比特币挖矿病毒

AIYYK

链接：https://pan.baidu.com/s/1WgPJhFpBhA8l4cYhB-wkgQ
提取码：1o6u

MBAM删除此病毒后仍然不停提示

AIYYK

MBAM删除后重启，安装智量，一直提示，无法隔离

BE_HC

Emsisoft Anti-Malware Scan Kill

BE_HC

反沙箱，反虚拟机，删不掉的话建议用PCHunter（ARK）处理
-----
以下由PortEX-Master自动生成

1. Anomalies
   
2. *********
   
3. 
   
4. * Optional Header: ImageBase + SizeOfImage is too large (0x140b3c000), thus relocated to 0x10000
   
5. * Optional Header: The default image base is 0x00400000, but actual value is 0x140000000
   
6. * Optional Header: size of code is too small (0xba600), it should be 0x49f400
   
7. * Optional Header: size of initialized data is too small (0x87c00), it should be 0x49fc00
   
8. * Section Header 1 with name .text: SIZE_OF_RAW_DATA is 0
   
9. * Section Header 2 with name .rdata: SIZE_OF_RAW_DATA is 0
   
10. * Section Header 3 with name .data: SIZE_OF_RAW_DATA is 0
    
11. * Section Header 4 with name .pdata: SIZE_OF_RAW_DATA is 0
    
12. * Section Header 6 with name .vmp0: SIZE_OF_RAW_DATA is 0
    
13. * Section name .vmp0 is typical for VMProtect packer
    
14. * Section name .vmp1 is typical for VMProtect packer
    
15. * Section 1 with name .text (range: 0--0) has same physical location as section 2 with name .rdata
    
16. * Section 1 with name .text (range: 0--0) has same physical location as section 3 with name .data
    
17. * Section 1 with name .text (range: 0--0) has same physical location as section 4 with name .pdata
    
18. * Section 1 with name .text (range: 0--0) has same physical location as section 6 with name .vmp0
    
19. * Section 2 with name .rdata (range: 0--0) has same physical location as section 3 with name .data
    
20. * Section 2 with name .rdata (range: 0--0) has same physical location as section 4 with name .pdata
    
21. * Section 2 with name .rdata (range: 0--0) has same physical location as section 6 with name .vmp0
    
22. * Section 3 with name .data (range: 0--0) has same physical location as section 4 with name .pdata
    
23. * Section 3 with name .data (range: 0--0) has same physical location as section 6 with name .vmp0
    
24. * Section 4 with name .pdata (range: 0--0) has same physical location as section 6 with name .vmp0
    
25. * Section Header 8 with name .reloc should (but doesn't) contain the characteristics: Discardable
    
26. * Import function typical for code injection: LoadLibraryA maps module into the address space of the calling process
    
27. * Import function typical for code injection: LoadLibraryA maps module into the address space of the calling process
    

复制代码

AIYYK

BE_HC 发表于 2018-10-6 09:15
反沙箱，反虚拟机，删不掉的话建议用PCHunter（ARK）处理
-----
以下由PortEX-Master自动生成

我试一下，删除了原文件还是在提示

BE_HC

AIYYK 发表于 2018-10-6 09:42
我试一下，删除了原文件还是在提示

360急救箱用过咩，你康康它是不是一直在生成（感觉有本体在生成，如果是的话PCHunter这样弄

猥琐大叔

Luca.l

j2016

解压阻止应用，头一次见到这样的弹框

by wd

c/mm