Ransom.Locky

819340

微点双击拦截失败

819340

瑞星安全云终端 解压秒杀

Tom179090

文件名: e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
威胁名称: Ransom.Cerber完整路径: d:\样本2\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe

____________________________

____________________________


在电脑上 
2017/8/14 ( 21:15:43 )

上次使用时间 
2017/8/14 ( 21:17:44 )

启动项 
否

已启动 
否

威胁类型: 病毒。 将自身插入或附加到其他程序、文件或电脑区域以感染这些媒介的程序。

____________________________


e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe 威胁名称: Ransom.Cerber
定位


极少用户信任的文件
Norton 社区中有不到 5 名用户 使用了此文件。

极新的文件
该文件已在 不到 1 周 前发行。

高
此文件具有高风险。


____________________________


来源: 外部介质

源文件:
e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe

____________________________

文件操作

文件: d:\样本2\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230\ e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe 已删除
____________________________


文件指纹 - SHA:
e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230
文件指纹 - MD5:
af11efbb2db8bb18fdefb490565730dc

左手

2017-8-14 21:42:30    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: D:
规则: [文件组]《坚固》f111_隐藏磁盘 -> [文件]d:\*

2017-8-14 21:42:30    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: E:
规则: [文件组]《坚固》f111_隐藏磁盘 -> [文件]e:\*

2017-8-14 21:42:30    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: F:
规则: [文件组]《坚固》f111_隐藏磁盘 -> [文件]f:\*

2017-8-14 21:42:30    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: G:
规则: [文件组]《坚固》f111_隐藏磁盘 -> [文件]g:\*

2017-8-14 21:42:30    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: H:
规则: [文件组]《坚固》f111_隐藏磁盘 -> [文件]h:\*

2017-8-14 21:42:30    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: I:
规则: [文件组]《坚固》f111_隐藏磁盘 -> [文件]i:\*

2017-8-14 21:42:30    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: J:
规则: [文件组]《坚固》f111_隐藏磁盘 -> [文件]j:\*

2017-8-14 21:42:30    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: K:
规则: [文件组]《坚固》f111_隐藏磁盘 -> [文件]k:\*

2017-8-14 21:42:30    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: D:
规则: [文件组]《坚固》f111_隐藏磁盘 -> [文件]d:\*

2017-8-14 21:42:30    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: E:
规则: [文件组]《坚固》f111_隐藏磁盘 -> [文件]e:\*

2017-8-14 21:42:30    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: F:
规则: [文件组]《坚固》f111_隐藏磁盘 -> [文件]f:\*

2017-8-14 21:42:30    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: G:
规则: [文件组]《坚固》f111_隐藏磁盘 -> [文件]g:\*

2017-8-14 21:42:30    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: H:
规则: [文件组]《坚固》f111_隐藏磁盘 -> [文件]h:\*

2017-8-14 21:42:30    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: I:
规则: [文件组]《坚固》f111_隐藏磁盘 -> [文件]i:\*

2017-8-14 21:42:30    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: J:
规则: [文件组]《坚固》f111_隐藏磁盘 -> [文件]j:\*

2017-8-14 21:42:30    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: K:
规则: [文件组]《坚固》f111_隐藏磁盘 -> [文件]k:\*

2017-8-14 21:42:36    读文件夹 风险级别:低 (3)    允许
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\a
规则: [应用程序组]a022_《行为防御》_自动运行 -> [应用程序]c:\documents and settings\*\* -> [文件组]《终止》f022_高优先禁读 -> [文件]?:\; ?

2017-8-14 21:42:38    读文件夹 风险级别:低 (3)    允许
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\a\a
规则: [应用程序组]a022_《行为防御》_自动运行 -> [应用程序]c:\documents and settings\*\* -> [文件组]《终止》f022_高优先禁读 -> [文件]?:\?\*

2017-8-14 21:42:43    读文件夹 风险级别:低 (3)    允许
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\a\bak
规则: [应用程序组]a022_《行为防御》_自动运行 -> [应用程序]c:\documents and settings\*\* -> [文件组]《终止》f022_高优先禁读 -> [文件]?:\?\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\(原创)无测试模式无重启，有图有真相完美破解64位Sandboxie
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\201601
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\201602
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\201603
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\201604
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\201605
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\201606
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\201607
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\201608
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\201609
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\201610
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*


2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\cachm1001
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\dbank
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\FileRecv
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\fuli
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\josy
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\QQ
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\Resources
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\saiban
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\themes主题
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\virus
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\vivo Y13L
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\Walpaper
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\yfx
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\zd423
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*


2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\亲亲小五班
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*



2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\小瘦牛
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*


2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\微视频
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*


2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\沙盘和谐工具
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\电子书
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\百度文库下载器V2.3.4.1_1
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\美丽背影
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\自解压文件创建工具(Make SFX)5.5.49.159汉化版
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:47    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\Resourced\蓝色海底世界
规则: [应用程序]?:\*\*\*\* -> [文件组]《保护》f998_受保护的用户重要文件或目录 -> [文件]?:\documents and settings\*\桌面\resourced\*

2017-8-14 21:42:53    读文件夹 风险级别:低    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\VisTitle\preset\TemplateStyles
规则: [文件组]《终止》f009_病毒生成物2 -> [文件]*; *test*

2017-8-14 21:42:55    创建文件 风险级别:未知    阻止
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\VisTitle\diablo6-2a29.htm
规则: [文件]*; *.htm

2017-8-14 21:42:55    修改文件 风险级别:未知    阻止并结束进程
进程: c:\documents and settings\administrator\桌面\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe
目标: C:\Documents and Settings\Administrator\桌面\saiban\d547ce6c-89ad-4092-a1bf-dc064bc2d70a.DOC
规则: [应用程序]?:\*\*\*\* -> [文件]c:\documents and settings\*\桌面\*

greenfinger168

Norton 解压过程自动杀

greenfinger168

Comodo 扫描被过

双击验出，狙击成功

zst470396853

360 kill

cdyism

X-SEC KILL
[mw_shl_code=css,true]**********************X-Sec CommandLine Scanner File Scan*********************
Log: Enabled
Heuristic Engine: Enabled
Cloud Engine: Enabled
Resolve Threats: Ask user
Database Version: 2017.08.14.01
Scan Target: C:\Users\Downloads\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230
******************************X-Sec Antivirus Team****************************
[!]C:\Users\Downloads\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230\e53586aa3f3f3f7e46c4a65cda7ea66449b82691c32b166381b34c78ff21f230.exe -> Cloud:Trojan.Win32.Ransom
Scan finished!
Elapsed Time: 00:00:02[/mw_shl_code]

和泉纱雾

jordanbear

Heilig Defense RansomOff 5.2017.214.6672 (RC1)