4.25 数字签名样本一枚

轩夏

微软

C:\Users\XuanXia\Desktop\virus\425.exe         Infected: DDoS:Win32/Nitol.B [submit_sample]

dongwenqi

wjy19800315 发表于 2016-4-25 11:51
诺顿解压工具用WINRAR下载智能分析才起作用的！
你换个解压工具再试试

难道诺顿针对winrar？晕死，卡巴斯基都可以检测所有的压缩工具

fuzhk

dongwenqi 发表于 2016-4-25 18:36
难道诺顿针对winrar？晕死，卡巴斯基都可以检测所有的压缩工具

没想到吧！？诺顿还真是这样。

dongwenqi

fuzhk 发表于 2016-4-25 19:00
没想到吧！？诺顿还真是这样。

晕死，好吧，感谢解答

aboringman

AVG：

扫描：killed；

"";"Trojan horse Agent5.PC, C:\Users\killer\Desktop\425.exe";"Unresolved"

双击：关闭监控，实机双击，先是防火墙阻止【真少见，只可惜手速太慢，没截到图。。。。。。】，然后IDP出手，击杀掉了它【又现Unknown报法】

"";"Unknown, C:\Users\killer\AppData\Local\Temp\SOFTWARE.LOG";"Deleted, Moved to Virus Vault";"File or Directory";"2016/4/25, 19:07:52"

"";", C:\USERS\KILLER\DESKTOP\425.EXE";"Object was blocked";"Process";"2016/4/25, 19:07:52"

"";", C:\Windows\System32\zuznqq.exe";"Object was blocked";"Process";"2016/4/25, 19:07:52"

"";", C:\Windows\System32\gei33.dll";"Deleted, Moved to Virus Vault";"File or Directory";"2016/4/25, 19:07:52"

"";", C:\Boot\lpk.dll";"Deleted, Moved to Virus Vault";"File or Directory";"2016/4/25, 19:07:52"

"";", C:\Program Files\alipay\aliedit\5.1.0.3754\lpk.dll";"Deleted, Moved to Virus Vault";"File or Directory";"2016/4/25, 19:07:52"

"";", C:\Windows\System32\zuznqq.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/4/25, 19:07:52"

"";", HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\SERVICES\ASPNET_SEEEES";"Deleted";"Registry key";"2016/4/25, 19:07:52"