ramdisk

pal家族

ymb668888 发表于 2016-2-20 13:07
@pal家族 解压不杀，双击，卡巴杀，但是数据依然被加密

这么吊人胃口啊~~~日志截图都没有。。。
我还是去睡午觉吧

rrorr

胖福 发表于 2016-2-20 11:59

这是疯狂模式？

pal家族

安全威脅:        HEU_AEGIS_CRYPT
來源類型:        安全威脅
受影響的檔案:        d:\360安全浏览器下载\r…\ramdisk.exe
處理行動:        已移除
偵測方式:        未經授權的加密掃瞄


weiwu！！！！！！！！！！！！！！！！！！！！！！！！！！！！！

啊哈哈哈~~百无一用的趋势防勒索终于起效了哈，我就知道连acdsee改三张图片都要拦截的蛐蛐，这个国产加密肯定不在话下！

美中不足

ymb668888

看记录，好像主防回滚了部分文件

windows7爱好者

pal家族 发表于 2016-2-20 13:13
安全威脅:        HEU_AEGIS_CRYPT
來源類型:        安全威脅
受影響的檔案:        d:\360安全浏览器下载\r…\ramdisk.ex ...

明天给分，啥也不说
一个都没加密成功？

pal家族

windows7爱好者 发表于 2016-2-20 13:15
明天给分，啥也不说
一个都没加密成功？

名稱:        ramdisk.exe
寄件人:        未知
版本:       
版權所有:       
偵測到的資源或程序 ID:        d:\360安全浏览器下载\ramdisk\ramdisk.exe
回應:        已終止
已變更的檔案:       
mmog_data.xml
cqsconfig.xml
audioengineconfigdefault.xml

我找了下，这三个文件加密过和没加密的都在。。。。

pal家族

ymb668888 发表于 2016-2-20 13:13
看记录，好像主防回滚了部分文件

你会导出嘛。。。。。。

另外加密了哪些呢？都加密了吗

icedream89

pal家族 发表于 2016-2-20 13:13
安全威脅:        HEU_AEGIS_CRYPT
來源類型:        安全威脅
受影響的檔案:        d:\360安全浏览器下载\r…\ramdisk.ex ...

-0-不错，
啊 剑灵 很久以前玩过

1446547521

pal家族 发表于 2016-2-20 13:18
你会导出嘛。。。。。。

另外加密了哪些呢？都加密了吗

现在趋势还会改系统设置吧

ymb668888

@pal家族 20.02.2016 13.17.03;回滚所检测到对象的操作时进程被终止。;c:\sandbox\administrator\defaultbox\drive\d\ramdisk.dll.exe;c:\sandbox\administrator\defaultbox\drive\d\ramdisk.dll.exe;02/20/2016 13:17:03
20.02.2016 13.17.10;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\ramdisk.dll.exe;c:\sandbox\administrator\defaultbox\drive\d\ramdisk.dll.exe;02/20/2016 13:17:10
20.02.2016 13.17.11;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\antispam.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\antispam.dll;02/20/2016 13:17:11
20.02.2016 13.17.11;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\atl80.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\atl80.dll;02/20/2016 13:17:11
20.02.2016 13.17.11;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\cloud.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\cloud.dll;02/20/2016 13:17:11
20.02.2016 13.17.11;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\common.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\common.dll;02/20/2016 13:17:11
20.02.2016 13.17.11;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\crashrpt.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\crashrpt.dll;02/20/2016 13:17:11
20.02.2016 13.17.12;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\helper.js;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\helper.js;02/20/2016 13:17:12
20.02.2016 13.17.12;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\jquery.min.js;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\jquery.min.js;02/20/2016 13:17:12
20.02.2016 13.17.12;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\jquery.tinyscrollbar.js;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\jquery.tinyscrollbar.js;02/20/2016 13:17:12
20.02.2016 13.17.13;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\multiview.js;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\multiview.js;02/20/2016 13:17:13
20.02.2016 13.17.13;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\viewer.js;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\viewer.js;02/20/2016 13:17:13
20.02.2016 13.17.13;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\deskir.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\deskir.dll;02/20/2016 13:17:13
20.02.2016 13.17.13;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\device.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\device.dll;02/20/2016 13:17:13
20.02.2016 13.17.14;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\flashmail.exe;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\flashmail.exe;02/20/2016 13:17:14
20.02.2016 13.17.14;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\flashmailshell.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\flashmailshell.dll;02/20/2016 13:17:14
20.02.2016 13.17.14;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\flashmailshell64.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\flashmailshell64.dll;02/20/2016 13:17:14
20.02.2016 13.17.14;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\fmupdater.exe;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\fmupdater.exe;02/20/2016 13:17:14
20.02.2016 13.17.14;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\idownrun.exe;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\idownrun.exe;02/20/2016 13:17:14
20.02.2016 13.17.14;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\im.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\im.dll;02/20/2016 13:17:14
20.02.2016 13.17.15;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\kernel.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\kernel.dll;02/20/2016 13:17:15
20.02.2016 13.17.15;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\libcurl.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\libcurl.dll;02/20/2016 13:17:15
20.02.2016 13.17.15;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\libeay32.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\libeay32.dll;02/20/2016 13:17:15
20.02.2016 13.17.15;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\mail.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\mail.dll;02/20/2016 13:17:15
20.02.2016 13.17.15;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\mfc80u.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\mfc80u.dll;02/20/2016 13:17:15
20.02.2016 13.17.15;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\migrate.exe;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\migrate.exe;02/20/2016 13:17:15
20.02.2016 13.17.16;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\modules\weather\citymap.js;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\modules\weather\citymap.js;02/20/2016 13:17:16
20.02.2016 13.17.16;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\msvcp80.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\msvcp80.dll;02/20/2016 13:17:16
20.02.2016 13.17.16;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\msvcr80.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\msvcr80.dll;02/20/2016 13:17:16
20.02.2016 13.17.16;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\net.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\net.dll;02/20/2016 13:17:16
20.02.2016 13.17.17;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\notification.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\notification.dll;02/20/2016 13:17:17
20.02.2016 13.17.17;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\schedule.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\schedule.dll;02/20/2016 13:17:17
20.02.2016 13.17.17;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\sqlite3.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\sqlite3.dll;02/20/2016 13:17:17
20.02.2016 13.17.17;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\ssleay32.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\ssleay32.dll;02/20/2016 13:17:17
20.02.2016 13.17.17;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\start.exe;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\start.exe;02/20/2016 13:17:17
20.02.2016 13.17.19;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\theme.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\theme.dll;02/20/2016 13:17:19
20.02.2016 13.17.19;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\updater.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\updater.dll;02/20/2016 13:17:19
20.02.2016 13.17.19;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\zlib.dll;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\zlib.dll;02/20/2016 13:17:19
20.02.2016 13.17.19;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\卸载闪电邮.exe;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\卸载闪电邮.exe;02/20/2016 13:17:19
20.02.2016 13.17.19;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\解密.exe;c:\sandbox\administrator\defaultbox\drive\d\解密.exe;02/20/2016 13:17:19
20.02.2016 13.17.20;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\d3d9.dll;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\d3d9.dll;02/20/2016 13:17:20
20.02.2016 13.17.20;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san.exe;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san.exe;02/20/2016 13:17:20
20.02.2016 13.17.20;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\user\current\downloads\runs.bat;c:\sandbox\administrator\defaultbox\user\current\downloads\runs.bat;02/20/2016 13:17:20
20.02.2016 13.17.20;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\template\update\reply\纯文本邮件.txt;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\template\update\reply\纯文本邮件.txt;02/20/2016 13:17:20
20.02.2016 13.17.20;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\theme\build.xml;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\theme\build.xml;02/20/2016 13:17:20
20.02.2016 13.17.20;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\theme\themelist.xml;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\theme\themelist.xml;02/20/2016 13:17:20
20.02.2016 13.17.20;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\theme\theme_base.xml;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\theme\theme_base.xml;02/20/2016 13:17:20
20.02.2016 13.17.20;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\软件\data\ocfg.odb;c:\sandbox\administrator\defaultbox\drive\d\软件\data\ocfg.odb;02/20/2016 13:17:20
20.02.2016 13.17.20;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san13manual_jp.pdf;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san13manual_jp.pdf;02/20/2016 13:17:20
20.02.2016 13.17.20;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san13readme_jp.txt;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san13readme_jp.txt;02/20/2016 13:17:20
20.02.2016 13.17.20;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san13readme_tc.txt;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san13readme_tc.txt;02/20/2016 13:17:20
20.02.2016 13.17.21;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san1manual_jp.pdf;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san1manual_jp.pdf;02/20/2016 13:17:21
20.02.2016 13.17.21;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san1manual_tc.pdf;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san1manual_tc.pdf;02/20/2016 13:17:21
20.02.2016 13.17.43;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\helper.js;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\helper.js;02/20/2016 13:17:43
20.02.2016 13.17.43;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\jquery.min.js;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\jquery.min.js;02/20/2016 13:17:43
20.02.2016 13.17.43;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\jquery.tinyscrollbar.js;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\jquery.tinyscrollbar.js;02/20/2016 13:17:43
20.02.2016 13.17.44;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\multiview.js;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\multiview.js;02/20/2016 13:17:44
20.02.2016 13.17.44;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\viewer.js;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\data\pages\viewer.js;02/20/2016 13:17:44
20.02.2016 13.17.46;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\modules\weather\citymap.js;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\modules\weather\citymap.js;02/20/2016 13:17:46
20.02.2016 13.17.50;回滚所检测到对象的操作时文件被删除。;c:\sandbox\administrator\defaultbox\user\current\downloads\runs.bat;c:\sandbox\administrator\defaultbox\user\current\downloads\runs.bat;02/20/2016 13:17:50
20.02.2016 13.17.50;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\template\update\reply\纯文本邮件.txt;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\template\update\reply\纯文本邮件.txt;02/20/2016 13:17:50
20.02.2016 13.17.50;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\theme\build.xml;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\theme\build.xml;02/20/2016 13:17:50
20.02.2016 13.17.50;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\theme\themelist.xml;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\theme\themelist.xml;02/20/2016 13:17:50
20.02.2016 13.17.50;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\theme\theme_base.xml;c:\sandbox\administrator\defaultbox\drive\d\网易闪电邮\theme\theme_base.xml;02/20/2016 13:17:50
20.02.2016 13.17.50;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\软件\data\ocfg.odb;c:\sandbox\administrator\defaultbox\drive\d\软件\data\ocfg.odb;02/20/2016 13:17:50
20.02.2016 13.17.50;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san13manual_jp.pdf;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san13manual_jp.pdf;02/20/2016 13:17:50
20.02.2016 13.17.50;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san13readme_jp.txt;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san13readme_jp.txt;02/20/2016 13:17:50
20.02.2016 13.17.50;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san13readme_tc.txt;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san13readme_tc.txt;02/20/2016 13:17:50
20.02.2016 13.17.50;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san1manual_jp.pdf;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san1manual_jp.pdf;02/20/2016 13:17:50
20.02.2016 13.17.50;回滚所检测到对象的操作时文件被恢复。;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san1manual_tc.pdf;c:\sandbox\administrator\defaultbox\drive\d\软件\romance of the three kingdoms 13\san1manual_tc.pdf;02/20/2016 13:17:50