[Ransom] 1c8HSPCFkEv.exe 09.19

zst470396853

191196846 发表于 2017-9-19 23:37
不愧是卡巴...

额  小BD也不错  

Jerry.Lin

zst470396853 发表于 2017-9-19 23:39
额  小BD也不错

是的呢

手动滑稽~

和泉纱雾

Symantec Norton

左手

[mw_shl_code=css,true]2017-9-20 00:08:53    修改注册表值 风险提示:敏感    阻止
进程: c:\documents and settings\administrator\桌面\1c8hspcfkev.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [应用程序]?:\*\*\*\* -> [注册表组]阻止_优先黑名单

2017-9-20 00:09:31    创建文件 风险提示:低风险    允许
进程: c:\documents and settings\administrator\桌面\1c8hspcfkev.exe
目标: C:\Documents and Settings\Administrator\Application Data\QuickMediaEditor\Application\1.0.0.2057\share\mlt\presets\consumer\avformat\dv_pal\config.evo
规则: [应用程序]?:\*\*\*\* -> [文件]c:\documents and settings\*\application data\*

2017-9-20 00:09:39    创建文件 风险提示:低风险    允许
进程: c:\documents and settings\administrator\桌面\1c8hspcfkev.exe
目标: C:\Documents and Settings\Administrator\Application Data\QuickMediaEditor\Application\1.0.0.2057\share\mlt\presets\consumer\avformat\dv_pal\iku.ynz
规则: [应用程序]?:\*\*\*\* -> [文件]c:\documents and settings\*\application data\*

2017-9-20 00:09:50    创建文件 风险提示:低风险    允许
进程: c:\documents and settings\administrator\桌面\1c8hspcfkev.exe
目标: C:\Documents and Settings\Administrator\Application Data\QuickMediaEditor\Application\1.0.0.2057\share\mlt\presets\consumer\avformat\dv_pal\f_000035.zyw
规则: [应用程序]?:\*\*\*\* -> [文件]c:\documents and settings\*\application data\*

2017-9-20 00:10:01    创建注册表项 风险提示:未知    阻止并结束进程
进程: c:\documents and settings\administrator\桌面\1c8hspcfkev.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Ligaos
规则: [注册表组]r111_低优先询问 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft
[/mw_shl_code]

wuming_bpnes

双击后大蜘蛛kill

和泉纱雾

XZ8SM7Sx0bVkoUV

火绒