照片

显示全部楼层 · 发表于 2014-9-2 20:55:44

发的邮件大家看看

显示全部楼层 · 发表于 2014-9-2 21:00:07

本帖最后由 minjiaming 于 2014-9-2 21:01 编辑

BD被过双击也是一样.过了一分钟BD主防提示检测到病毒, 但是没有删除干净,只删除了缓存目录下的photo.exe,有残留别的文件

显示全部楼层 · 发表于 2014-9-2 21:01:13

本帖最后由饭@avast 于 2014-9-2 21:08 编辑

ESET-NOD32 Win32/Pronny.LZ 10353 20140902
Cyren W32/Trojan.HGIH-4282 5.4.1.7 20140902
ByteHero Virus.Win32.Heur.p 1.0.0.1 20140902
DrWeb Trojan.PWS.Turist.144 7.0.10.8210 20140902
Sophos Mal/VBInj-BB 4.98.0 20140902
Qihoo-360 HEUR/Malware.QVM03.Gen 1.0.0.1015 20140902
VBA32 BScope.Trojan-Spy.Zbot 3.12.26.3 20140902
诺顿下载分析杀.双击没反应.结束之.
趋势主防杀

显示全部楼层 · 发表于 2014-9-2 21:11:48

费尔启发杀

显示全部楼层 · 发表于 2014-9-2 21:18:53

数字

显示全部楼层 · 发表于 2014-9-2 21:27:49

avast kill

显示全部楼层 · 发表于 2014-9-2 21:44:26

诺顿文件智能分析认为别碰为妙

显示全部楼层 · 发表于 2014-9-2 23:21:17

好压火绒扫描MISS

EAVKILL

显示全部楼层 · 发表于 2014-9-3 00:19:53

卡巴斯基杀

显示全部楼层 · 发表于 2014-9-3 08:22:03

Filename: photo.exe
Threat name: SONAR.SelfHijack!gen1Full Path: Not Available

____________________________

____________________________

____________________________

photo.exe Threat name: SONAR.SelfHijack!gen1
Locate

Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week ago.

High
This file risk is high.

____________________________

Source: External Media

Source File:
photo.exe

____________________________

File Actions

File: f:\norton样本\临时收集\ photo.exe Threat Removed
File: c:\Users\administrator\AppData\LocalLow\SogouPY\components\ componentconfig.ini Threat Removed
Event: Running process: f:\norton样本\临时收集\ photo.exe Terminated
____________________________

Registry Actions

Registry change: HKEY_USERS\S-1-5-21-1071228153-3121885108-811120218-500\Software\ SogouInput.user->SogouComponentFirstLoad:1409703238 Repaired
Registry change: HKEY_USERS\S-1-5-21-1071228153-3121885108-811120218-500\Software\ SogouInput.user->Used:1409703238 Repaired
____________________________

System Settings Actions

Event: Process start (Performed by f:\norton样本\临时收集\photo.exe, PID:3540) No action taken
(Performed by f:\norton样本\临时收集\photo.exe, PID:3540) No action taken
Event: Process start: f:\norton样本\临时收集\ photo.exe, PID:1096 (Performed by f:\norton样本\临时收集\photo.exe, PID:3540) No action taken
Event: Process start: f:\norton样本\临时收集\ photo.exe, PID:3540 (Performed by f:\norton样本\临时收集\photo.exe, PID:3540) No action taken
____________________________

File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

[可疑文件] 照片

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块