VT检测率 1/67，有没有大佬来个行为分析

景圣临

TU.exe是Total Uninstall...

LZ的版本哪下的？

KevinYu0504

会不会是误报 ?

VT 刚刚我按下重新扫描，
目前全都是零检出了 ~

https://virustotalcloud.appspot.com/nui/index.html#/file/44ba84d6193b2b15c18146af05da336049e883f413df313fc2b7570d77f3353d/detection

ak666

KevinYu0504 发表于 2017-11-5 17:29
会不会是误报 ?

VT 刚刚我按下重新扫描，

之前有个叫什么eGambit什么的报毒，就他一个。现在看来是没问题了，用破解软件，心里总是不踏实。。
用ssf，总是监控到要键盘记录。。===============================

1. Filename: Tu.exe
   
2. Threat name: SONAR.AM.C!g3Full Path: c:\program files\total uninstall 6\tu.exe
   
3. 
   
4. ____________________________
   
5. 
   
6. ____________________________
   
7. 
   
8. 
   
9. On computers as of
   
10. 2017/11/5 at 18:16:52
    
11. 
    
12. Last Used
    
13. 2017/11/5 at 18:16:52
    
14. 
    
15. Startup Item
    
16. No
    
17. 
    
18. Launched
    
19. Yes
    
20. 
    
21. SONAR Protection monitors for suspicious program activity on your computer.
    
22. 
    
23. 
    
24. ____________________________
    
25. 
    
26. 
    
27. Tu.exe Threat name: SONAR.AM.C!g3
    
28. Locate
    
29. 
    
30. 
    
31. Few Users
    
32. Fewer than 100 users in the Norton Community have used this file.
    
33. 
    
34. New
    
35. This file was released 14 days ago.
    
36. 
    
37. High
    
38. This file risk is high.
    
39. 
    
40. 
    
41. ____________________________
    
42. 
    
43. 
    
44. Source: External Media
    
45. 
    
46. Source File:
    
47. tu.exe
    
48. 
    
49. ____________________________
    
50. 
    
51. System Settings Actions
    
52. 
    
53. Event: Process start (Performed by c:\program files\total uninstall 6\tu.exe, PID:1772) No fix attempted
    
54. Event: Process start: c:\program files\total uninstall 6\ Tu.exe, PID:1772 (Performed by c:\program files\total uninstall 6\tu.exe, PID:1772) No fix attempted
    
55. Event: Process start (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
    
56. \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG:mcsmetwu (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
    
57. \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG:tupnhdxm (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
    
58. c:\programdata\Martau\total uninstall 6\ monitored programs.folders (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
    
59. Event: Process start: c:\Windows\System32\windowspowershell\v1.0\ powershell.exe, PID:3372 (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
    
60. c:\users\27526\appdata\local\temp\ __psscriptpolicytest_4lrvd2lt.n23.ps1 (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
    
61. c:\users\27526\appdata\local\temp\ __psscriptpolicytest_coh1njsr.rha.psm1 (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
    
62. c:\users\27526\appdata\local\temp\ tul8a31.tmp (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
    
63. c:\Users\27526\AppData\Local\microsoft\Windows\powershell\ startupprofiledata-noninteractive (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
    
64. Event: Process start: c:\Windows\System32\windowspowershell\v1.0\ powershell.exe, PID:9828 (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
    
65. c:\programdata\Martau\total uninstall 6\ installed programs2.cache (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
    
66. c:\users\27526\appdata\local\temp\ __psscriptpolicytest_gdlvx3ut.x1m.ps1 (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
    
67. c:\users\27526\appdata\local\temp\ __psscriptpolicytest_caotiay1.x3r.psm1 (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
    
68. Event: Process start: c:\program files (x86)\Tencent\QQPinyin\5.6.4107.400\ qqpyservice.exe, PID:9800 (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
    
69. c:\programdata\Martau\total uninstall 6\ installed programs3.cache (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
    
70. c:\programdata\Martau\total uninstall 6\ installed programs.folders (Performed by c:\program files\total uninstall 6\tu.exe, PID:4512) No fix attempted
    
71. ____________________________
    
72. 
    
73. 
    
74. File Thumbprint - SHA:
    
75. 44ba84d6193b2b15c18146af05da336049e883f413df313fc2b7570d77f3353d
    
76. File Thumbprint - MD5:
    
77. Not available
    

复制代码

ak666

景圣临 发表于 2017-11-5 12:45
TU.exe是Total Uninstall...

LZ的版本哪下的？

叫什么海心的下载站

歌德塔大蜘蛛

ak666 发表于 2017-11-5 18:23
叫什么海心的下载站

心海，烈火的网站。我的winrar就是用的他的版本

ak666

歌德塔大蜘蛛 发表于 2017-11-5 18:54
心海，烈火的网站。我的winrar就是用的他的版本

那看来稳了。。果断加了sonar信任

景圣临

我知道的TU可信的破解只有一个，是国外remek002大神做的

你的是谁破解的？