Troj/Ransom-CGL

白露为霜

aboringman

AVG：

扫描：killed；

"";"Trojan horse Pakes2_c.BYUX, https://att.kafan.cn/forum.php?mod=attachment&aid=Mjc1NzI0Mnw3OGMyM2JjZXwxNDU1NzI4NjI1fDEwMDA1MDF8MTk2NDY5NQ%3D%3D";"Object was blocked";"URL";"2016/2/18, 1:04:08"

"";"Trojan horse Pakes2_c.BYUX, https://att.kafan.cn/forum.php?mod=attachment&aid=Mjc1NzI0Mnw3OGMyM2JjZXwxNDU1NzI4NjI1fDEwMDA1MDF8MTk2NDY5NQ%3D%3D:\4.exe";"Unresolved";"Embedded element in the archive, email attachment, cookie etc.";"2016/2/18, 1:04:08"

双击：关闭监控，实机双击，IDP击杀之。（连同两个衍生物及两个注册表项）

"";"IDP.Program.D1B0A5C0, C:\Users\killer\Desktop\4.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/2/18, 1:05:28"

"";", C:\Users\killer\Desktop\4.exe";"Object was blocked";"Process";"2016/2/18, 1:05:28"

"";", C:\Users\killer\AppData\Local\Temp\crehktn.exe";"Object was blocked";"Process";"2016/2/18, 1:05:28"

"";", C:\Users\killer\AppData\Local\Temp\crehktn.exe";"Object was blocked";"Process";"2016/2/18, 1:05:28"

"";", C:\Windows\Temp\1672034741.exe";"Object was blocked";"Process";"2016/2/18, 1:05:28"

"";", C:\Windows\Temp\1672034741.exe";"Object was blocked";"Process";"2016/2/18, 1:05:28"

"";", C:\Windows\Temp\1672034741.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/2/18, 1:05:28"

"";", C:\Users\killer\AppData\Local\Temp\crehktn.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/2/18, 1:05:28"

"";", HKEY_USERS\.DEFAULT\SOFTWARE\PORT SCANNING, (C)BY RSNM@SINA.COM";"Deleted, Moved to Virus Vault";"Registry key";"2016/2/18, 1:05:28"

"";", C:\Users\killer\Desktop\4.exe";"Object was blocked";"Process";"2016/2/18, 1:05:28"

"";", HKEY_USERS\S-1-5-21-540828005-2055914412-3868506426-1000\SOFTWARE\PORT SCANNING, (C)BY RSNM@SINA.COM";"Deleted, Moved to Virus Vault";"Registry key";"2016/2/18, 1:05:28"

cfhdrty

火绒不杀，hips阻止

无微不至

欧阳宣

norton
Trojan.Cryptolocker.E

墨家小子

cfhdrty 发表于 2016-2-18 04:44
火绒不杀，hips阻止

系统是32位还是64位？

墨家小子

拦截注入之后样本没有进一步行为

cxy密斯

pal家族

PC-西林 无检测

ericdj

cxy密斯 发表于 2016-2-18 08:57

补个BD双击