GandCrab 5.2 (19.05.20)

jiaobaoyun51

avira解压kill 1 双击APC kill 2

Nocria

Both were blocked by G DATA.

1. Suspicious access to your file system has been detected that indicate an encryption Trojan.
   
2. 
   
3. The following processes were therefore interrupted by G DATA for security reasons:
   
4.         ----------------------------------------------------------------
   
5.         C:\Windows\System32\svchost.exe (PID 1164)
   
6.         C:\Windows\System32\svchost.exe (PID 1032)
   
7.         C:\Windows\System32\svchost.exe (PID 2976)
   
8.         C:\Windows\System32\wermgr.exe (PID 6788)
   
9.         C:\Windows\System32\taskhost.exe (PID 5396)
   
10.         C:\Windows\System32\DsmUserTask.exe (PID 2960)
    
11.         C:\Windows\WinStore\WSHost.exe (PID 6524)
    
12.         C:\Windows\System32\taskhostex.exe (PID 2844)
    
13.         C:\Windows\System32\sppsvc.exe (PID 1800)
    
14.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 4092)
    
15.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 3600)
    
16.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 6124)
    
17.         C:\Program Files\Bandizip\Bandizip.exe (PID 7108)
    
18.         C:\Program Files\Bandizip\Updater.exe (PID 948)
    
19.         C:\Users\promi\AppData\Local\Temp\BNZ.5ce2bfdd31a673\1.exe (PID 6488)
    
20.         ----------------------------------------------------------------
    
21. 
    
22. If blocked, the following programs responsible will be moved to Quarantine:
    
23.         ----------------------------------------------------------------
    
24.         C:\Users\promi\AppData\Local\Temp\BNZ.5ce2bfdd31a673\1.exe
    
25.         ----------------------------------------------------------------
    
26. 
    
27. Detected suspicious activities:
    
28.         ----------------------------------------------------------------
    
29.         Created: C:\Users\promi\AppData\HQBZWHXEV-MANUAL.txt
    
30.         Created: C:\Users\promi\AppData\Local\VirtualStore\HQBZWHXEV-MANUAL.txt
    
31.         Created: C:\LeakHotfix\HQBZWHXEV-MANUAL.txt
    
32.         Created: C:\Users\promi\AppData\Local\VirtualStore\Program Files\HQBZWHXEV-MANUAL.txt
    
33.         Created: C:\Users\promi\AppData\Local\VirtualStore\Program Files (x86)\HQBZWHXEV-MANUAL.txt
    
34.         Created: C:\Users\promi\AppData\Local\Temp\DMIE3C4.tmp
    
35.         Created: C:\Users\promi\AppData\Local\Temp\DMIE3C4.tmp.log.xml
    
36.         Created: C:\Users\promi\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x64_9b7b96e7449d9b89f8a366d8a7931ec83e213_00000000_cab_0bbfe441\DMIE3C4.tmp.log.xml
    
37.         Created: C:\Users\promi\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x64_9b7b96e7449d9b89f8a366d8a7931ec83e213_00000000_cab_0bbfe441\Report.wer
    
38.         Created: C:\Windows\SoftwareDistribution\Download\b2f1109cd6afa55900702fafa43c67fa\BlockMap.xml
    
39.         Created: C:\Users\promi\AppData\Local\Microsoft\Windows\INetCookies\container.dat
    
40.         ----------------------------------------------------------------
    
41. 
    
42. The user blocked access.
    

复制代码

1. Suspicious access to your file system has been detected that indicate an encryption Trojan.
   
2. 
   
3. The following processes were therefore interrupted by G DATA for security reasons:
   
4.         ----------------------------------------------------------------
   
5.         C:\Windows\System32\svchost.exe (PID 1164)
   
6.         C:\Windows\System32\svchost.exe (PID 1032)
   
7.         C:\Users\promi\AppData\Local\Temp\BNZ.5ce2c00b325a13\2.exe (PID 5036)
   
8.         C:\Windows\System32\svchost.exe (PID 2976)
   
9.         C:\Windows\System32\wermgr.exe (PID 6788)
   
10.         C:\Windows\System32\taskhost.exe (PID 5396)
    
11.         C:\Windows\System32\DsmUserTask.exe (PID 2960)
    
12.         C:\Windows\WinStore\WSHost.exe (PID 6524)
    
13.         C:\Windows\System32\taskhostex.exe (PID 2844)
    
14.         C:\Windows\System32\sppsvc.exe (PID 1800)
    
15.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 4092)
    
16.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 3600)
    
17.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 6124)
    
18.         C:\Program Files\Bandizip\Bandizip.exe (PID 7108)
    
19.         C:\Program Files\Bandizip\Updater.exe (PID 948)
    
20.         C:\Users\promi\AppData\Local\Temp\BNZ.5ce2bfdd31a673\1.exe (PID 6488)
    
21.         C:\Program Files\Bandizip\Bandizip.exe (PID 4712)
    
22.         ----------------------------------------------------------------
    
23. 
    
24. If blocked, the following programs responsible will be moved to Quarantine:
    
25.         ----------------------------------------------------------------
    
26.         C:\Users\promi\AppData\Local\Temp\BNZ.5ce2bfdd31a673\1.exe
    
27.         ----------------------------------------------------------------
    
28. 
    
29. Detected suspicious activities:
    
30.         ----------------------------------------------------------------
    
31.         Created: C:\Users\promi\AppData\CMCWHNHQ-MANUAL.txt
    
32.         Created: C:\Users\promi\AppData\Local\VirtualStore\CMCWHNHQ-MANUAL.txt
    
33.         Created: C:\LeakHotfix\CMCWHNHQ-MANUAL.txt
    
34.         Created: C:\Users\promi\AppData\Local\VirtualStore\Program Files\CMCWHNHQ-MANUAL.txt
    
35.         Created: C:\Users\promi\AppData\Local\VirtualStore\Program Files (x86)\CMCWHNHQ-MANUAL.txt
    
36.         Created: C:\Users\promi\AppData\Local\Temp\DMIE3C4.tmp
    
37.         Created: C:\Users\promi\AppData\Local\Temp\DMIE3C4.tmp.log.xml
    
38.         Created: C:\Users\promi\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x64_9b7b96e7449d9b89f8a366d8a7931ec83e213_00000000_cab_0bbfe441\DMIE3C4.tmp.log.xml
    
39.         Created: C:\Users\promi\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x64_9b7b96e7449d9b89f8a366d8a7931ec83e213_00000000_cab_0bbfe441\Report.wer
    
40.         Created: C:\Windows\SoftwareDistribution\Download\b2f1109cd6afa55900702fafa43c67fa\BlockMap.xml
    
41.         Created: C:\Users\promi\AppData\Local\Microsoft\Windows\INetCookies\container.dat
    
42.         ----------------------------------------------------------------
    
43. 
    
44. The user blocked access.
    

复制代码

www-tekeze

智量Heur清空，火绒miss all，有空双击。。

www-tekeze

安天智甲、管家无BD，均MISS 。

761773275

瑞星安全云kill all



双击被加密

www-tekeze

www-tekeze 发表于 2019-5-20 23:11
智量Heur清空，火绒miss all，有空双击。。

退出火绒，关闭智量监控，两个都被主防杀。。

Nocria

www-tekeze

www-tekeze 发表于 2019-5-20 23:11
智量Heur清空，火绒miss all，有空双击。。

退出智量，双击第一个弹窗就报勒索，两个样本情况相同。。   PS：开启勒索诱捕。

ytysh

McAfee Kill All

pen2

avast 今早已经是2个解压出来就都杀了