目前認的不多,今天信箱裡收到的js裡下載下來的

Eset小粉絲

admin.vir
  [DETECTION] Is the TR/Crypt.Xpack.ygqm Trojan

Js miss

zq19861019

gdata js删除，admin.exe扫描miss,沙盘运行，gdata主防拦截
The following files were moved into quarantine:
F:\病毒样本\admin\admin.exe
c:\sandbox\琪\virus\user\current\appdata\local\temp\nsw7391.tmp\system.dll
c:\sandbox\琪\virus\user\current\appdata\roaming\11.svg
c:\sandbox\琪\virus\user\current\appdata\roaming\16.svg
c:\sandbox\琪\virus\user\current\appdata\roaming\20.svg
c:\sandbox\琪\virus\user\current\appdata\roaming\adobe-korea1-1
c:\sandbox\琪\virus\user\current\appdata\roaming\align.fo
c:\sandbox\琪\virus\user\current\appdata\roaming\b_it.jpg
c:\sandbox\琪\virus\user\current\appdata\roaming\badbits.mm
c:\sandbox\琪\virus\user\current\appdata\roaming\blue 072 bl 1.ado
c:\sandbox\琪\virus\user\current\appdata\roaming\brazzaville
c:\sandbox\琪\virus\user\current\appdata\roaming\chunk.first.sections.xml
c:\sandbox\琪\virus\user\current\appdata\roaming\chunker.output.media-type.xml
c:\sandbox\琪\virus\user\current\appdata\roaming\ddvclean.mof
c:\sandbox\琪\virus\user\current\appdata\roaming\dsc_drivers_tile.png
c:\sandbox\琪\virus\user\current\appdata\roaming\editedby.enabled.xml
c:\sandbox\琪\virus\user\current\appdata\roaming\entropy.mm
c:\sandbox\琪\virus\user\current\appdata\roaming\excel.csv
c:\sandbox\琪\virus\user\current\appdata\roaming\foot.js
c:\sandbox\琪\virus\user\current\appdata\roaming\fop.xsl
c:\sandbox\琪\virus\user\current\appdata\roaming\idiophone.xgr

The following registry entries were deleted:

\registry\user\sandbox_琪_virus\user\current_classes\local settings\software\microsoft\windows\shell\muicache\c:\windows\syswow64 || taskkill.exe.applicationcompany
\registry\user\sandbox_琪_virus\user\current_classes\local settings\software\microsoft\windows\shell\muicache\c:\windows\syswow64 || taskkill.exe.friendlyappname

YGLRrtKXsHKC63KC62Ji0HKScpJiYuByonKiYmJwKnTiKnTiKiYGt3LiKieuYmJwLCeucuIqJga5YtGukp3ALycoJygmBo9ykigniWJi8CknKCcoJganKCcnJycmBqcrGLw1ZisnGLw1ZisnJgbnKCf3CucqJycnJyYG9y8nJycnJga4LycqJyomBgA
Rules version: 5.0.114
OS: Windows 6.3 Service Pack 0.0 Build: 9600 - Workstation 64bit OS
dll version: 63077

"F:\病毒样本\admin\admin.exe"
MD5: AABA32AF46909324D0C86E8905D07DCC
"D:\Program Files (x86)\Sandboxie\SbieSvc.exe" Sandboxie_UacProxy:00000D78_00007FF6_18A08288_000000C8_
MD5:

900703

又是勒索軟件

lzy2010000

ESET能杀了

3801187

lyqzg

红伞已查杀

lyqzg

Eset小粉絲 发表于 2016-7-1 14:52
admin.vir
  [DETECTION] Is the TR/Crypt.Xpack.ygqm Trojan

红伞查杀，JS/Dldr.Locky.AO

Eset小粉絲

lyqzg 发表于 2016-7-3 20:16
红伞查杀，JS/Dldr.Locky.AO

嗯嗯 我上報了

Microsoftheihei

ma系已经入库