流氓下载器

显示全部楼层 · 发表于 2016-11-13 20:31:23

本帖最后由 fireherman 于 2016-11-13 20:33 编辑

ESET HIPS/FireWall Test:

HIPS [阻止] [修改注册表]/[加驱]

[mw_shl_code=css,true]2016-11-13 20:23:34       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\kuwo_jm634.exe       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file,Get exclusive access to file
2016-11-13 20:23:32       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp\System.dll       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:23:32       E:\VirZ\naputelajfdlaggjh.exe       Start new application       E:\Temp\WinXP_TMP\5590a2a9_1202000632.exe       blocked       [103][H]ESET-NOD32 HIPS Test[AD]
2016-11-13 20:20:20       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\5590a2a9_1202000632.exe       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file,Get exclusive access to file
2016-11-13 20:20:19       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp\System.dll       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:18:57       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\Browser_V5.6.12860.10_r_4396_(Build1605251856).exe       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file,Get exclusive access to file
2016-11-13 20:18:55       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp\System.dll       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:18:46       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\rav3490022.exe       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file,Get exclusive access to file
2016-11-13 20:18:46       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp\System.dll       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:18:46       E:\VirZ\naputelajfdlaggjh.exe       Start new application       E:\Temp\WinXP_TMP\Baidu_Setup_3.0.200.2787_ftn_1050123723.exe       blocked       [103][H]ESET-NOD32 HIPS Test[AD]
2016-11-13 20:16:36       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\Baidu_Setup_3.0.200.2787_ftn_1050123723.exe       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file,Get exclusive access to file
2016-11-13 20:16:34       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp\System.dll       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:16:34       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp\System.dll       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:16:34       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp\System.dll       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:16:34       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp\System.dll       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:16:34       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp\System.dll       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:16:34       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\1.zip       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Delete file
2016-11-13 20:16:34       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\1.zip       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:16:34       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nsvD.tmp       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:16:34       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nsvD.tmp       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file,Get exclusive access to file
2016-11-13 20:16:34       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\1.zip       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file,Get exclusive access to file
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Delete from registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Delete from registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Delete from registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Delete from registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Delete from registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Delete from registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp\System.dll       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp\System.dll       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp\System.dll       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:15:54       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp\System.dll       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:15:53       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp\System.dll       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:15:53       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\1.ico       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:15:53       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp\System.dll       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file
2016-11-13 20:15:53       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Delete file
2016-11-13 20:15:53       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nstC.tmp       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file,Get exclusive access to file
2016-11-13 20:15:53       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nsrB.tmp       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Delete file,Write to file,Get exclusive access to file
2016-11-13 20:15:53       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nsrB.tmp       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file,Get exclusive access to file
2016-11-13 20:15:53       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nshA.tmp       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Delete file
2016-11-13 20:15:53       E:\VirZ\naputelajfdlaggjh.exe       Get access to file       E:\Temp\WINXP_~1\nshA.tmp       some access allowed       [100][O]ESET-NOD32 HIPS Test[FD:Del/Write]       Write to file,Get exclusive access to file
2016-11-13 20:15:53       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f274fa40-775a-11e6-be8c-806d6172696f}\BaseClass       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:53       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f274fa43-775a-11e6-be8c-806d6172696f}\BaseClass       blocked       [101][X]ESET-NOD32 HIPS Test[RD]
2016-11-13 20:15:53       E:\VirZ\naputelajfdlaggjh.exe       Modify registry       HKEY_USERS\S-1-5-21-2052111302-2111687655-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f274fa42-775a-11e6-be8c-806d6172696f}\BaseClass       blocked       [101][X]ESET-NOD32 HIPS Test[RD]       [/mw_shl_code]

防火墙记录 [放行]：如果防火墙选择[拒绝联网]是最好的

[mw_shl_code=css,true]2016-11-13 20:25:45       Communication allowed by rule       0.0.0.0:1319       101.227.199.28:80       TCP       [A][O][TCP]naputelajfdlaggjh.exe[G]       E:\VirZ\naputelajfdlaggjh.exe       RAYMOND-9B1A7AC\Raymond
2016-11-13 20:25:45       Communication allowed by rule       0.0.0.0:1317       221.231.6.186:57181       TCP       [A][O][TCP]naputelajfdlaggjh.exe[G]       E:\VirZ\naputelajfdlaggjh.exe       RAYMOND-9B1A7AC\Raymond
2016-11-13 20:25:44       Communication allowed by rule       0.0.0.0:1315       221.231.6.186:22       TCP       [A][O][TCP]naputelajfdlaggjh.exe[G]       E:\VirZ\naputelajfdlaggjh.exe       RAYMOND-9B1A7AC\Raymond
2016-11-13 20:25:43       Communication allowed by rule       0.0.0.0:1313       221.231.6.186:57180       TCP       [A][O][TCP]naputelajfdlaggjh.exe[G]       E:\VirZ\naputelajfdlaggjh.exe       RAYMOND-9B1A7AC\Raymond
2016-11-13 20:25:43       Communication allowed by rule       0.0.0.0:1311       221.231.6.186:22       TCP       [A][O][TCP]naputelajfdlaggjh.exe[G]       E:\VirZ\naputelajfdlaggjh.exe       RAYMOND-9B1A7AC\Raymond
2016-11-13 20:24:28       Communication allowed by rule       0.0.0.0:1306       113.105.141.142:80       TCP       [A][O][TCP]naputelajfdlaggjh.exe[G]       E:\VirZ\naputelajfdlaggjh.exe       RAYMOND-9B1A7AC\Raymond
2016-11-13 20:24:04       Communication allowed by rule       0.0.0.0:1301       183.61.180.229:80       TCP       [A][O][TCP]naputelajfdlaggjh.exe[G]       E:\VirZ\naputelajfdlaggjh.exe       RAYMOND-9B1A7AC\Raymond
2016-11-13 20:23:33       Communication allowed by rule       0.0.0.0:1256       123.129.249.142:80       TCP       [A][O][TCP]naputelajfdlaggjh.exe[G]       E:\VirZ\naputelajfdlaggjh.exe       RAYMOND-9B1A7AC\Raymond
2016-11-13 20:20:20       Communication allowed by rule       0.0.0.0:1251       119.188.97.182:80       TCP       [A][O][TCP]naputelajfdlaggjh.exe[G]       E:\VirZ\naputelajfdlaggjh.exe       RAYMOND-9B1A7AC\Raymond
2016-11-13 20:20:20       Communication allowed by rule       0.0.0.0:1248       180.149.131.240:80       TCP       [A][O][TCP]naputelajfdlaggjh.exe[G]       E:\VirZ\naputelajfdlaggjh.exe       RAYMOND-9B1A7AC\Raymond
2016-11-13 20:18:57       Communication allowed by rule       0.0.0.0:1243       119.188.99.254:80       TCP       [A][O][TCP]naputelajfdlaggjh.exe[G]       E:\VirZ\naputelajfdlaggjh.exe       RAYMOND-9B1A7AC\Raymond
2016-11-13 20:18:56       Communication allowed by rule       0.0.0.0:1241       111.161.46.88:80       TCP       [A][O][TCP]naputelajfdlaggjh.exe[G]       E:\VirZ\naputelajfdlaggjh.exe       RAYMOND-9B1A7AC\Raymond
2016-11-13 20:18:46       Communication allowed by rule       0.0.0.0:1238       219.238.237.210:13015       TCP       [A][O][TCP]naputelajfdlaggjh.exe[G]       E:\VirZ\naputelajfdlaggjh.exe       RAYMOND-9B1A7AC\Raymond
2016-11-13 20:18:46       Communication allowed by rule       0.0.0.0:1236       219.238.237.210:21       TCP       [A][O][TCP]naputelajfdlaggjh.exe[G]       E:\VirZ\naputelajfdlaggjh.exe       RAYMOND-9B1A7AC\Raymond
2016-11-13 20:16:35       Communication allowed by rule       0.0.0.0:1224       119.188.97.182:80       TCP       [A][O][TCP]naputelajfdlaggjh.exe[G]       E:\VirZ\naputelajfdlaggjh.exe       RAYMOND-9B1A7AC\Raymond
2016-11-13 20:16:33       Communication allowed by rule       0.0.0.0:1220       119.188.36.24:80       TCP       [A][O][TCP]naputelajfdlaggjh.exe[G]       E:\VirZ\naputelajfdlaggjh.exe       RAYMOND-9B1A7AC\Raymond[/mw_shl_code]

ESET kill [PUA]

下载回来的垃圾真TM多

[mw_shl_code=css,true]2016-11-13 20:20:19       Real-time file system protection       file       C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\ZDELHFRR\Browser_V5.7.16400.12_r_4396_(Build1611091214)[1].exe       a variant of Win32/Taobao.B potentially unwanted application       deleted (after the next restart)       RAYMOND-9B1A7AC\Raymond       Event occurred on a new file created by the application: E:\VirZ\naputelajfdlaggjh.exe (28001B730338867486C4C05D05CE4E314E110389).       2BF1505E055FAABCA1AC013447B355559D879791       2016-11-13 20:18:57
2016-11-13 20:20:19       Real-time file system protection       file       E:\Temp\WINXP_~1\Browser_V5.6.12860.10_r_4396_(Build1605251856).exe       a variant of Win32/Taobao.B potentially unwanted application       deleted       RAYMOND-9B1A7AC\Raymond       Event occurred on a new file created by the application: E:\VirZ\naputelajfdlaggjh.exe (28001B730338867486C4C05D05CE4E314E110389).       2BF1505E055FAABCA1AC013447B355559D879791       2016-11-13 20:18:57
2016-11-13 20:20:12       HTTP filter       file       http://umcdn.uc.cn/down/4396/Browser_V5.7.16400.12_r_4396_(Build1611091214).exe       a variant of Win32/Taobao.B potentially unwanted application       connection terminated       RAYMOND-9B1A7AC\Raymond       Threat was detected upon access to web by the application: E:\VirZ\naputelajfdlaggjh.exe (28001B730338867486C4C05D05CE4E314E110389).       7867A08AFA2C966D5E6780E600628056E9923157       2016-11-13 20:18:57
2016-11-13 20:18:55       Real-time file system protection       file       E:\Temp\WINXP_~1\rav3490022.exe       a variant of Win32/Rising.E potentially unwanted application       deleted       RAYMOND-9B1A7AC\Raymond       Event occurred on a new file created by the application: E:\VirZ\naputelajfdlaggjh.exe (28001B730338867486C4C05D05CE4E314E110389).       020A2108899F8F5C3E278EA2043E359F680AF8D0       2016-11-13 20:18:46
2016-11-13 20:18:52       Real-time file system protection       file       C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\U6AU8YR0\rav3490022[1].exe       a variant of Win32/Rising.E potentially unwanted application       deleted (after the next restart)       RAYMOND-9B1A7AC\Raymond       Event occurred on a new file created by the application: E:\VirZ\naputelajfdlaggjh.exe (28001B730338867486C4C05D05CE4E314E110389).       020A2108899F8F5C3E278EA2043E359F680AF8D0       2016-11-13 20:18:46
2016-11-13 20:18:21       HTTP filter       file       http://scloud-dlsw.br.baidu.com/ ... _ftn_1050123723.exe       Win32/Baidu.M potentially unwanted application       connection terminated       RAYMOND-9B1A7AC\Raymond       Threat was detected upon access to web by the application: E:\VirZ\naputelajfdlaggjh.exe.       [/mw_shl_code]

显示全部楼层 · 发表于 2016-11-13 22:08:02

红伞扫描miss

显示全部楼层 · 发表于 2016-11-13 22:42:49

Gdata miss

显示全部楼层 · 发表于 2016-11-13 23:06:00

有人上报给Bitdefender了，当前最新病毒库已收。

显示全部楼层 · 发表于 2016-11-13 23:43:12

卡巴云拉黑

显示全部楼层 · 发表于 2016-11-14 09:27:12

linzh 发表于 2016-11-13 23:43
卡巴云拉黑

卡巴
naputelajfdlaggjh.exe
UDS:DangerousObject.Multi.Generic

显示全部楼层 · 发表于 2016-11-14 15:36:52

fireherman 发表于 2016-11-13 20:06
ESET-NOD32 ess 8 [v14435/20161113]

依然 miss 已上报

14439还是不能查杀啊

显示全部楼层 · 发表于 2016-11-14 17:24:04

jayavira 发表于 2016-11-14 15:36
14439还是不能查杀啊

哪有这么快。

起码要14441或者14442才入库吧（按最快24小时入库，每2小时更新一次算）

显示全部楼层 · 发表于 2016-11-14 17:28:43

fireherman 发表于 2016-11-14 17:24
哪有这么快。

起码要14441或者14442才入库吧（按最快24小时入库，每2小时更新一次算）

明天我再来看看能不能杀吧

显示全部楼层 · 发表于 2016-11-14 17:31:39

本帖最后由 fireherman 于 2016-11-14 17:32 编辑

jayavira 发表于 2016-11-14 17:28
明天我再来看看能不能杀吧

可以试试这个：http://bbs.kafan.cn/thread-2064222-1-1.html

图标都还没改（似乎是同一个？）

--------------------

靠，那个也没入库。

[病毒样本] 流氓下载器

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源