電腦裡找到的

諾言敵不過時間

看看這是什麼? 文件路徑如圖

电脑发烧友

火绒目前扫描不杀，双击也不杀。

ELOHIM

Edge缓存吗？？

諾言敵不過時間

ELOHIM 发表于 2015-8-14 18:08
Edge缓存吗？？

看路徑應該是緩存

猥琐大叔

ELOHIM

Windows Defender不报。
• File Info

Name	Value
Size	377976
MD5	ee61d1b67ba6e91641e25c88dcda4489
SHA1	7789a2f8ee9919fd780d19a8a566a43b1f376e54
SHA256	0020384113a2d46b1025a8b72442e96a4ebf418fad47ad034de741bec74628e3
Process	Exited

• Keys Created

Name	Last Write Time
CU\Software\Microsoft\mdi	2009.01.09 10:54:23.250

• Keys Changed• Keys Deleted• Values Created

Name	Type	Size	Value
CU\Software\Microsoft\mdi\uid	REG_SZ	156	"c27196ad-d77b-4b53-bc67-fabd39b6fd37-c0229d503ae6930ecc4a1252480aa8b82b65c4d4"

• Values Changed• Values Deleted• Directories Created

Name	Last Write Time	Creation Time	Last Access Time	Attr
C:\Documents and Settings\User\Local Settings\Temp\mdi1.tmp	2009.01.09 10:54:23.343	2009.01.09 10:54:23.343	2009.01.09 10:54:23.343	0x10
C:\MediaDrug	2009.01.09 10:54:23.343	2009.01.09 10:54:23.343	2009.01.09 10:54:23.343	0x10

• Directories Changed• Directories Deleted• Files Created

Name	Size	Last Write Time	Creation Time	Last Access Time	Attr
C:\TEST\mdi-2009-01-09-12-54-23.txt	332	2009.01.09 10:54:24.406	2009.01.09 10:54:23.453	2009.01.09 10:54:23.453	0x20

• Files Changed• Files Deleted• Directories Hidden• Files Hidden• Drivers Loaded• Drivers Unloaded• Processes Created• Processes Terminated• Threads Created

PId	Process Name	TId	Start	Start Mem	Win32 Start	Win32 Start Mem
0x348	svchost.exe	0x784	0x7c810856	MEM_IMAGE	0x7c910760	MEM_IMAGE
0x420	svchost.exe	0x7e4	0x7c810856	MEM_IMAGE	0x77df9981	MEM_IMAGE

• Modules Loaded• Windows Api Calls• DNS Queries

DNS Query Text

debugdatalab.com IN A +

• HTTP Queries

HTTP Query Text

debugdatalab.com GET /client.config/?format=json&advert_key=ZWMwMDAzMDAwYjAwMDI4ODAwMDAwMjkwMDAwMjkwMDAwMjkwMzYxZmQxYTlhMg==ff1a9f8810e4423c&app=md_downloader&oslang=ru-ru&brlang=&uid=c27196ad-d77b-4b53-bc67-fabd39b6fd37-c0229d503ae6930ecc4a1252480aa8b82b65c4d4 HTTP/1.1

• Verdict

Auto Analysis Verdict

Undetected

• Mutexes  Created or Opened

PId	Image Name	Address	Mutex Name
0xd8	C:\TEST\sample.exe	0x40d004	b4123099-a7ea-4286-bf83-98f6b2641593

---------
看你的结果，应该是广告程序。

fuzhk

诺顿的不用测了！

諾言敵不過時間

ELOHIM 发表于 2015-8-14 18:16
Windows Defender不报。
• File Info• Keys Created• Keys Changed• Keys Delete ...

謝謝大神

我如浮云般飘过

McAfee wa 报

ELOHIM

諾言敵不過時間 发表于 2015-8-14 18:38
謝謝大神

我晕，我不是大神……………………