本帖最后由 aboringman 于 2016-5-28 15:39 编辑
AVG：
扫描：miss；
双击：实机双击，IDP击杀本体及其下载的衍生物。【又现ALEXA】
"";"IDP.ALEXA.51, C:\Users\killer\Desktop\changes-8342-.js";"Deleted, Moved to Virus Vault";"File or Directory";"2016/5/28, 14:47:09"
"";", C:\Windows\System32\wscript.exe";"Object was blocked";"Process";"2016/5/28, 14:47:09"
"";", C:\Users\killer\AppData\Local\Temp\Fg2G1Cs3cs.exe";"Object was blocked";"Process";"2016/5/28, 14:47:09"
"";", C:\Users\killer\AppData\Local\Temp\Fg2G1Cs3cs.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/5/28, 14:47:09"
"";", C:\Windows\System32\wscript.exe";"Object was blocked";"Process";"2016/5/28, 14:47:09"
ESET：
扫描：killed（包括衍生物）；
Time：2016/5/28 15:22:16;
Scanner：Real-time file system protection;
Object Type：file;
Object：C:\Users\killer\AppData\Local\Temp\Fg2G1Cs3cs.exe;
Threat：a variant of Win32/Kryptik.EYLQ trojan;
Action：cleaned by deleting;
User：killer-PC\killer;
Information：Event occurred during an attempt to access the file by the application: C:\Windows\explorer.exe (89A175A12BC20104770D0EF83E553F8B0E06274B).;
Hash：4A525DDD2EADC1D4FC7CC57689DFBC04E65C8259
Time：2016/5/28 14:46:20;
Scanner：Real-time file system protection;
Object Type：file;
Object：C:\Users\killer\Desktop\changes-8342-.js;
Threat：JS/TrojanDownloader.Nemucod.ABZ trojan;
Action：cleaned by deleting;
User：killer-PC\killer;
Information：Event occurred during an attempt to access the file by the application: C:\Windows\explorer.exe (89A175A12BC20104770D0EF83E553F8B0E06274B).;
Hash：93686A520A170898A8576DEFCDBE641211CF0F59
双击：关闭监控，实机双击，这次Botnet Protection发挥了作用。
Time：2016/5/28 14:56:14;
Event：Suspected botnet detected;
Source：192.168.1.104:58553;
Target：107.181.187.12:80;
Protocol：TCP;
Rule/worm name：Win32/Filecoder.Locky;
Application：C:\Users\killer\AppData\Local\Temp\Fg2G1Cs3cs.exe;
User：killer-PC\killer
Time：2016/5/28 14:56:13;
Event：Suspected botnet detected;
Source：192.168.1.104:58552;
Target：212.109.219.31:80;
Protocol：TCP;
Rule/worm name：Win32/Filecoder.Locky;
Application：C:\Users\killer\AppData\Local\Temp\Fg2G1Cs3cs.exe;
User：killer-PC\killer
Time：2016/5/28 14:56:13;
Event：Suspected botnet detected;
Source：192.168.1.104:58550;
Target：5.152.199.70:80;
Protocol：TCP;
Rule/worm name：Win32/Filecoder.Locky;
Application：C:\Users\killer\AppData\Local\Temp\Fg2G1Cs3cs.exe;
User：killer-PC\killer
Time：2016/5/28 14:56:13;
Event：Suspected botnet detected;
Source：192.168.1.104:58549;
Target：193.9.28.13:80;
Protocol：TCP;
Rule/worm name：Win32/Filecoder.Locky;
Application：C:\Users\killer\AppData\Local\Temp\Fg2G1Cs3cs.exe;
User：killer-PC\killer
|
发表于 2016-5-28 13:17:05
下载勒索木马。。。
