锁屏

显示全部楼层 · 发表于 2014-8-11 23:13:22

bav扫描不杀

显示全部楼层 · 发表于 2014-8-11 23:17:49

左手发表于 2014-8-11 23:08
呃。用速度卫士结束时，蓝屏了。。
样本后续还有动作，除了全局钩子外。
2014-08-11 22:59:32 创建文 ...

http://bbs.kafan.cn/thread-1761256-1-1.html
上次的特性除了加密以外全部保留
设置关键进程属性是hx介绍的，因VB导出有问题，Rtlsetcritical()不能正常用，30#用NtSetInformationProcess()解决此问题。

显示全部楼层 · 发表于 2014-8-11 23:21:15

唢呐威武
Filename: 锁屏.exe
Threat name: SONAR.Heuristic.120Full Path: Not Available

____________________________

Details
Very Few Users, Very New, Risk High

Origin
Downloaded from
Unknown

Activity
Actions performed: 4

____________________________

On computers as of 2014-8-11 at 23:20:29
Last Used 2014-8-11 at 23:20:29
Startup Item No
Launched Yes

____________________________

Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week ago.

High
This file risk is high.

SONAR Protection monitors for suspicious program activity on your computer.

____________________________

Source: External Media

Source File:
explorer.exe

File Created:
锁屏.exe

____________________________

File Actions

File: c:\documents and settings\rusb\桌面\锁屏\锁屏.exe
Removed
____________________________

System Settings Actions

Event: Process start (Performed by c:\documents and settings\rusb\桌面\锁屏\锁屏.exe, PID:2628)
No action taken
Event: Process start: c:\documents and settings\rusb\桌面\锁屏\锁屏.exe, PID:2628 (Performed by c:\documents and settings\rusb\桌面\锁屏\锁屏.exe, PID:2628)
No action taken
____________________________

Suspicious Actions

Event: Keystroke capture (Performed by c:\documents and settings\rusb\桌面\锁屏\锁屏.exe, PID:2628)
No action taken
____________________________

File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

显示全部楼层 · 发表于 2014-8-11 23:59:37

这种东西在沙盒里运行什么结果能锁屏吗

显示全部楼层 · 发表于 2014-8-12 00:27:30

sogou2004 发表于 2014-8-11 23:59
这种东西在沙盒里运行什么结果能锁屏吗

一样被锁.只能注销

显示全部楼层 · 发表于 2014-8-12 08:32:41

过大蜘蛛

显示全部楼层 · 发表于 2014-8-12 09:25:18

本帖最后由 zxcqwe 于 2014-8-12 09:28 编辑

avast8.0
行为防护默认选阻止
沙箱提示暂无威胁
继续运行后重启
把十个数点完又重启
之后就不启动，好了
求解释

对了，要不要我说下图形答案

显示全部楼层 · 发表于 2014-8-12 09:29:26

。。。。。。。。。

显示全部楼层 · 发表于 2014-8-12 13:28:54

僵尸爱上猫发表于 2014-8-12 09:29
。。。。。。。。。

楼主原创的

，如果有只说明杀软太强大了......

显示全部楼层 · 发表于 2014-8-12 13:30:58

饭@avast 发表于 2014-8-12 00:27
一样被锁.只能注销

好厉害，看来不是任何样本都赶在沙盘里面跑了

[病毒样本] 锁屏

评分

本帖子中包含更多资源