2014-07-09 #31

显示全部楼层 · 发表于 2014-7-9 23:29:20

http://www.400gb.com/file/68140875

密码(7Z) infected

已将以下杀软漏报的文件上报至对应厂商:

Anvisoft
Avast
Avira
Baidu
BitDefender
Comodo
Dr.Web
Emsisoft
ESET
F-Prot
F-Secure
Fortinet
Ikarus
Immunet
K7
Kaspersky
Kompas
Malwarebytes
McAfee
Microsoft
Nano
Norman
Outpost
Panda
PCMAV
Qihoo 360
Quick Heal
Sophos
Spybot
Symantec
TotalDefense
Trend Micro
Trojan Killer
Twister
Vipre
VirIT
Xvirus
Zillya

显示全部楼层 · 发表于 2014-7-9 23:36:43

360杀毒解压剩余3个，扫描再杀一个

显示全部楼层 · 发表于 2014-7-10 04:51:20

显示全部楼层 · 发表于 2014-7-10 07:50:13

费尔右键 1X
C:\Users\chen wei\Desktop\新建文件夹\2014-07-09_31\fax0010029826052014.scr Suspicious:Heuri.NewThreat.MVM 启发只报告

360右键 28X

显示全部楼层 · 发表于 2014-7-10 08:25:55

腾讯解压直接报毒，查杀9

为什么没有上报腾讯，楼主要黑腾讯吗？

显示全部楼层 · 发表于 2014-7-10 08:26:29

360解压一个不报，查杀29.监控仍然是渣渣

显示全部楼层 · 发表于 2014-7-10 11:43:36

费尔2个，火绒18个

显示全部楼层 · 发表于 2014-7-10 11:52:22

Dr.Web 18x kill 13x miss

Object(s) to scan:
- C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31

C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\AvisDePaiement.pdf - infected with Exploit.PDF.8360
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\AvisDePaiement.pdf - infected
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\ESTADOCUENTA_MES.doc - infected with W97M.DownLoader.36
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\ESTADOCUENTA_MES.doc - infected
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\fax0010029826052014.scr - infected with Trojan.Encoder.514
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\fax0010029826052014.scr - infected
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\eFaktura_DHL Express 2873664091.XML.exe - infected with Trojan.Hottrend
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\eFaktura_DHL Express 2873664091.XML.exe - infected
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\dogerawp.exe - infected with Trojan.Siggen6.20334
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\dogerawp.exe - infected
>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\binc2.exe - packed by UPX
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\bbbv.exe - Ok
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\leghere.exe - infected with Trojan.Siggen6.20334
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\leghere.exe - infected
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\Account detail_fdp.exe - infected with BackDoor.Bladabindi.1056
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\Account detail_fdp.exe - infected
>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\bbbbbbv.exe is RAR archive
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\k.exe - infected with Trojan.Packed.28201
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\k.exe - infected
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\k(1).exe - Ok
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\M123S.com.exe - Ok
>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\burgerdone.exe is RAR archive
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\NJRAT000007.exe - infected with BackDoor.Bladabindi.1056
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\NJRAT000007.exe - infected
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\Purchase_Order1.exe - infected with Trojan.PWS.Stealer.13078
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\Purchase_Order1.exe - infected
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\purchasing_order.exe - infected with Trojan.Siggen6.20334
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\purchasing_order.exe - infected
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\ng.exe - Ok
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\report_id_875893475983475934759384.exe - infected with BackDoor.Tishop.122
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\report_id_875893475983475934759384.exe - infected
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\ok.exe - Ok
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\Quotation01.exe - infected with BackDoor.Bladabindi.1056
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\Quotation01.exe - infected
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\Server_41571.exe - infected with Trojan.Siggen6.20332
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\Server_41571.exe - infected
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\ss.exe - infected with BackDoor.IRC.NgrBot.146
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\ss.exe - infected
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\svchost.exe - infected with Trojan.VbCrypt.250
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\svchost.exe - infected
>>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\bbbbbbv.exe\RuPKCTqK.exe is AUTOIT container
>>>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\bbbbbbv.exe\RuPKCTqK.exe\Users\Windows\AppData\Local\Temp\aut5A41.tmp - packed by ASCRIPT
>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\cleantemp.exe is AUTOIT container
>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\h.exe is AUTOIT container
>>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\burgerdone.exe\h.exe is AUTOIT container
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\WindowsApplication7.exe - infected with Trojan.Siggen6.20333
>>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\binc2.exe is AUTOIT container
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\WindowsApplication7.exe - infected
>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\TRRRRR.exe is RAR archive
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\bbbbbbv.exe\RuPKCTqK.exe - Ok
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\bbbbbbv.exe - Ok
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\bbbbbbv.exe - archive
>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\RuPKCTqK.exe is AUTOIT container
>>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\RuPKCTqK.exe\Users\Windows\AppData\Local\Temp\aut5A41.tmp - packed by ASCRIPT
>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\RTQEAFD.exe is AUTOIT container
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\RuPKCTqK.exe - container
>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\vbbvcv.exe is AUTOIT container
>>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\TRRRRR.exe\RTQEAFD.exe is AUTOIT container
>>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\cleantemp.exe\Users\Thomas\AppData\Local\Temp\aut4F2A.tmp - packed by ASCRIPT
>>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\h.exe\Users\jubi\AppData\Local\Temp\autBFCC.tmp - packed by ASCRIPT
>>>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\binc2.exe\DOCUME~1\Admin\LOCALS~1\Temp\autC6.tmp - packed by ASCRIPT
>>>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\burgerdone.exe\h.exe\Users\jubi\AppData\Local\Temp\autBFCC.tmp - packed by ASCRIPT
>>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\vbbvcv.exe\Users\Windows\AppData\Local\Temp\autCA80.tmp - packed by ASCRIPT
>>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\RTQEAFD.exe\Users\Test\AppData\Local\Temp\aut9A4F.tmp - packed by ASCRIPT
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\h.exe - container
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\burgerdone.exe\h.exe - Ok
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\burgerdone.exe - Ok
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\burgerdone.exe - archive
>>>C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\TRRRRR.exe\RTQEAFD.exe\Users\Test\AppData\Local\Temp\aut9A4F.tmp - packed by ASCRIPT
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\RTQEAFD.exe - container
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\TRRRRR.exe\RTQEAFD.exe - Ok
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\TRRRRR.exe - Ok
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\TRRRRR.exe - archive
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\binc2.exe - container
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\cleantemp.exe\Users\Thomas\AppData\Local\Temp\aut4F2A.tmp - infected with BackDoor.Andromeda.22
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\cleantemp.exe - infected container
C:\Users\PRODUCTION I.G\Desktop\2014-07-09_31\2014-07-09_31\vbbvcv.exe - container

显示全部楼层 · 发表于 2014-7-10 11:54:14

无状态发表于 2014-7-10 08:26
360解压一个不报，查杀29.监控仍然是渣渣

问一下，你用的是那个版本的360？

显示全部楼层 · 发表于 2014-7-10 13:56:56

无状态发表于 2014-7-10 08:26
360解压一个不报，查杀29.监控仍然是渣渣

杀毒要把监控调到中解压才会杀，卫士只有双击才会杀，否则无视的。

[病毒样本] 2014-07-09 #31

本帖子中包含更多资源

本帖子中包含更多资源