system32下的可疑文件

ytysh

欧阳宣

avira

TR/Agent.1283584.8

浅暮、浅离

小蛛蛛KILL

，就一个.

AVA 25.13298
GD 25.9962

*** Process ***

Process: 5060
File name: wanset0.exe
Path: d:\360极速浏览器下载\7349\wanset0.exe

Publisher: Unknown publisher

Started by: Explorer.EXE
Publisher: Microsoft Windows


*** Actions ***

The program is trying to create a startup item to launch a program automatically at system startup.
The program has changed Internet Explorer settings that can be used to endanger the system.
An unknown process was accessed.
The program has created or manipulated an executable file.
The program can be used to execute any program code.
The program has started another program to delete itself.


*** Quarantine ***

The following files were moved into quarantine:
C:\Users\Administrator\AppData\Local\Temp\aut588B.tmp
C:\Users\Administrator\AppData\Local\Temp\aut5948.tmp
C:\Users\Administrator\Favorites\links\京东商城.url
C:\Users\Administrator\Favorites\links\导航大全.url
C:\Users\Administrator\Favorites\links\小游戏.url
C:\Users\Administrator\Favorites\links\百☆度.url
C:\Users\Administrator\Favorites\京东商城.url
C:\Users\Administrator\Favorites\导航大全.url
C:\Users\Administrator\Favorites\百☆度.url
C:\Users\Administrator\Favorites\链接\京东商城.url
C:\Users\Administrator\Favorites\链接\导航大全.url
C:\Users\Administrator\Favorites\链接\小游戏.url
C:\Users\Administrator\Favorites\链接\百☆度.url
C:\Windows\Temp\avkhttp_230849659_019e2731.tmp
D:\360极速浏览器下载\7349\wanset0.exe
c:\users\administrator\appdata\local\temp\fbinst.dll

The following registry entries were deleted:

\registry\user\s-1-5-21-1736763866-1601622952-3993810934-500\software\microsoft\windows\currentversion\run || ctfmon.exe

YGLR14IMLCcpJykmBi0nKicqJgYuJysnKScIp0InKHSCYmJwKycoJygmBuhygnKCYmKALycLuWLR14IJ2XKCkC4nLSYmJw3KcsJiYnLCwCYnJycnJgascqJyknJywC8nJycnJgZtcqJyomJi0CgnLCYmJwztcsJiYnLC8CgnKicqJgZ3KicJhysnKicqJgaXJicnJycmBpcnJycmJicHlygnJycnJgaXLycoJygmBqcrGZY1ZisrF+g1ZiwnGZY1ZisKtycnJycnJgbHLyeXYmJycgnXKScqJyomBucoJwhoKScNaC0nKCcoJgaoJicsJiYnDLgvJysnKScI6Conh4C+cnIoJiYnhwAA
Rules version: 5.0.147
OS: Windows 6.1 Service Pack 1.0 Build: 7601 - Workstation 64bit OS
dll version: 68091

"D:\360极速浏览器下载\7349\wanset0.exe"
MD5: 8E3CF00DFAE0F2D67110053DDC9C9502
C:\windows\Explorer.EXE
MD5: AC4C51EB24AA95B77F705AB159189E24

dcbacool

电脑管家成功清除（开启了BD引擎）

cz88

哦   会员网盘  

qftest

Anan20060615

cz88 发表于 2017-7-10 12:13
哦   会员网盘

会。。。会员网盘？