今天裸奔中的毒，卡巴从我电脑里抓的

windows7爱好者

pal家族 发表于 2016-1-1 16:16
删掉就好了。。。。。你在用PChunter检查下驱动服务启动项就好
2345可是A股上市公司，卡巴可是怕死了的 ...

数字又干掉了一个启动项

pal家族

windows7爱好者 发表于 2016-1-1 17:18
数字又干掉了一个启动项

会用PChunter哪里需要急救箱来杀流氓~~

windows7爱好者

pal家族 发表于 2016-1-1 17:20
会用PChunter哪里需要急救箱来杀流氓~~

数字的急救箱感觉还是可以的 ，我家是win10 11082，PC用不了的

275751198

360 Win32/Trojan.97a
下载没杀但是一解压就弹窗删除了

尘梦幽然

[mw_shl_code=css,true]Assessment

File1:        SExplore.exe
MD5:        0x214F0CDFA7E69C3D72F935EAAC610BBF
SHA-1:        0x0405371F57B7D93133E145F8941FDA884B30C151
Machine:        Machine
Determination:        NewThreat
Submission Detail:        This file is detected as Trojan.Gen with our existing Rapid Release definition set. Protection is available in Rapid Release definitions with a sequence number of 171334 or greater.
Signature Protection Name:        Trojan.Gen
Rapid Release Sequence Number:        171334

This message was generated by Symantec Security Response automation.[/mw_shl_code]

[mw_shl_code=css,true]When executed, the threat performs the following functions.
The following file(s) were created:
%Windir%\inf\oem7.PNF
(af77ac39c6e220d65dc08947444ce0ca)
%Windir%\inf\oem7.inf
(ddd7c557a24cc1270b5d5b050d492661)
%Windir%\LastGood\TMP1.tmp
%Windir%\LastGood\TMP2.tmp
%System%\drivers\SET3.tmp
%Windir%\inf\oem10.inf
(ddd7c557a24cc1270b5d5b050d492661)
%Windir%\LastGood\INF\oem10.inf
%Windir%\LastGood\INF\oem10.PNF
%Windir%\hllog.txt
(246b0cdd711e81c5459511b3eb0356fd)
%Windir%\hllog.txt
(60dbb9b699ac33f2902bcbfe972a1366)
%Windir%\Setupsti.log
(6fcdd016335a948defde36672da70691)
%System%\drivers\Mslmedia.sys
(b611367fe6f04843a38b663099968550)
%Temp%\~tmp_hl\mslmedia.inf
%Temp%\~tmp_hl\mslmedia.sys
%System%\LMIns.exe
(309ba5e79a57795bd3bc91554336a45d)
%Windir%\_ntdll.bak
(27d9ed8cb8b62d1e0a8e5ace6cf52e2f)
The following file(s) were deleted:
%Windir%\LastGood\TMP1.tmp
%Windir%\LastGood\TMP2.tmp
%System%\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem7.CAT
%System%\CatRoot2\edbtmp.log
%System%\CatRoot2\tmp.edb
%System%\drivers\SET3.tmp
%System%\CatRoot2\tmp.stm
%System%\drivers\Mslmedia.sys
%Temp%\~tmp_hl\mslmedia.inf
%Temp%\~tmp_hl\mslmedia.sys
The following file(s) were modified:
%System%\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\TimeStamp
%Windir%\setupapi.log
%System%\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
%System%\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\TimeStamp
%System%\CatRoot2\edb.log
%System%\CatRoot2\tmp.edb
The following file(s) were renamed:
%Windir%\LastGood\INF\oem7.PNF
%Windir%\LastGood\INF\oem7.inf
%Windir%\LastGood\TMP1.tmp
%Windir%\LastGood\TMP2.tmp
%System%\drivers\SET3.tmp
%System%\drivers\Mslmedia.sys
The following registry subkey(s) were created:
HKEY_LOCAL_MACHINE\SYSTEM\LastKnownGoodRecovery\LastGood
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\Instances
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\Instances\Mslmedia Instance
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\Security
The following folder(s) were created:
%Windir%\LastGood
%Windir%\LastGood\INF
%Temp%\~tmp_hl
The following folder(s) were deleted:
%Temp%\~tmp_hl
The following mutex(es) were created:
lmins_1_0_1
The following registry entries were created:
HKEY_LOCAL_MACHINE\SYSTEM\LastKnownGoodRecovery\LastGood\"INF/oem7.PNF" = "1"
HKEY_LOCAL_MACHINE\SYSTEM\LastKnownGoodRecovery\LastGood\"INF/oem7.inf" = "1"
HKEY_LOCAL_MACHINE\SYSTEM\LastKnownGoodRecovery\LastGood\"INF/oem10.inf" = "1"
HKEY_LOCAL_MACHINE\SYSTEM\LastKnownGoodRecovery\LastGood\"INF/oem10.PNF" = "1"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GroupOrderList\"FSFilter Activity Monitor" = "[BINARY DATA]"
The following registry entries were created so that it runs every time Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"SExplore" = "%CurrentFolder[ORIGINAL FILE
NAME]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"SExplore" = "%CurrentFolder[ORIGINAL FILE
NAME].exe"
The following registry entries were created to register itself as a legacy driver service:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSLMEDIA\0000\"ClassGUID" = "[BINARY DATA]"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSLMEDIA\0000\"Class" = "LegacyDriver"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSLMEDIA\0000\"ConfigFlags" = "0"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSLMEDIA\0000\"DeviceDesc" = "Mslmedia"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSLMEDIA\0000\"Legacy" = "1"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSLMEDIA\0000\"Service" = "Mslmedia"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSLMEDIA\"NextInstance" = "1"
The following registry entries were created to register itself as a system service:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\"DebugFlags" = "0"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\"DependOnGroup" = ""
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\"DependOnService" = "FltMgr"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\"Description" = "Mslmedia Media Driver"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\"DisplayName" = "Mslmedia"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\"ErrorControl" = "1"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\"Group" = "FSFilter Activity Monitor"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\"ImagePath" = "system32\DRIVERS\Mslmedia.sys""
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\"ImagePath" = "system32\DRIVERS\Mslmedia.sys"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\Instances\"DefaultInstance" = "Mslmedia Instance"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\Instances\Mslmedia Instance\"Altitude" = "370030"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\Instances\Mslmedia Instance\"Flags" = "0"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\Security\"Security" = "[BINARY DATA]"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\"Start" = "1"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\"Tag" = "4"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mslmedia\"Type" = "2"
Searches for the following addresses:
hlsoft2.laolaoma.com
Presence of service(s) with the following characteristics:
Name: "Mslmedia"
Image Path: "system32\DRIVERS\Mslmedia.sys"
Type: System[/mw_shl_code]

温馨小屋

FS灭了

windows7爱好者

这两个驱动卡巴还没入库？

飞翔病毒

醉了，两个抓样本最给力的两家都没入库

275751198

类型:包含木马的压缩包文件
描述:包含至少 1 个木马程序
LMIns.exe : HEUR/QVM10.1.Malware.Gen

扫描引擎:云特征引擎
位置:D:\邮件\新建文件夹\新建文件夹 (2)\新建文件夹\新建文件夹 (3)\新建文件夹 (5)\搬运中转站\LMIns.part1.rar
处理建议:隔离文件

蓝泽祈

pal家族 发表于 2016-1-1 17:20
会用PChunter哪里需要急救箱来杀流氓~~

我这win10 th2 x64无法启动PChunter，你的行么