目测流氓软件下载器一枚……看看有几家报的？

学雷锋做人

当别人以自己使用的杀软回复时，而我是在用自己写的引擎回复

貌赛潘安

很不错

tun

[mw_shl_code=css,false]AVA 25.6449
GD 25.6806

*** Process ***

Process: 204
File name: fuladdala.exe
Path: c:\users\fyou\desktop\fuladdala.exe

Publisher: Unknown publisher
Creation date: 05/03/16 11:03:02
Modification date: 05/03/16 04:14:44

Started by: svchost.exe
Publisher: Microsoft Windows Publisher


*** Actions ***

The program has changed values in the system registry that can be used to endanger the system.
The program is trying to create a startup item to launch a program automatically at system startup.
The program establishes a network connection.
The program has added a new job to the task planner.
An unknown process was accessed.
The program has downloaded infected software.
The program has saved files in the system folder.
The program has created or manipulated an executable file.
The program can be used to execute any program code.
The program has created or manipulated an executable file in the system folder.


*** Quarantine ***

The following files were moved into quarantine:
C:\Users\fyou\Desktop\fuladdala.exe
c:\users\fyou\appdata\local\microsoft\windows\inetcache\ie\4ygszhk4\1332280[1].htm
c:\users\fyou\appdata\local\microsoft\windows\inetcache\ie\9axmieuc\7185bdf1gw1f05vls701mg21130hix6s[1].gif
c:\users\fyou\appdata\local\temp\1.jpg
c:\users\fyou\appdata\local\temp\12au21bac\bin\infobar\css\base.css
c:\users\fyou\appdata\local\temp\12au21bac\bin\infobar\image\icon.png
c:\users\fyou\appdata\local\temp\12au21bac\bin\infobar\image\infobar_close_active.png
c:\users\fyou\appdata\local\temp\12au21bac\bin\infobar\image\infobar_close_hover.png
c:\users\fyou\appdata\local\temp\12au21bac\bin\infobar\image\infobar_close_normal.png
c:\users\fyou\appdata\local\temp\12au21bac\bin\infobar\image\infobar_fav.png
c:\users\fyou\appdata\local\temp\12au21bac\bin\infobar\image\infobar_login.png
c:\users\fyou\appdata\local\temp\12au21bac\bin\infobar\image\infobar_offlineurl.png
c:\users\fyou\appdata\local\temp\12au21bac\bin\infobar\image\security.png
c:\users\fyou\appdata\local\temp\12au21bac\bin\infobar\inforbar.html
c:\users\fyou\appdata\local\temp\12au21bac\bin\infobar\js\base.js
c:\users\fyou\appdata\local\temp\12au21bac\bin\microsoft.vc90.crt\microsoft.vc90.crt.manifest
c:\users\fyou\appdata\local\temp\12au21bac\bin\navi.ico
c:\users\fyou\appdata\local\temp\12au21bac\bin\service\qqtrace.ini
c:\users\fyou\appdata\local\temp\12au21bac\bin\service\qqtrack.xml
c:\users\fyou\appdata\local\temp\12au21bac\config.xml
c:\users\fyou\appdata\local\temp\12au21bac\customerjoinplan.txt
c:\users\fyou\appdata\local\temp\12au21bac\license.txt
c:\users\fyou\appdata\local\temp\12au21bac\nsis_skin.gt
c:\users\fyou\appdata\local\temp\1332280.exe
c:\users\fyou\appdata\local\temp\21.tmp
c:\users\fyou\appdata\local\temp\nsj37e1.tmp\installhelper.dll
c:\users\fyou\appdata\local\temp\nsj37e1.tmp\microsoft.vc80.atl\atl80.dll
c:\users\fyou\appdata\local\temp\nsj37e1.tmp\microsoft.vc80.atl\microsoft.vc80.atl.manifest
c:\users\fyou\appdata\local\temp\nsj37e1.tmp\microsoft.vc80.crt\microsoft.vc80.crt.manifest
c:\users\fyou\appdata\local\temp\nsj37e1.tmp\microsoft.vc80.crt\msvcm80.dll
c:\users\fyou\appdata\local\temp\nsw45.tmp\inetload.dll
c:\users\fyou\appdata\local\temp\nsw45.tmp\system.dll
c:\users\fyou\appdata\local\temp\nsw45.tmp\zipdll.dll
c:\users\fyou\appdata\roaming\tencent\qqbrowser\clientupdate\cli570f.tmp
c:\users\fyou\appdata\roaming\tencent\qqbrowser\clientupdate\cli570f.tmp.qbl
c:\users\fyou\appdata\roaming\tencent\qqbrowser\clientupdate\cli58c5.tmp
c:\users\fyou\appdata\roaming\tencent\qqbrowser\clientupdate\cli58c5.tmp.qbl
c:\users\fyou\appdata\roaming\tencent\qqbrowser\clientupdate\cli5c12.tmp
c:\users\fyou\appdata\roaming\tencent\qqbrowser\clientupdate\cli5c12.tmp.qbl
c:\users\fyou\appdata\roaming\tencent\qqbrowser\clientupdate\cli6114.tmp
c:\users\fyou\appdata\roaming\tencent\qqbrowser\clientupdate\cli6114.tmp.qbl
c:\users\fyou\appdata\roaming\tencent\qqbrowser\clientupdate\cli6432.tmp
c:\users\fyou\appdata\roaming\tencent\qqbrowser\clientupdate\cli6432.tmp.qbl
c:\users\fyou\appdata\roaming\tencent\qqbrowser\clientupdate\cli6637.tmp
c:\users\fyou\appdata\roaming\tencent\qqbrowser\clientupdate\cli6637.tmp.qbl
c:\users\fyou\appdata\roaming\tencent\qqbrowser\clientupdate\update.ini
c:\users\fyou\appdata\roaming\tencent\qqbrowser\skin\001-cool air.gt
c:\users\fyou\appdata\roaming\tencent\qqbrowser\skin\lightstripes.gt
c:\windows\tasks\qqbrowser udpater task.job
c:\windows\temp\baidu\youqian\桌面百度\process.cfg
c:\windows\temp\baidu\youqian\桌面百度\桌面百度.ini

The following registry entries were deleted:

\registry\machine\software\classes\.webp || content type
\registry\machine\software\classes\.webp || perceivedtype
\registry\machine\software\classes\appid\webpdecodefilter.dll || appid
\registry\machine\software\classes\appid || a629f59c-66c9-4775-901a-a017530e3958
\registry\machine\software\classes\mime\database\content type\image/webp\bits || 0
\registry\machine\software\classes\mime\database\content type\image/webp || clsid
\registry\machine\software\classes\mime\database\content type\image/webp || extension
\registry\machine\software\classes\mime\database\content type\image/webp || image filter clsid
\registry\machine\software\classes || qqbrowser.file
\registry\machine\software\classes\qqbrowser.file || appusermodelid
\registry\machine\software\classes\qqbrowser.file || defaulticon
\registry\machine\software\classes\qqbrowser.file || shell
\registry\machine\software\classes\qqbrowser.file\shell\open || command
\registry\machine\software\classes\qqbrowser.file || url protocol
\registry\machine\software\classes || qqbrowser.protocol
\registry\machine\software\classes\qqbrowser.protocol || appusermodelid
\registry\machine\software\classes\qqbrowser.protocol || defaulticon
\registry\machine\software\classes\qqbrowser.protocol || shell
\registry\machine\software\classes\qqbrowser.protocol\shell\open || command
\registry\machine\software\classes\qqbrowser.protocol || url protocol
\registry\machine\software\classes || webpfilter.cowebpfilter
\registry\machine\software\classes || webpfilter.cowebpfilter.1
\registry\machine\software\classes\webpfilter.cowebpfilter.1 || clsid
\registry\machine\software\classes\webpfilter.cowebpfilter || clsid
\registry\machine\software\classes\webpfilter.cowebpfilter || curver
\registry\machine\software\classes\wow6432node\clsid || a981255c-6123-4487-b21a-9cf468eb3fc7
\registry\machine\software\classes\wow6432node\clsid\a981255c-6123-4487-b21a-9cf468eb3fc7 || appid
\registry\machine\software\classes\wow6432node\clsid\a981255c-6123-4487-b21a-9cf468eb3fc7 || inprocserver32
\registry\machine\software\classes\wow6432node\clsid\a981255c-6123-4487-b21a-9cf468eb3fc7\inprocserver32 || threadingmodel
\registry\machine\software\classes\wow6432node\clsid\a981255c-6123-4487-b21a-9cf468eb3fc7 || progid
\registry\machine\software\classes\wow6432node\clsid\a981255c-6123-4487-b21a-9cf468eb3fc7 || typelib
\registry\machine\software\classes\wow6432node\clsid\a981255c-6123-4487-b21a-9cf468eb3fc7 || versionindependentprogid
\registry\machine\software\registeredapplications || qqbrowser
\registry\machine\software\wow6432node\microsoft\windows\currentversion\uninstall\qqbrowser || publisher
\registry\machine\software\wow6432node\tencent\qqbrowser\capabilities || applicationdescription
\registry\machine\software\wow6432node\tencent\qqbrowser\capabilities\fileassociations || .html
\registry\machine\system\controlset001\control\wmi\security || 5abb9909-bb1c-4766-94a2-dc34220d0391
\registry\machine\system\controlset001\control\wmi\security || a083b31f-8832-4593-97ce-95c482533167
\registry\machine\system\controlset001\control\wmi\security || fe298bd4-04d8-4bf8-9422-77d6b66b255f
\registry\machine\system\controlset001\services\eventlog\application\perftraceservice || typessupported
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\common || mainpagediy_
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\extensions8\309147a1-5ca9-4082-bab3-bf9020cde0c2\8.0.0.25\contentscripts\documentidle_0 || js
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\extensions8\309147a1-5ca9-4082-bab3-bf9020cde0c2\8.0.0.25 || desc
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\extensions8\309147a1-5ca9-4082-bab3-bf9020cde0c2\8.0.0.25 || homeurl
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\extensions8\309147a1-5ca9-4082-bab3-bf9020cde0c2\8.0.0.25 || manifestversion
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\extensions8\309147a1-5ca9-4082-bab3-bf9020cde0c2\8.0.0.25 || name
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\extensions8\309147a1-5ca9-4082-bab3-bf9020cde0c2\8.0.0.25 || operational
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\extensions8\309147a1-5ca9-4082-bab3-bf9020cde0c2\8.0.0.25 || requiredminversion
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\extensions8\309147a1-5ca9-4082-bab3-bf9020cde0c2\8.0.0.25\signaturelist || background.js
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\extensions8\309147a1-5ca9-4082-bab3-bf9020cde0c2\8.0.0.25\signaturelist || content.js
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\extensions8\309147a1-5ca9-4082-bab3-bf9020cde0c2\8.0.0.25\signaturelist\js || inforbar.js
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\extensions8\309147a1-5ca9-4082-bab3-bf9020cde0c2\8.0.0.25 || style
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\extensions8\309147a1-5ca9-4082-bab3-bf9020cde0c2\8.0.0.25 || version
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\extensions8\309147a1-5ca9-4082-bab3-bf9020cde0c2 || currentversion
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser || homepagecfg
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\installinfo || defaultbrower
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\installinfo || defaultbrowserfirstrun
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\installinfo || firstlaunch
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\installinfo || installmodeforextension
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\launch || launchopenpagetype
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\launch || mainpagetype
\registry\user\s-1-5-21-3581345298-2740131099-2291164873-1001\software\tencent\qqbrowser\privatecfg || tc_cft_bits3

YGLhLcwPLCfHLCcnJ8cLLSd9KyeXctKG4HKyqnKiKCdrCGdycnJyYmJwKnRyQicnJga3cnJycmJikCgnKSYmJwm5YuEt/AvJcpKQLScH6XJyn2JicnKfoCYnKCYmJwjKcqIsJiYnyqAtJ5dysnLisC0nt3LCcvKwLicnJiYnB6xygmJicoLALScnJycmBuxy0mJictLALyd+cvJy0ghtcnKIcvJycpfQKCfKYmJyogzdcnK3YmJycrfQLicnJiYnB95igXLwKCcnJiYnB/9ykmJicpJw1nJyKScrJw53KicJhysnaSknl3KCb3DYcoJycnJycPlyci4nKCfHcLqSsVxjtnIuHFxjtnKSsVxjtnINpy0nKiYmJwqnLyf5YmJykg+3KCcoJiYnCLcqJwq3LSdncnJy8nDMcnKfYmJycp9w7HKyJyYmJ3tw/HKyLyYmJ/twnXKC73LycoL+cG5ycp1wjnKCDOctJycmJicH9ykn+ScmJif5B/cvJ5hycnKCCGgpJ2sIaCsnLCYmJwyIJicoJygmBrgvJ7dygnJyCQA
Rules version: 5.0.87
OS: Windows 6.3 Service Pack 0.0 Build: 9600 - Workstation 64bit OS
dll version: 59958

"C:\Users\fyou\Desktop\fuladdala.exe"
MD5: 92A42D35F7E127E13D0E7D3CF18993D5

MD5:
[/mw_shl_code]

vm001

pal家族 发表于 2016-5-3 13:56
????

这种截图真清楚。。。怎么设置可以让截图这么清楚

pal家族

vm001 发表于 2016-5-3 21:27
这种截图真清楚。。。怎么设置可以让截图这么清楚

qq自带截图
ctrl+alt+A

落霞岛稻草人

刚下载完火绒就报了

windows7爱好者

安装了QQ浏览器

欧阳宣

Artemis!92A42D35F7E1