~~样本*5~~

白露为霜

aboringman

建议楼主对压缩包进行加密，防止被杀软网页监控拦截

aboringman

AVG：

扫描：miss all；

双击：除2.doc无条件pass外，其余均进行双击测试。

1.exe：

"";"IDP.Program.D1B0A5C0, C:\Users\killer\Desktop\新建文件夹\1.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/2/18, 1:12:12"

"";", C:\Users\killer\Desktop\新建文件夹\1.exe";"Object was blocked";"Process";"2016/2/18, 1:12:12"

3.exe：

"";"IDP.Program.D1B0A5C0, C:\Users\killer\Desktop\新建文件夹\3.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/2/18, 1:12:30"

"";", C:\Users\killer\Desktop\新建文件夹\3.exe";"Object was blocked";"Process";"2016/2/18, 1:12:30"

"";", HKEY_USERS\S-1-5-21-540828005-2055914412-3868506426-1000\SOFTWARE\LOCKY";"Deleted, Moved to Virus Vault";"Registry key";"2016/2/18, 1:12:30"

4.exe（仅杀掉衍生物，本体被留下）：

"";"IDP.ALEXA.51, C:\Users\killer\AppData\Local\Temp\Build.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/2/18, 1:12:56"

"";", C:\Users\killer\AppData\Local\Temp\Build.exe";"Object was blocked";"Process";"2016/2/18, 1:12:56"

"";", HKEY_USERS\S-1-5-21-540828005-2055914412-3868506426-1000\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\SHELL";"Deleted";"Registry value";"2016/2/18, 1:12:56"

"";", HKEY_USERS\S-1-5-21-540828005-2055914412-3868506426-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\\USERINI";"Deleted, Moved to Virus Vault";"Registry value";"2016/2/18, 1:12:56"

5.exe（需重启，各种注入，居然还企图注入AVG的UI进程，真是胆大包天，又现Unknown报法）：

"";"Unknown, C:\Users\killer\Desktop\新建文件夹\5.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/2/18, 1:35:37"

"";", C:\Windows\explorer.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Windows\System32\rundll32.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Windows\System32\winlogon.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Windows\System32\dwm.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Windows\System32\taskhost.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Program Files\AVG\Framework\Common\avguix.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Windows\System32\userinit.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Windows\System32\LogonUI.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Windows\System32\csrss.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Windows\System32\wininit.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Windows\System32\services.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Windows\System32\conhost.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Windows\System32\conhost.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Windows\System32\conhost.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Windows\System32\lsass.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Windows\System32\lsm.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

"";", C:\Users\killer\Desktop\新建文件夹\5.exe";"Object was blocked";"Process";"2016/2/18, 1:35:37"

祝贺IDP大获全胜（除4.exe本体并未被干掉之外，其他均已伏法【其实那个Build.exe才是罪魁祸首，哈哈】）

cfhdrty

火绒，build.exe是4.exe的衍生物

欧阳宣

诺顿两个
Trojan.Cridex
Trojan.Cryptolocker.N

xyz0703

卡巴killed 4
18.02.2016 08.07.23;检测到的对象（文件）已删除。;C:\Users\Yizhou\Desktop\4.exe;C:\Users\Yizhou\Desktop\4.exe;Trojan-Ransom.Win32.Blocker.idbo;木马程序;02/18/2016 08:07:23

18.02.2016 08.07.32;检测到的对象（文件）已删除。;C:\Users\Yizhou\Desktop\3.exe;C:\Users\Yizhou\Desktop\3.exe;Trojan.Win32.Reconyc.ffmn;木马程序;02/18/2016 08:07:32


18.02.2016 08.07.42;检测到的对象（文件）已删除。;C:\Users\Yizhou\Desktop\1.exe;C:\Users\Yizhou\Desktop\1.exe;Trojan-Dropper.Win32.Agent.sbgr;木马程序;02/18/2016 08:07:42

18.02.2016 08.08.06;检测到的对象（文件）已删除。;C:\Users\Yizhou\Desktop\2.doc//word/vbaProject.bin//Module1;C:\Users\Yizhou\Desktop\2.doc//word/vbaProject.bin//Module1;Trojan-Downloader.MSWord.Agent.aai;木马程序;02/18/2016 08:08:06

cxy密斯

共和时代

实机双击 4.exe       NS miss
电脑被锁，尝试安全模式没用，索性还原了
不说了，换BD去

PS.这几天自己双击包括饭友的反映，SONAR还不如IDP啊

ymb668888

@共和时代 居然敢实机双击，佩服佩服

ericdj

cxy密斯 发表于 2016-2-18 08:58

BD的终端么？

单位买的么？