a variant of Win32/Kryptik.EPZZ trojan

白露为霜

文件类型	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
文件大小	429232 字节
MD5	be4e10c0047231ac903fc1ef79bc1e19

AVG	Found MalSign.Malware.530	2016-03-04
ESET	a variant of Win32/Kryptik.EPZZ trojan	2016-03-04

windows7爱好者

注入了explorer，然后居然注入百度输入法...........

Eset小粉絲

Avira
TR/AD.BetaBot.Y.216 Trojan

aboringman

AVG：

扫描：pass；

双击：关闭监控，实机双击，IDP击杀之。（连同衍生物“ga9y91a3g.exe”）

"";"IDP.Trojan.B0E3B135, C:\Users\killer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ga9y91a3g.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/3/4, 23:47:36"

"";", C:\Windows\System32\msiexec.exe";"Object was blocked";"Process";"2016/3/4, 23:47:36"

"";", C:\USERS\KILLER\DESKTOP\V.EXE";"Object was blocked";"Process";"2016/3/4, 23:47:36"

左手

[mw_shl_code=css,true]2016-3-4 23:48:25    创建文件夹 风险级别:未知    允许
进程: c:\documents and settings\administrator\桌面\v.exe
目标: C:\Program Files\Common Files\Device Driver Setup
规则: [文件组]询问_install -> [文件]?:\program files\*

2016-3-4 23:48:32    创建文件 风险级别:未知    允许
进程: c:\documents and settings\administrator\桌面\v.exe
目标: C:\Program Files\Common Files\Device Driver Setup\pivnmjtjc.txt
规则: [文件组]询问_install -> [文件]?:\program files\*

2016-3-4 23:48:40    设置文件夹隐藏属性 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\v.exe
目标: C:\Program Files\Common Files
规则: [文件组]询问_install -> [文件]?:\program files\*

2016-3-4 23:48:52    修改文件 风险级别:未知    阻止
进程: c:\documents and settings\administrator\桌面\v.exe
目标: C:\Documents and Settings\Administrator\桌面\v.exe
规则: [应用程序]?:\*\*\*\* -> [文件]c:\documents and settings\*\桌面\*

2016-3-4 23:48:52    修改文件 风险级别:未知    阻止
进程: c:\documents and settings\administrator\桌面\v.exe
目标: C:\Documents and Settings\Administrator\桌面\v.exe
规则: [应用程序]c:\documents and settings\administrator\桌面\v.exe -> [文件]c:\documents and settings\administrator\桌面; v.exe

2016-3-4 23:48:52    创建注册表项 风险级别:中    阻止并结束进程
进程: c:\documents and settings\administrator\桌面\v.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aywa539e.exe
规则: [应用程序]??* -> [注册表]*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*[/mw_shl_code]

pal家族

Kaspersky
Internet Security
ACCESS DENIED
The requested URL cannot be provided

Object URL:

https://att.kafan.cn/forum.php?mo ... Dk3NTc3MnwyMDMxNTQ3

Reason:

The object is infected by Trojan.Win32.Ocna.d
Message generated on: 2016/3/4 23:51:52

icedream89

ess9

MXCERILYF!

Bitdefender

心醉咖啡

360 malware radar01.gen

820119sly

楼主这个你用小a试了没？是不是过了。。。