卡巴云拉黑

1446547521

链接：http://pan.baidu.com/s/1nu1UKml 密码：n6ct

解压密码：kafan

z2009

此链接分享内容可能因为涉及侵权、色情、反动、低俗等信息，无法访问!

1446547521

z2009 发表于 2016-1-30 21:17
此链接分享内容可能因为涉及侵权、色情、反动、低俗等信息，无法访问!

被百度墙了

windows7爱好者

pal家族

30.01.2016 21.41.20;Malicious program deleted;D:\360安全浏览器下载\1\进化DDOS工具(2).exe;D:\360安全浏览器下载\1\进化DDOS工具(2).exe;UDS:DangerousObject.Multi.Generic;进化DDOS程序;D:\360安全浏览器下载\1\进化DDOS工具(2).exe

275751198

360 HEUR/Malware.QVM16.Gen

aboringman

AVG：

扫描：miss；

双击：实机双击，随便输个钓鱼网址后启动线程，然后摧毁线程，弹出无数个重启IE生效还有重启生效的窗口，最终葬送在我IDP的手上。

"";"IDP.ALEXA.51, C:\Users\kiiler\Desktop\进化DDOS工具(2).exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/1/30, 21:42:03"
"";", C:\Windows\System32\taskkill.exe";"Object was blocked";"Process";"2016/1/30, 21:42:03"
"";", C:\Windows\System32\taskkill.exe";"Object was blocked";"Process";"2016/1/30, 21:42:03"
"";", C:\Windows\System32\taskkill.exe";"Object was blocked";"Process";"2016/1/30, 21:42:03"
"";", C:\Windows\System32\taskkill.exe";"Object was blocked";"Process";"2016/1/30, 21:42:03"
"";", C:\Windows\System32\taskkill.exe";"Object was blocked";"Process";"2016/1/30, 21:42:03"
"";", C:\Windows\System32\taskkill.exe";"Object was blocked";"Process";"2016/1/30, 21:42:03"
"";", C:\Windows\System32\taskkill.exe";"Object was blocked";"Process";"2016/1/30, 21:42:03"
"";", C:\Windows\System32\taskkill.exe";"Object was blocked";"Process";"2016/1/30, 21:42:03"
"";", C:\Windows\System32\taskkill.exe";"Object was blocked";"Process";"2016/1/30, 21:42:03"
"";", C:\Windows\System32\taskkill.exe";"Object was blocked";"Process";"2016/1/30, 21:42:03"
"";", C:\Windows\System32\taskkill.exe";"Object was blocked";"Process";"2016/1/30, 21:42:03"
"";", C:\Windows\System32\taskkill.exe";"Object was blocked";"Process";"2016/1/30, 21:42:03"
"";", C:\Windows\System32\taskkill.exe";"Object was blocked";"Process";"2016/1/30, 21:42:03"
"";", C:\Users\kiiler\Desktop\进化DDOS工具(2).exe";"Object was blocked";"Process";"2016/1/30, 21:42:03"
"";", HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER";"Deleted, Moved to Virus Vault";"Registry key";"2016/1/30, 21:42:03"
"";", HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\ADMINISTRATION";"Deleted, Moved to Virus Vault";"Registry value";"2016/1/30, 21:42:03"
"";", HKEY_USERS\S-1-5-21-2236816692-667211127-2861217297-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM";"Deleted, Moved to Virus Vault";"Registry key";"2016/1/30, 21:42:03"
"";", HKEY_USERS\S-1-5-21-2236816692-667211127-2861217297-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM\\DISABLEREGISTRYTOOLS";"Deleted";"Registry value";"2016/1/30, 21:42:03"

PS.真猛，多次调用taskkill.exe试图关闭某个程序，但均被IDP阻止，还修改重要注册表项，简直就是送自己入IDP之口啊。。。。。。

windows7爱好者

aboringman 发表于 2016-1-30 21:48
AVG：

扫描：miss；

IDP当年被我一个样本蹂躏过啊

aboringman

windows7爱好者 发表于 2016-1-30 21:54
IDP当年被我一个样本蹂躏过啊

我当然还记得，那个样本还过了ATC呢。不过，那个样本可真狠，一次性破坏多个位置，而且是从运行开始就开始破坏，当然各种主防都挡不住

nick20010117

关闭监控，BG双击，防火墙拦截后杀
关闭防火墙后双击，再次杀@aboringman