#3（18.06.06）

聆听落雨

诺顿NS

Kill 3 个

aboringman

BD：miss all.

实机双击，ATD killed all files.

The file c:\users\killer\desktop\threat test\3.exe is infected with Atc4.Detection and was moved to quarantine.

The file c:\users\killer\desktop\threat test\2.exe is infected with Atc4.Detection and was moved to quarantine.

The file c:\users\killer\desktop\threat test\1.exe is infected with Atc4.Detection and was moved to quarantine.

petr0vic

191196846 发表于 2018-6-6 17:51
给Launcher 文件夹设权限就可以了

全部选拒绝

It doesn't work anymore?
https://bbs.kafan.cn/forum.php?m ... ;page=1#pid39569644

Jerry.Lin

petr0vic 发表于 2018-6-6 20:07
It doesn't work anymore?
https://bbs.kafan.cn/forum.php?mod=viewthread&tid=2081496&page=1#pid3956 ...

It works

For new installing:


1.  create the launcher folder (C:\Program Files (x86) )before installing and set it to deny any operation( write, read, execute...) of all user groups

    This method cannot work for the lastest antivirus installer ( it would check the status of launcher : cannot continue until launcher installed.）

   For old installer, it works so no launcher would be installed


For already installed:


2. uninstall launcher


enable the self-protect setting( so the antivirus module would not be affected), use uninstall tools (such as total uninstall) to uninstall launcher totally ( remove files and reg), then set the folder as method 1, rebot your computer

WCMS

BDF miss All
双击AVC杀

小淘气

卡巴双击杀了两个，第一个运行闪退

尘梦幽然

扫描无检出
在虚拟机双击1.exe后弹出了多个命令行窗口，但是没有被拦截。

双击2.exe后被拦截行为，但是未被结束进程，也未移除。

双击3.exe后被拦截，已被结束进程，但是未被移除。

欧阳宣

mcafee 2x

桑德尔

191196846 发表于 2018-6-6 17:47
Modified Hash

当然MISS 啦

有的时候我都在想，那些被上报又被二次拉黑的Modified Hash样本有多少是重新提取了一个MD5

a445441

微点拦截2,3.exe   MISS 1.exe