从SysWOW64里抓出来一个未知程序

nick20010117

windows7爱好者 发表于 2016-7-15 11:10
DPD现在击杀出面次数很多的
最感动的是上次一个国产流氓，蜘蛛居然入库了....

主要是DPD这种检测机制的特别，导致测试他很困难，个人认为比较神秘
蜘蛛脱壳比较彻底了，DPD杀的几率应该不会很高

好想用EMSI

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 2016/7/15
Scan Time: 12:52
Logfile: 检测1.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.07.15.02
Rootkit Database: v2016.05.27.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Enabled

OS: Windows 10
CPU: x64
File System: NTFS
User: woshi

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 1
Time Elapsed: 0 min, 20 sec

Memory: Disabled
Startup: Disabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
Heuristics.Shuriken, C:\Users\woshi\Downloads\joflum.exe, Quarantined, [ffffffffffffffffffffffffffffffff],

Physical Sectors: 0
(No malicious items detected)


(end)
第一个的报告
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 2016/7/15
Scan Time: 12:54
Logfile: 检测2.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.07.15.02
Rootkit Database: v2016.05.27.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Enabled

OS: Windows 10
CPU: x64
File System: NTFS
User: woshi

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 1
Time Elapsed: 0 min, 22 sec

Memory: Disabled
Startup: Disabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
Trojan.AdLoad.CN, C:\Users\woshi\Downloads\gole.exe, Quarantined, [af9f71b3d3c71125f214369a18e9b64a],

Physical Sectors: 0
(No malicious items detected)


(end)
第二个的报告

as188672207

裸奔这么久，居然没发现我中了这么多毒

没想到除了gole.exe还有其他34个小伙伴在我电脑里玩耍
虽然不知道是谁打开了我的摄像头，但是全删了应该没问题了吧

ELOHIM

WD MISS ALL

mmppp9898

pal家族 发表于 2016-7-15 09:37
咦？楼主安装了什么杀软？我眼里不是很好。

也许我看花眼了~

mmppp9898

km2002 发表于 2016-7-15 10:15
楼主没装杀软吧  ·  第一排最后那个看不出是什么

人老了，眼花啦~

f59375443

as188672207 发表于 2016-7-15 02:26

安装了什么啊？

as188672207

f59375443 发表于 2016-7-15 18:14
安装了什么啊？

什么杀毒都没装啊  

Eset小粉絲

Flying_Bird 发表于 2016-7-15 11:34
gole.exe - Win32/Liuliangbao.A

这个是哪个杀软报的？

ELOHIM

裸奔大神，来来来，我们谈谈人生。

WD删掉了这个：joflum.exe