Detection ratio: 1 / 54 order481449.txt.exe

显示全部楼层 · 发表于 2015-12-8 18:04:12

SHA256: 2c013cb5d1e0394e520b92effed37b23cb65566c74a098d94c1ff4a9b5c31016
File name: order481449.txt.exe
Detection ratio: 1 / 54
Analysis date: 2015-12-08 09:21:26 UTC ( 39 minutes ago )
https://www.virustotal.com/en/fi ... 9b5c31016/analysis/

2015/12/8 18:01:58,C:\Windows\explorer.exe,53,Allowed ;执行应用程序 ("C:\Users\SSSS\Desktop\AA\order481449.txt.exe" )

2015/12/8 18:02:10,C:\Users\SSSS\Desktop\AA\order481449.txt.exe,53,Allowed ;执行应用程序 ("C:\Program Files (x86)\Internet Explorer\iexplore.exe")

2015/12/8 18:02:12,C:\Users\SSSS\Desktop\AA\order481449.txt.exe,40,Blocked ;以修改权限打开进程或线程 (iexplore.exe(pid=3004))

2015/12/8 18:02:12,C:\Program Files (x86)\Internet Explorer\iexplore.exe,50,Allowed ;使用 DNS 解析服务访问网络

2015/12/8 18:02:13,C:\Program Files (x86)\Internet Explorer\iexplore.exe,48,Allowed ;出站网络访问

2015/12/8 18:02:13,C:\Windows\explorer.exe,57,Allowed ;正在以只读方式打开受保护的进程 (iexplore.exe(pid=3004))

显示全部楼层 · 发表于 2015-12-8 19:00:22

AVAST

显示全部楼层 · 发表于 2015-12-8 19:12:41

显示全部楼层 · 发表于 2015-12-8 19:37:38

本帖最后由 aboringman 于 2015-12-8 19:39 编辑

AVG：

扫描：网页防护拦截下载；

"";"Virus found FakeAlert, att.kafan.cn/forum.php?mod=attachment&aid=MjcyOTQxN3w5ODVmZTUyZHwxNDQ5NTc0MTE0fDEwMDA1MDF8MTg2ODYxNQ%3D%3D";"Object was blocked";"URL";"2015/12/8, 19:29:21"

双击：实机双击（不入沙），IDP只击杀了衍生物。

"";"Unknown, C:\USERS\KILLER.KILLER-PC\APPDATA\LOCAL\TEMP\2C83.EXE";"Deleted";"File or Directory";"2015/12/8, 19:31:20"
"";", C:\Windows\System32\svchost.exe";"Object was blocked";"Process";"2015/12/8, 19:31:20"
"";", C:\Windows\explorer.exe";"Object was blocked";"Process";"2015/12/8, 19:31:20"
"";", C:\Users\killer.Killer-PC\AppData\Roaming\{F4601CD8-1540-7600-5000-ED5D49AA65}\puvbchmnst.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/8, 19:31:20"
"";", C:\USERS\KILLER.KILLER-PC\APPDATA\LOCAL\TEMP\2C83.EXE";"Object was blocked";"Process";"2015/12/8, 19:31:20"
"";", HKEY_USERS\S-1-5-21-1910074467-3606790842-1030588025-1003\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\{F4601CD8-1540-7600-5000-ED5D49AA65}";"Deleted, Moved to Virus Vault";"Registry value";"2015/12/8, 19:31:20"

显示全部楼层 · 发表于 2015-12-8 20:49:12

文件被阻止运行，哪来的衍生物

显示全部楼层 · 发表于 2015-12-8 21:52:47

红伞kill

显示全部楼层 · 发表于 2015-12-8 22:36:46

360 QVM20

显示全部楼层 · 发表于 2015-12-8 22:51:55

SUD to BAV

显示全部楼层 · 发表于 2015-12-9 11:37:02

F-Secure kill

显示全部楼层 · 发表于 2015-12-9 12:19:17

火绒

[可疑文件] Detection ratio: 1 / 54 order481449.txt.exe

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

评分

评分

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块