dalicjlbcad.exe

Ｍy↘じ★ve

从http://bbs.kafan.cn/thread-2048689-1-1.html中提取的。

应该也是推广程序。

2941057373

管家拦截

蓝天二号

不就是我发出来的那个链接嘛。。。

诸葛亮

红伞misss.

km2002

我晕  这不刚才那个么  刚更新完毒库 卡巴还是miss

mmppp9898

同一个流氓软件，有必要单独开个帖子讨论么？相关内容详见7-16的二楼

km2002

费尔扫描miss 双击X

zq19861019

运行后，下载拦截病毒，主防回滚删除AVA 25.7422
GD 25.7286

*** Process ***

Process: 17400
File name: dalicjlbcad.exe
Path: f:\病毒样本\dalicjlbcad\dalicjlbcad.exe

Publisher: Unknown publisher
Creation date: 07/17/16 15:32:55
Modification date: 07/16/16 04:23:23

Started by: SbieSvc.exe
Publisher: Invincea, Inc.


*** Actions ***

A packer was run on the program file, possibly to conceal malicious content.
The program establishes a network connection.
The program has downloaded infected software.
The program has created or manipulated an executable file.


*** Quarantine ***

The following files were moved into quarantine:
F:\病毒样本\dalicjlbcad\dalicjlbcad.exe
c:\sandbox\琪\virus\user\current\appdata\local\microsoft\windows\inetcache\counters.dat
c:\sandbox\琪\virus\user\current\appdata\local\microsoft\windows\inetcache\ie\anu93dhm\rav3490001[1].htm
c:\sandbox\琪\virus\user\current\appdata\local\temp\nsq45fe.tmp\1.ico
c:\sandbox\琪\virus\user\current\appdata\local\temp\nsq45fe.tmp\system.dll

The following registry entries were deleted:

\registry\user\sandbox_琪_virus\user\current\software\microsoft\windows\currentversion\internet settings\connections || savedlegacysettings
\registry\user\sandbox_琪_virus\user\current\software\microsoft\windows\currentversion\internet settings || proxyserver

YGLRrIIKLCcoJygmBi0nKCcoJgYuJycnJyYGp0InKnSiYmJwKycqJyomBsdyonKiYmKALycLuWLRrMKgLScnJycmBtxycnJyYmLALycoJygmBo9ycnJyYmJwp3JycNhycnJyYmJw2XJycnJiYnC68tE1ZisnH11jtnJiYnDbcnJycmJicI5yggAA
Rules version: 5.0.117
OS: Windows 6.3 Service Pack 0.0 Build: 9600 - Workstation 64bit OS
dll version: 63077

"F:\病毒样本\dalicjlbcad\dalicjlbcad.exe"
MD5: C633D0E4042DF8CF485ED2C8C50421F9
"D:\Program Files (x86)\Sandboxie\SbieSvc.exe" Sandboxie_UacProxy:00002F54_00007FF7_E1AF1708_00000104_
MD5:

轩夏

MSE MISS