蓝屏，敲竹杠

饭@avast

Filename: 网赚教程.exe
Threat name: SONAR.Heuristic.120
Full Path: Not Available

____________________________

Details
Very Few Users,  Very New,  Risk High

Origin
Downloaded from
Unknown

Activity
Actions performed: 4

____________________________


On computers as of 2014-6-15 at 13:53:17
Last Used 2014-6-15 at 13:53:17
Startup Item No
Launched Yes

____________________________


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.

SONAR Protection monitors for suspicious program activity on your computer.


____________________________


Source: External Media

Source File:
360zip.exe

File Created:
网赚教程.exe


____________________________

File Actions

File: c:\documents and settings\avt\桌面\test\蓝屏-输入密码(样本)\网赚教程.exe
Removed
____________________________

System Settings Actions

Event: Process start (Performed by c:\documents and settings\avt\桌面\test\蓝屏-输入密码(样本)\网赚教程.exe, PID:2568)
No action taken
Event: PE file creation: c:\windows\system32\winlockdll.dll (Performed by c:\documents and settings\avt\桌面\test\蓝屏-输入密码(样本)\网赚教程.exe, PID:2568)
No action taken
Event: Process start: c:\documents and settings\avt\桌面\test\蓝屏-输入密码(样本)\网赚教程.exe, PID:2568 (Performed by c:\documents and settings\avt\桌面\test\蓝屏-输入密码(样本)\网赚教程.exe, PID:2568)
No action taken
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

hddu

密码：wyl707586927995  

Qutianshang

hddu 发表于 2014-6-15 15:41
密码：wyl707586927995

怎么弄出来的？

hddu

Qutianshang 发表于 2014-6-15 16:01
怎么弄出来的？

记事本搜索。
你不是有工具吗？

Qutianshang

hddu 发表于 2014-6-15 16:27
记事本搜索。
你不是有工具吗？

这个好像有些麻烦

Qutianshang

hddu 发表于 2014-6-15 16:27
记事本搜索。
你不是有工具吗？

这个无法调试，直接就蓝屏了

调试线程已开启...
-----------------------
Msg ------ :  创建文件：C:\WINDOWS\system32\WinLockDll.dll 【放行】
Msg ------ :  END
-----------------------
调试线程已关闭...

bambooslip

过瑞星V16+
火眼--结果分析--4b01283be498511082c7c313caee997c http://fireeye.ijinshan.com/anal ... b61&type=1#full

FUCKCAT

瓜g

bambooslip 发表于 2014-6-15 17:19
过瑞星V16+
火眼--结果分析--4b01283be498511082c7c313caee997c http://fireeye.ijinshan.com/analyse.htm ...

bambooslip

瓜g 发表于 2014-6-15 17:26

啥子情况。我这右键扫描不报毒。