Could be a Trojan horse PSW.ILUSpy

aboringman

rrorr 发表于 2016-3-12 12:24
下面那个是啥？

趋势的根本原因分析报告，主要是用来让用户了解威胁是如何进入及入侵的。

aboringman

AVG：

扫描：killed；（by WP）；

"";"Could be a Trojan horse PSW.ILUSpy, https://att.kafan.cn/forum.php?mod=attachment&aid=Mjc2NTc2NHxjZmY3MzY3YXwxNDU3NzYwNzQ0fDEwMDA1MDF8MjAzMjY0MQ%3D%3D";"Object was blocked";"URL";"2016/3/12, 13:32:24"

"";"Could be a Trojan horse PSW.ILUSpy, https://att.kafan.cn/forum.php?mod=attachment&aid=Mjc2NTc2NHxjZmY3MzY3YXwxNDU3NzYwNzQ0fDEwMDA1MDF8MjAzMjY0MQ%3D%3D:\f.exe";"Unresolved";"Embedded element in the archive, email attachment, cookie etc.";"2016/3/12, 13:32:24"

双击：关闭监控，实机双击，IDP击杀之。（【又现ALEXA】连同衍生物Errofix.exe）；

"";"IDP.ALEXA.51, C:\Users\killer\AppData\Local\Temp\ErroFix.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/3/12, 13:34:12"

"";", C:\Users\killer\Desktop\f.exe";"Object was blocked";"Process";"2016/3/12, 13:34:12"

"";", C:\Windows\System32\netsh.exe";"Object was blocked";"Process";"2016/3/12, 13:34:12"

"";", C:\Users\killer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5c0a0b4e535bae7210683abf755ee7c4.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/3/12, 13:34:12"

"";", C:\Users\killer\Desktop\f.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/3/12, 13:34:12"

"";", C:\Users\killer\AppData\Local\Temp\ErroFix.exe";"Object was blocked";"Process";"2016/3/12, 13:34:12"

"";", HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\5C0A0B4E535BAE7210683ABF755EE7C4";"Deleted, Moved to Virus Vault";"Registry value";"2016/3/12, 13:34:12"

"";", HKEY_USERS\S-1-5-21-3895625976-2995373382-4201264068-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\5C0A0B4E535BAE7210683ABF755EE7C4";"Deleted, Moved to Virus Vault";"Registry value";"2016/3/12, 13:34:12"

"";", HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES\\{B2FF04B1-282A-4396-A952-31494853874E}";"Deleted, Moved to Virus Vault";"Registry value";"2016/3/12, 13:34:12"

"";", HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES\\{EE16188A-63B7-4940-A090-B3ECF02D74F7}";"Deleted, Moved to Virus Vault";"Registry value";"2016/3/12, 13:34:12"

nick20010117

现在已经入库

尘梦幽然

nick20010117 发表于 2016-3-12 15:32
现在已经入库

趋势科技简中10
威胁名称:        BKDR_BLADABI.SMC
类型:        威胁
受感染文件:        C:\Users\simplr\Desktop\f.exe
处理措施:        已移除
检测方式:        实时扫描

nick20010117

尘梦幽然 发表于 2016-3-12 18:45
趋势科技简中10
威胁名称:        BKDR_BLADABI.SMC
类型:        威胁

报毒名是一样的

尘梦幽然

nick20010117 发表于 2016-3-12 18:52
报毒名是一样的

是的，趋势科技简中现在病毒码和国际同步速度还不错啊

nick20010117

尘梦幽然 发表于 2016-3-12 18:53
是的，趋势科技简中现在病毒码和国际同步速度还不错啊

不过我还是不敢用简中……
另外吐槽一下诺顿和趋势的IO写入，实在太大了

尘梦幽然

nick20010117 发表于 2016-3-12 18:55
不过我还是不敢用简中……
另外吐槽一下诺顿和趋势的IO写入，实在太大了

对比一下其他杀软对系统的影响看看

nick20010117

尘梦幽然 发表于 2016-3-12 18:57
对比一下其他杀软对系统的影响看看

这两个对比蜘蛛还是稍微好一点，不过比BG，FS等稍差一些

尘梦幽然

nick20010117 发表于 2016-3-12 18:58
这两个对比蜘蛛还是稍微好一点，不过比BG，FS等稍差一些

我对FS持保留态度，我认为它是牺牲了安全性的
BG就不了解了