习惯性认为可疑

显示全部楼层 · 发表于 2015-10-26 13:28:23

http://pan.baidu.com/s/1eQ6nZEy?_client_version=6.8.7

显示全部楼层 · 发表于 2015-10-26 13:29:49

请原谅我马上上课了，来不及验证是不是木马

显示全部楼层 · 发表于 2015-10-26 13:39:41

adware

显示全部楼层 · 发表于 2015-10-26 14:31:57

非正常方式安装惠惠购物助手

显示全部楼层 · 发表于 2015-10-26 14:36:21

本帖最后由毛豆新人于 2015-10-26 14:45 编辑

CIS miss all，看来下文件大小，貌似两个exe重复

毛豆在线沙盘：http://camas.comodo.com/cgi-bin/ ... 6344fc065be5f097e00

新建C:\b5tcj，C:\bfq，C:\ho，C:\llq

捆绑帮5淘

显示全部楼层 · 发表于 2015-10-26 16:11:31

显示全部楼层 · 发表于 2015-10-28 12:18:36

[mw_shl_code=css,true]Assessment
File1: 1019.exe
MD5: 0x0C5CD5DCFAFA21930758DF714E8B96A3
SHA-1: 0x18DC3BCA190A1CAA3C7D4CD964C9A06FAD4C0E93
Machine: Machine
Determination: NewThreat
Submission Detail: This file is detected as PUA.Gen.4 with our existing Rapid Release definition set. Protection is available in Rapid Release definitions with a sequence number of 169113 or greater.
Signature Protection Name: PUA.Gen.4
Rapid Release Sequence Number: 169113

This message was generated by Symantec Security Response automation.[/mw_shl_code]

[可疑文件] 习惯性认为可疑

评分

本帖子中包含更多资源

浏览过的版块