1bee42737a192bb43d7e836b99a624e0a4bbf040c6fb9cb8aee5906e5172f9bf

Jirehlov1234

https://www.lanzous.com/i5c9aja

https://www.virustotal.com/gui/f ... e5172f9bf/detection

静影沉璧

Windows Defender 双击后云杀

Jirehlov1234

静影沉璧 发表于 2019-8-5 19:27
Windows Defender

下次能不能标一下是双击的还是扫描的

静影沉璧

Jirehlov1234 发表于 2019-8-5 19:28
下次能不能标一下是双击的还是扫描的

No problem.

a233

卡巴扫描Miss
双击

咖啡战士XD

G DATA：

扫描miss，双击，BB杀：

Started by: 2019-08-05 111409.exe
Publisher: Unknown publisher


*** Actions ***

The program is trying to create a startup item to launch a program automatically at system startup.
An unknown process was accessed.
The program has created or manipulated an executable file.
The program has read data from its own program file.
The program created a copy of itself.


*** Quarantine ***

The following files were moved into quarantine:
D:\Users\User\AppData\Local\VirtualStore\Windows\win.ini
D:\Users\User\Downloads\2019-08-05 111409\2019-08-05 111409.exe
D:\Users\User\Form1UNRES\Form1Frtid.exe
D:\Users\User\Form1UNRES\Form1Frtid.vbs
D:\Windows\win.ini

The following registry entries were deleted:

\registry\user\s-1-5-21-2225727273-1228488606-1948357757-1000\software\microsoft\windows\currentversion\runonce || form1supe

YGLRrpIILCcnJiYnBy0nKScoJwcuJyknKCcHp0InKCYmdIJwKycoJiYnCMdygmJicoKQKxbtKueQLScHrHKScnJygsAvJycnJyYGj3JyKyctJw6fcnJycmJi8CwnJycnJgaHKycoJycnB6cqJycmJicHpysXmDXGknKBWWMsJxeYNcaCcNtycnJyYmJwjnJyB7gvJygnJycHAA
Rules version: 5.0.152
OS: Windows 6.1 Service Pack 1.0 Build: 7601 - Workstation 64bit OS
dll version: 76935

QVM360

360 Miss

www-tekeze

智量Heur杀，火绒miss，有空双击。。

www-tekeze

www-tekeze 发表于 2019-8-5 21:50
智量Heur杀，火绒miss，有空双击。。

双击，被智量主防杀！退出智量双击，会改名为Form1Frtid隐藏到users目录，并且释放一个vbs，文件名也为Form1Frtid，然后添加自启、联网，但没流量。。。重启后被智量主防连杀两次！火绒没反应。。

N卡网速快

双击