WS.Reputation.1

显示全部楼层 · 发表于 2016-2-19 20:31:32

扫描：miss
双击：
是个PUP

，后面的朋友请在沙盘双击
为啥每个PUP总有QQ浏览器

显示全部楼层 · 发表于 2016-2-19 20:52:41

微点

显示全部楼层 · 发表于 2016-2-19 21:07:00

AVG：

扫描：miss；

双击：PUP，pass。。。。。。

显示全部楼层 · 发表于 2016-2-19 21:09:12

本帖最后由 rrorr 于 2016-2-19 21:19 编辑

是下载器吗？趋势扫描和主防毫无反应

-----------------------------------------------
刚说完就被主防杀了HEU_AEGISCS927，之前我都和电脑对视2、3分钟了，装了qq浏览器和金山毒霸
-----------------------------------------------
然后再刚才的基础上我又双击了一次，又和电脑对望了2分钟后被主防杀了

显示全部楼层 · 发表于 2016-2-19 21:34:45

rrorr 发表于 2016-2-19 21:09
是下载器吗？趋势扫描和主防毫无反应

-----------------------------------------------

安装的软件回滚了么

显示全部楼层 · 发表于 2016-2-19 21:35:38

bbszy 发表于 2016-2-19 21:34
安装的软件回滚了么

没

显示全部楼层 · 发表于 2016-2-19 21:53:57

bbszy 发表于 2016-2-19 21:34
安装的软件回滚了么

AGIES的回滚要是能做到这种地步，我立马投入怀抱

显示全部楼层 · 发表于 2016-2-19 22:06:04

2016-2-19 22:05:04 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\cilhiglajehh.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
值: 46 00 00 00 31 0b 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 90 3e 8e 41 72 62 d1 01 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 c0 a8 01 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
规则: [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections; SavedLegacySettings
2016-2-19 22:05:18 创建新进程风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\cilhiglajehh.exe
目标: c:\windows\system32\cmd.exe
命令行: C:\WINDOWS\system32\cmd.exe /C copy /b "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nst127.tmp\" + "C:\WINDOWS\Fonts\SIMSUN.TTC" "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nst127.tmp\"
规则: [应用程序组]→终止_降权组件

2016-2-19 22:05:19 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\cilhiglajehh.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\c:\program files\ksafe\AppData\proc_startup_perf.dat \??\C:\PROGRAM FILES\TENCENT\TM2013\BIN\msimg32.dll~ \??\C:\PROGRAM FILES\TENCENT\TM2013\BIN\msimg32.dll~ \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nst127.tmp\nsProcess.dll
规则: [注册表组]拦截_病毒生成物 -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager; PendingFileRenameOperations

2016-2-19 22:05:19 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\cilhiglajehh.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\c:\program files\ksafe\AppData\proc_startup_perf.dat \??\C:\PROGRAM FILES\TENCENT\TM2013\BIN\msimg32.dll~ \??\C:\PROGRAM FILES\TENCENT\TM2013\BIN\msimg32.dll~ \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nst127.tmp\
规则: [注册表组]拦截_病毒生成物 -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager; PendingFileRenameOperations

显示全部楼层 · 发表于 2016-2-19 22:33:59

双击过EVA

[可疑文件] WS.Reputation.1

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块