下载卡巴免费版遇到的。

ICzcz

心心相印 发表于 2022-1-3 20:09
avast还是报毒。第二个链接有毒吧。

打开之后就弹出来
@vaedzy 我怀疑和MDE有关

1. 时间;应用程序;操作;目标;操作;规则;其他信息
   
2. 2021/12/30 23:38:36;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe;已阻止;Deny child processes for powershell.exe;
   
3. 2021/12/30 23:38:45;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe;已阻止;Deny child processes for powershell.exe;
   
4. 2021/12/30 23:39:16;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
   
5. 2021/12/30 23:39:16;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
   
6. 2021/12/30 23:39:16;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
   
7. 2021/12/30 23:39:16;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
   
8. 2021/12/30 23:39:16;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
   
9. 2021/12/30 23:39:16;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
   
10. 2021/12/30 23:39:16;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
11. 2021/12/30 23:39:16;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
12. 2021/12/30 23:39:26;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
13. 2021/12/30 23:39:26;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
14. 2021/12/30 23:39:26;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
15. 2021/12/30 23:39:26;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
16. 2021/12/30 23:39:26;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
17. 2021/12/30 23:39:26;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
18. 2021/12/30 23:39:26;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
19. 2021/12/30 23:39:26;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
20. 2021/12/30 23:39:36;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
21. 2021/12/30 23:39:36;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
22. 2021/12/30 23:39:36;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
23. 2021/12/30 23:39:36;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
24. 2021/12/30 23:39:36;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
25. 2021/12/30 23:39:36;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
26. 2021/12/30 23:39:36;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
27. 2021/12/30 23:39:36;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
28. 2022/1/3 20:10:28;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
29. 2022/1/3 20:10:28;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
30. 2022/1/3 20:10:28;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
31. 2022/1/3 20:10:28;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
32. 2022/1/3 20:10:28;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
33. 2022/1/3 20:10:28;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
34. 2022/1/3 20:10:28;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
35. 2022/1/3 20:10:28;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
36. 2022/1/3 20:10:38;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
37. 2022/1/3 20:10:38;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
38. 2022/1/3 20:10:38;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
39. 2022/1/3 20:10:38;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
40. 2022/1/3 20:10:38;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
41. 2022/1/3 20:10:38;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
42. 2022/1/3 20:10:38;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    
43. 2022/1/3 20:10:38;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;启动新应用程序;C:\windows\System32\Conhost.exe;已阻止;Deny child processes for powershell.exe;
    

复制代码

vaedzy

ICzcz 发表于 2022-1-3 20:11
打开之后就弹出来
@vaedzy 我怀疑和MDE有关

弹出来啥 这些一串是啥...

ICzcz

vaedzy 发表于 2022-1-3 20:12
弹出来啥 这些一串是啥...

hips弹窗

vaedzy

ICzcz 发表于 2022-1-3 20:24
hips弹窗

你去MDE控制台看 是不是被EDR阻断了

ICzcz

vaedzy 发表于 2022-1-3 20:12
弹出来啥 这些一串是啥...

我发现MDE是依靠PowerShell工作的，但是官方的规则中确阻止其打开子程序

vaedzy

ICzcz 发表于 2022-1-3 20:26
我发现MDE是依靠PowerShell工作的，但是官方的规则中确阻止其打开子程序

他不依靠这个 兄弟 任务管理器 看到WDAPT没 还有WD高级防护 靠这些 很猛的

ICzcz

vaedzy 发表于 2022-1-3 20:27
他不依靠这个 兄弟 任务管理器 看到WDAPT没 还有WD高级防护 靠这些 很猛的

如果是这样的话，那@心心相印 这个网址可能有使用PoverShell打开指定文件的嫌疑哦

vaedzy

ICzcz 发表于 2022-1-3 20:29
如果是这样的话，那@心心相印 这个网址可能有使用PoverShell打开指定文件的嫌疑哦

来群里 我正在教弥豆子粤语和闽南语

ICzcz

vaedzy 发表于 2022-1-3 20:33
来群里 我正在教弥豆子粤语和闽南语

哈哈哈哈可辛苦小粉丝了

Jirehlov1234

这个是第三方广告使用cookie

完整列表见
https://www.kaspersky.com.cn/third-party-tracking

avast报的是其中的

Kenshoo
Advertising/ Analytics
Kenshoo, Ltd.
22 4th Street, 14th Floor San Francisco, CA 94103 USA

另外小a报的是scam（诈骗）