声纳没反应，入侵防护不停拦截

www-tekeze

安天和无BD管家，Both Scan Miss 。

flyhunterl2

我都看不见

ELOHIM

flyhunterl2 发表于 2019-10-17 22:20
我都看不见

https://att.kafan.cn/forum.php?mo ... DY2NTU5OXwyMTYyNDU0

试试看。

www-tekeze

www-tekeze 发表于 2019-10-17 21:19
智量Heur杀，火绒Miss，有空双击。。

双击，首先被智量主防杀！退出智量双击，会删除自身并改名隐藏到系统目录里，被火绒ADV主防杀！

这几天这么多Emotet？？估计我发那些样本里也有不少。。。

evans168

FSS

lovelive10010

Nocria

G DATA.

1. AVA 25.23711
   
2. GD 26.16324
   
3. 
   
4. *** Process ***
   
5. 
   
6. Process: 7016
   
7. File name: magnifyresw.exe
   
8. Path: C:\Users\promi\AppData\Local\Temp\BNZ.5da903091ae10a\magnifyresw.exe
   
9. 
   
10. Publisher: Unknown publisher
    
11. 
    
12. Started by: Bandizip.exe
    
13. Publisher: Bandisoft
    
14. 
    
15. 
    
16. *** Actions ***
    
17. 
    
18. The program has created or manipulated an executable file.
    
19. The program has read data from its own program file.
    
20. The program attempted to remove its own program file.
    
21. The program attempted to rename its own program file.
    
22. The program has started another program to delete itself.
    
23. The program attempted to move its own program file.
    
24. 
    
25. 
    
26. *** Quarantine ***
    
27. 
    
28. The following files were moved into quarantine:
    
29. C:\Users\promi\AppData\Local\Temp\BNZ.5da903091ae10a\magnifyresw.exe
    
30. C:\Users\promi\AppData\Local\movecrypto\movecrypto.exe
    
31. 
    
32. The following registry entries were deleted:
    
33. 
    
34. 
    
35. YGLh3bILLScnJiYnBy4nKCcnJweXcnImJiYnZ3AqdHImJiZ0cga3cnImJiYnZ5ArFt4t97AtJycmJicHrHJyYmJycsAvJycmJicHj3LicrJykvApJycnJyYGZyYnJyYmJwdnJycnJiYnB4crJycmJicHlyYnJycnJgaXJycnJiYnB6crHIg1tnLCgVhjKycmBrcnJycnJyYG5ygnmnBvcnJiYnJycH9ycmJicnKA+3KCcnJycoC+cqJyknJyAAA
    
36. Rules version: 5.0.152
    
37. OS: Windows 6.3 Service Pack 0.0 Build: 9600 - Workstation 64bit OS
    
38. dll version: 76935
    
39. 
    
40. "C:\Users\promi\AppData\Local\Temp\BNZ.5da903091ae10a\magnifyresw.exe"
    
41. MD5: 3214E5CCF6D7F0B97EA4A917CA44F0D5
    
42. "C:\Program Files\Bandizip\Bandizip.exe" "C:\Users\promi\Desktop\magnifyresw.rar"
    
43. MD5: 22D24F8736BA0748FBE2098416612FEF
    

复制代码

Miostartos

18927058963 发表于 2019-10-17 21:38
楼主你用的什么版本，我刚打开文件夹就拦住了。

这报毒是入库。
估计LZ测的时候还没呢。

神算子

www-tekeze 发表于 2019-10-17 22:54
双击，首先被智量主防杀！退出智量双击，会删除自身并改名隐藏到系统目录里，被火绒ADV主防杀！

...

这个月智量会有新版本出来