ransomware.aleta

bambooslip

，就一个. 发表于 2017-7-12 09:38
安天智甲 早上试了试 好傻

哪里傻

，就一个.

bambooslip 发表于 2017-7-12 15:01
哪里傻

双击失败好多次

bambooslip

，就一个. 发表于 2017-7-12 15:49
双击失败好多次

双击样本吗？

，就一个.

bambooslip 发表于 2017-7-12 20:31
双击样本吗？

嗯嗯那

saleniy35

NS Kill

bambooslip

，就一个. 发表于 2017-7-12 20:32
嗯嗯那

其中包含安天智甲主动防御系统中智能防范勒索者加密行为模块，以及连接安天公有云查杀病毒的扫描能力。

bambooslip

，就一个. 发表于 2017-7-12 15:49
双击失败好多次

我一般把安天智甲作为一款云杀毒引擎用。

，就一个.

AVA 25.13402
GD 25.10012

*** Process ***

Process: 6588
File name: nochanse@tuta.io.exe
Path: c:\users\administrator\desktop\nochanse@tuta.io.exe

Publisher: Unknown publisher
Creation date: 2017年7月11日 21:52:44
Modification date: 2017年7月7日 7:26:37

Started by: Explorer.EXE
Publisher: Microsoft Windows


*** Actions ***

The virus scanner has detected that the file is malicious.
The program is trying to create a startup item to launch a program automatically at system startup.
An executable file was stored in a suspicious location.
A suspicious location is referenced in startup.


*** Quarantine ***

The following files were moved into quarantine:
C:\Users\Administrator\AppData\Roaming\Info.hta
C:\Users\Administrator\AppData\Roaming\key.aleta
C:\Users\Administrator\Desktop\nochanse@tuta.io.exe

The following registry entries were deleted:

\registry\user\s-1-5-21-3791087008-2748381550-4144482455-500\software\microsoft\windows\currentversion\run || decryptinfo

YHJyCSwnJycnJgYtJygnKCYGLycoJygmBqdCJyh0gmJicCsnKCcoJgbocnJycmJikCsnDdlycvAoJyonKiYGdyonB4cqJygnKCYGhysnKCcoJgaHLCcnJycmBqcrGNY1ZisnGNY1ZisnJgbnKCeHcI9yonCfcoJygmJicK9ycnJyYmIAAA
Rules version: 5.0.148
OS: Windows 10.0 Service Pack 0.0 Build: 14393 - Workstation 64bit OS
dll version: 70613

"C:\Users\Administrator\Desktop\nochanse@tuta.io.exe"
MD5: 640F1FBE6A480FF41992C47FBDAD6849
C:\Windows\Explorer.EXE
MD5: 679D17F8CDB938C7100D7A647953677E

I76700K

管家Kill