3e0e5b7d301c559dde78b5458df4a41579e191c67145f3db26f47d34068cf466

显示全部楼层 · 发表于 2017-5-27 22:57:46

http://blog.talosintelligence.co ... ins-from-india.html

https://p.fuwafuwa.moe/hxwjhk.zip

显示全部楼层 · 发表于 2017-5-27 23:02:36

rising
682d5d60d6fc0e1d5810e9cd9d8b1c6b6fa154d5a790da944177074d28846d66 ...    Malware.Generic.d!tfe-MeXam6t03fE <cloud>
b7101462507a8cf5bf91b62b641ef1ac3d268115d6dfca54a1625efb07fccf0d ...    Hack.Win32.SpyWare.aa-QJTPq1DfYfJ <cloud>
4bce73a29ee1b9840cd82d8c08e107179cd74dc1aed488f6d16772ce12092c69 ...    Malware.Heuristic!ET#94%-biW72bkDD2C <cloud>
bcf8dbbc78883b2d84511819123cf39b1c2ffe3cd9763d08fe1544c89084cadf ...    Malware.Heuristic!ET#89%-en4rOs5WdCB <cloud>
e5d2c3a7ddd219ab361af4a709999a492387e3aaf8380187a7699895fc383e40 ...    Malware.Strealer!8.1EF-RAKI5moMmcV <cloud>

显示全部楼层 · 发表于 2017-5-27 23:11:06

F-S K ALL

Trojan.GenericKD.4753584
C:\Users\常用.user-PC.000\Desktop\6\4bce73a29ee1b9840cd82d8c08e107179cd74dc1aed488f6d16772ce12092c69: 已清除
Trojan.Generic.20472792
C:\Users\常用.user-PC.000\Desktop\6\682d5d60d6fc0e1d5810e9cd9d8b1c6b6fa154d5a790da944177074d28846d66: 已清除
Trojan.GenericKD.5040519
C:\Users\常用.user-PC.000\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be\word\document.xml: 已跳過
Trojan.GenericKD.4911982
C:\Users\常用.user-PC.000\Desktop\6\bcf8dbbc78883b2d84511819123cf39b1c2ffe3cd9763d08fe1544c89084cadf: 已清除
Trojan.AgentWDCR.JWM
C:\Users\常用.user-PC.000\Desktop\6\b7101462507a8cf5bf91b62b641ef1ac3d268115d6dfca54a1625efb07fccf0d: 已清除
Gen:Variant.Kazy.764369
C:\Users\常用.user-PC.000\Desktop\6\e5d2c3a7ddd219ab361af4a709999a492387e3aaf8380187a7699895fc383e40: 已清除
Exploit.CVE-2012-1856.Gen
Trojan.GenericKD.5040519
C:\Users\常用.user-PC.000\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be:

显示全部楼层 · 发表于 2017-5-27 23:25:32

Avira kill all
[mw_shl_code=css,true]Start of the scan: 2017-05-27 23:23:54
05/27/2017,23-23-55 [INFO] C:\Users\Ivan\Downloads\6\b7101462507a8cf5bf91b62b641ef1ac3d268115d6dfca54a1625efb07fccf0d
05/27/2017,23-23-55 [INFO] [DETECTION] file contains 'DR/Autoit.ofeip'
05/27/2017,23-23-55 [INFO] repair.rdf loaded (version: 1.0.27.96)
05/27/2017,23-23-55 [INFO] C:\Users\Ivan\Downloads\6\bcf8dbbc78883b2d84511819123cf39b1c2ffe3cd9763d08fe1544c89084cadf
05/27/2017,23-23-55 [INFO] [DETECTION] file contains 'DR/Autoit.woltu'
05/27/2017,23-23-55 [INFO] C:\Users\Ivan\Downloads\6\e5d2c3a7ddd219ab361af4a709999a492387e3aaf8380187a7699895fc383e40
05/27/2017,23-23-55 [INFO] [DETECTION] file contains 'TR/Spy.Gen'
05/27/2017,23-23-56 [INFO] C:\Users\Ivan\Downloads\6\4bce73a29ee1b9840cd82d8c08e107179cd74dc1aed488f6d16772ce12092c69
05/27/2017,23-23-56 [INFO] [DETECTION] file contains 'DR/Autoit.tnvhd'
05/27/2017,23-23-56 [INFO] C:\Users\Ivan\Downloads\6\682d5d60d6fc0e1d5810e9cd9d8b1c6b6fa154d5a790da944177074d28846d66
05/27/2017,23-23-56 [INFO] [DETECTION] file contains 'TR/Dropper.Gen'
ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be'
contained the pattern of 'EXP/CVE-2013-3906' [exploit][/mw_shl_code]

显示全部楼层 · 发表于 2017-5-28 00:34:12

emsi KA
扫描开始： 2017/5/28 0:30:05
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/document.xml    Trojan.GenericKD.5040519 (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX1.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX10.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX11.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX12.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX13.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX14.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX15.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX16.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX17.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX18.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX19.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX2.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX20.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX21.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX22.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX23.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX24.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX25.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX26.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX27.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX28.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX29.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX3.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX30.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX31.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX32.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX33.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX34.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX35.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX36.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX37.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX38.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX39.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX4.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX40.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX5.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX6.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX7.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX8.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/activeX/activeX9.xml    Exploit.CVE-2012-1856.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be -> word/media/image1.jpeg    Exploit.CVE-2013-3906.Gen (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\4bce73a29ee1b9840cd82d8c08e107179cd74dc1aed488f6d16772ce12092c69    Trojan.GenericKD.4753584 (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\682d5d60d6fc0e1d5810e9cd9d8b1c6b6fa154d5a790da944177074d28846d66    Trojan.Generic.20472792 (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\b7101462507a8cf5bf91b62b641ef1ac3d268115d6dfca54a1625efb07fccf0d    Trojan.AgentWDCR.JWM (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\bcf8dbbc78883b2d84511819123cf39b1c2ffe3cd9763d08fe1544c89084cadf    Trojan.GenericKD.4911982 (B) [krnl.xmd]
C:\Users\Admin\Desktop\6\e5d2c3a7ddd219ab361af4a709999a492387e3aaf8380187a7699895fc383e40    Gen:Variant.Kazy.764369 (B) [krnl.xmd]

扫描 6
发现 47

扫描结束： 2017/5/28 0:30:36
扫描时间： 0:00:31

显示全部楼层 · 发表于 2017-5-28 05:29:00

cylance 5x

显示全部楼层 · 发表于 2017-5-28 10:04:28

卡巴修复一个，其他全部删除

显示全部楼层 · 发表于 2017-5-28 11:13:05

ESET Kill 5x

显示全部楼层 · 发表于 2017-5-28 12:28:38

360miss 2个都入了风险库，万恶的风险库

显示全部楼层 · 发表于 2017-5-28 13:02:09

如图

[其他相关] 3e0e5b7d301c559dde78b5458df4a41579e191c67145f3db26f47d34068cf466

本帖子中包含更多资源