12
返回列表 发新帖
楼主: ak666
收起左侧

[可疑文件] VT检测率 1/67,有没有大佬来个行为分析

[复制链接]
景圣临
发表于 2017-11-5 12:45:28 | 显示全部楼层
TU.exe是Total Uninstall...

LZ的版本哪下的?
KevinYu0504
发表于 2017-11-5 17:29:14 | 显示全部楼层
ak666
 楼主| 发表于 2017-11-5 18:14:58 | 显示全部楼层
本帖最后由 ak666 于 2017-11-5 18:21 编辑
KevinYu0504 发表于 2017-11-5 17:29
会不会是误报 ?

VT 刚刚我按下重新扫描,

之前有个叫什么eGambit什么的报毒,就他一个。现在看来是没问题了,用破解软件,心里总是不踏实。。
用ssf,总是监控到要键盘记录。。===============================
  1. Filename: Tu.exe
  2. Threat name: SONAR.AM.C!g3Full Path: c:\program files\total uninstall 6\tu.exe

  3. ____________________________

  4. ____________________________


  5. On computers as of
  6. 2017/11/5 at 18:16:52

  7. Last Used
  8. 2017/11/5 at 18:16:52

  9. Startup Item
  10. No

  11. Launched
  12. Yes

  13. SONAR Protection monitors for suspicious program activity on your computer.


  14. ____________________________


  15. Tu.exe Threat name: SONAR.AM.C!g3
  16. Locate


  17. Few Users
  18. Fewer than 100 users in the Norton Community have used this file.

  19. New
  20. This file was released 14 days ago.

  21. High
  22. This file risk is high.


  23. ____________________________


  24. Source: External Media

  25. Source File:
  26. tu.exe

  27. ____________________________

  28. System Settings Actions

  29. Event: Process start (Performed by c:\program files\total uninstall 6\tu.exe, PID:1772) No fix attempted
  30. Event: Process start: c:\program files\total uninstall 6\ Tu.exe, PID:1772 (Performed by c:\program files\total uninstall 6\tu.exe, PID:1772) No fix attempted
  31. Event: Process start (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
  32. \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG:mcsmetwu (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
  33. \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG:tupnhdxm (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
  34. c:\programdata\Martau\total uninstall 6\ monitored programs.folders (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
  35. Event: Process start: c:\Windows\System32\windowspowershell\v1.0\ powershell.exe, PID:3372 (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
  36. c:\users\27526\appdata\local\temp\ __psscriptpolicytest_4lrvd2lt.n23.ps1 (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
  37. c:\users\27526\appdata\local\temp\ __psscriptpolicytest_coh1njsr.rha.psm1 (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
  38. c:\users\27526\appdata\local\temp\ tul8a31.tmp (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
  39. c:\Users\27526\AppData\Local\microsoft\Windows\powershell\ startupprofiledata-noninteractive (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
  40. Event: Process start: c:\Windows\System32\windowspowershell\v1.0\ powershell.exe, PID:9828 (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
  41. c:\programdata\Martau\total uninstall 6\ installed programs2.cache (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
  42. c:\users\27526\appdata\local\temp\ __psscriptpolicytest_gdlvx3ut.x1m.ps1 (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
  43. c:\users\27526\appdata\local\temp\ __psscriptpolicytest_caotiay1.x3r.psm1 (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
  44. Event: Process start: c:\program files (x86)\Tencent\QQPinyin\5.6.4107.400\ qqpyservice.exe, PID:9800 (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
  45. c:\programdata\Martau\total uninstall 6\ installed programs3.cache (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
  46. c:\programdata\Martau\total uninstall 6\ installed programs.folders (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
  47. ____________________________


  48. File Thumbprint - SHA:
  49. 44ba84d6193b2b15c18146af05da336049e883f413df313fc2b7570d77f3353d
  50. File Thumbprint - MD5:
  51. Not available
复制代码

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
ak666
 楼主| 发表于 2017-11-5 18:23:08 | 显示全部楼层
景圣临 发表于 2017-11-5 12:45
TU.exe是Total Uninstall...

LZ的版本哪下的?

叫什么海心的下载站
歌德塔大蜘蛛
发表于 2017-11-5 18:54:35 | 显示全部楼层
ak666 发表于 2017-11-5 18:23
叫什么海心的下载站

心海,烈火的网站。我的winrar就是用的他的版本
ak666
 楼主| 发表于 2017-11-5 19:00:38 | 显示全部楼层
歌德塔大蜘蛛 发表于 2017-11-5 18:54
心海,烈火的网站。我的winrar就是用的他的版本

那看来稳了。。果断加了sonar信任
景圣临
发表于 2017-11-6 00:00:16 | 显示全部楼层
我知道的TU可信的破解只有一个,是国外remek002大神做的

你的是谁破解的?
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-3-29 21:41 , Processed in 0.108215 second(s), 14 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表