敲竹杠，更新第四个，最狠的一个，进不去系统啊！！

JokerJ

Qutianshang 发表于 2014-6-8 18:18
没有试过，不知道

         你怎么不试一下

dongwenqi

卡巴斯基全杀

XywCloud

新来的那个
bav启发杀
费尔基因杀

cn86li

GD kill 2
Gen:Variant.Graftor.134421 (引擎A)

Gen:Variant.Strictor.38430 (引擎A)


剩余一个已上报

ticket number is 2014060810470001

Hello,

Thank you for your patience.
The analysis of the file / website has been completed:

File has been signed as Trojan.Ransom.AGH.

File exe declared INFECTED

Please do not hesitate to contact us should you have any other inquiries in the future.

Have a great day.

happylty

他禁用组策略了么

MrDeep

瓜g

第3个

时间	事件	结果	附加信息
2014/6/8 18:57	系统内核加固	阻止天天酷跑刷物品.exe	规则ID：131270912 防护类型：打开 进程：C:\Users\123\Desktop\天天酷跑刷物品.exe  文件路径：C:\Windows\System32\net.exe
2014/6/8 18:57	系统内核加固	阻止天天酷跑刷物品.exe	规则ID：131272272 防护类型：修改 进程：C:\Users\123\Desktop\天天酷跑刷物品.exe  注册表路径：HKEY_USERS\S-1-5-21-3325087568-3306842301-3112582926-1001\Software\Microsoft\Windows\CurrentVersion\Policies\System
2014/6/8 18:57	文件监控	发现威胁天天酷跑刷物品.exe	文件路径：C:\Users\123\Desktop\天天酷跑刷物品.exe 相关进程：C:\WINDOWS\Explorer.EXE

Qutianshang

JokerJ 发表于 2014-6-8 18:22
你怎么不试一下

还没有来的及，应该没有问题

cn86li

第四个样本
To GD

已上报

ticket number is 2014060811080001

Hello,

Thank you for your patience.
The analysis of the file / website has been completed:

File has been signed as Trojan.Ransom.AGI.

File exe declared INFECTED

Please do not hesitate to contact us should you have any other inquiries in the future.

Have a great day.

深山红叶__

第四个：
重启F8进安全模式，在欢迎登陆界面按两下Ctrl+Alt+Del，手动输入Administrator和密码登陆。