suspicious:W32/Malware.e16d86!Online (病毒)
C:\Users\Administrator\Desktop\病毒测试用\d68dda9d50ec5f965948e8b2d9ad17b9.exe 操作： 已隔离