精睿样本测试（15.10.3）

aboringman

地址：http://kuai.xunlei.com/d/zuh.AdgDwLIOVgQAb3d

            http://pan.baidu.com/s/17GKxg     提取密码：1wjh

密码：bbs.vc52.cn

数量：50

MXCERILYF!

360 Total Security（只开启自主引擎）
文件后缀为vir时：杀30个

文件后缀为exe时：补杀4个

文件后缀为zip时：补杀6个

共查杀40个，剩余10个

卡巴斯基补杀6个

Norton补杀1个

最终剩余3个

aboringman

Avira kill 39 files
[mw_shl_code=css,true]Start of the scan: 2015年10月3日  10:42

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\2015.10.3'
C:\Documents and Settings\Administrator\桌面\2015.10.3\01.vir
    [0] Archive type: RAR
    --> PlutoCrypt\UnPackMe_PlutoCrypt.exe
        [DETECTION] Is the TR/Crypt.CFI.Gen Trojan
        [WARNING]   Infected files in archives cannot be repaired
C:\Documents and Settings\Administrator\桌面\2015.10.3\03.vir
  [DETECTION] Is the TR/Crypt.Xpack.287424 Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\04.vir
  [DETECTION] Is the TR/Dropper.VB.37090 Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\05.vir
  [DETECTION] Is the TR/Crypt.Xpack.287177 Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\07.vir
  [DETECTION] Is the TR/Crypt.ZPACK.84562 Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\08.vir
  [DETECTION] Is the TR/Dropper.MSIL.170466 Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\10.vir
  [DETECTION] Is the TR/Crypt.Xpack.252216 Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\11.vir
  [DETECTION] Contains a recognition pattern of the (harmful) BDS/Sub7.215.Srv back-door program
C:\Documents and Settings\Administrator\桌面\2015.10.3\13.vir
  [DETECTION] Is the TR/Dldr.Delphi.Gen Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\14.vir
  [DETECTION] Is the TR/EquationDrug.bgec Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\15.vir
    [0] Archive type: ZIP
    --> classes.dex
        [DETECTION] Contains code of the ANDROID/Zsone.B virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Documents and Settings\Administrator\桌面\2015.10.3\16.vir
  [DETECTION] Is the TR/Kryptik.bqup.8 Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\17.vir
    [0] Archive type: NSIS
    --> ProgramFilesDir/mcwsazmq.exe
        [DETECTION] Is the TR/Rogue.1378855 Trojan
        [WARNING]   Infected files in archives cannot be repaired
C:\Documents and Settings\Administrator\桌面\2015.10.3\18.vir
  [DETECTION] Is the TR/Crypt.ZPACK.htreu Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\21.vir
    [0] Archive type: ZIP
    --> DHL_AWB-1980011-shipment.exe
        [DETECTION] Is the TR/Dropper.MSIL.204994 Trojan
        [WARNING]   Infected files in archives cannot be repaired
C:\Documents and Settings\Administrator\桌面\2015.10.3\22.vir
    [0] Archive type: ZIP
    --> image73511338.exe
        [DETECTION] Is the TR/Crypt.ZPACK.185574 Trojan
        [WARNING]   Infected files in archives cannot be repaired
C:\Documents and Settings\Administrator\桌面\2015.10.3\23.vir
    [0] Archive type: NSIS
    --> ProgramFilesDir/webbora.exe
        [DETECTION] Is the TR/Zusy.106496.6 Trojan
        [WARNING]   Infected files in archives cannot be repaired
    --> ProgramFilesDir/webboraset.exe
        [DETECTION] Contains virus patterns of Adware ADWARE/Kraddare.348160.1
        [WARNING]   Infected files in archives cannot be repaired
    --> ProgramFilesDir/srvwebbora.exe
        [DETECTION] Contains virus patterns of Adware ADWARE/Kraddare.53248
        [WARNING]   Infected files in archives cannot be repaired
C:\Documents and Settings\Administrator\桌面\2015.10.3\25.vir
  [DETECTION] Is the TR/Upatre.45056.CY Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\26.vir
    [0] Archive type: ZIP
    --> my_photo_sexyy_38274923823748923749823798423.exe
        [DETECTION] Is the TR/Crypt.XPACK.Gen7 Trojan
        [WARNING]   Infected files in archives cannot be repaired
C:\Documents and Settings\Administrator\桌面\2015.10.3\28.vir
  [DETECTION] Is the TR/Dropper.Gen Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\29.vir
  [DETECTION] Is the TR/Drop.Stuxnet.A Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\30.vir
  [DETECTION] Contains recognition pattern of the WORM/Palevo.AC worm
C:\Documents and Settings\Administrator\桌面\2015.10.3\32.vir
  [DETECTION] Is the TR/Crypt.ZPACK.185539 Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\33.vir
  [DETECTION] Is the TR/Crypt.Xpack.287656 Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\34.vir
  [DETECTION] Is the TR/AD.Teerac.Y.36 Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\35.vir
  [DETECTION] Is the TR/Rogue.AI.11225 Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\36.vir
    [0] Archive type: ZIP
    --> Ekim_Fatura_Turkcell.exe
        [DETECTION] Is the TR/AD.Teerac.Y.36 Trojan
        [WARNING]   Infected files in archives cannot be repaired
C:\Documents and Settings\Administrator\桌面\2015.10.3\37.vir
  [DETECTION] Is the TR/AD.Golroted.Y.487 Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\40.vir
    [0] Archive type: ZIP
    --> po#1102015B.exe
        [DETECTION] Is the TR/Dropper.VB.37191 Trojan
        [WARNING]   Infected files in archives cannot be repaired
C:\Documents and Settings\Administrator\桌面\2015.10.3\41.vir
  [DETECTION] Contains virus patterns of Adware ADWARE/Amonetize.Gen7
C:\Documents and Settings\Administrator\桌面\2015.10.3\42.vir
  [DETECTION] Is the TR/Agent.589824.721 Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\43.vir
  [DETECTION] Is the TR/Patched.Ren.Gen Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\44.vir
  [DETECTION] Is the TR/Crypt.ZPACK.185594 Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\45.vir
  [DETECTION] Contains a recognition pattern of the (harmful) BDS/XHX.174.2 back-door program
C:\Documents and Settings\Administrator\桌面\2015.10.3\46.vir
  [DETECTION] Is the TR/Crypt.Xpack.287424 Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\47.vir
    [0] Archive type: ZIP
    --> Ekim_Fatura_Turkcell.exe
        [DETECTION] Is the TR/Crypt.ZPACK.185590 Trojan
        [WARNING]   Infected files in archives cannot be repaired
C:\Documents and Settings\Administrator\桌面\2015.10.3\48.vir
  [DETECTION] Is the TR/Crypt.Xpack.287833 Trojan
C:\Documents and Settings\Administrator\桌面\2015.10.3\49.vir
  [DETECTION] Contains recognition pattern of the EXP/CVE-2010-2568.A exploit
C:\Documents and Settings\Administrator\桌面\2015.10.3\50.vir
  [DETECTION] Is the TR/Dldr.Agent.klr Trojan

Beginning disinfection:
[ERROR] RepairMalware: Not able to Repair Malware ADWARE/Amonetize.Gen7
[ERROR] RepairMalware: Not able to Repair Malware ADWARE/Kraddare.53248
C:\Documents and Settings\Administrator\桌面\2015.10.3\50.vir
  [DETECTION] Is the TR/Dldr.Agent.klr Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '4a0fca57.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\49.vir
  [DETECTION] Contains recognition pattern of the EXP/CVE-2010-2568.A exploit
  [NOTE]      The file was moved to the quarantine directory under the name '18509088.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\48.vir
  [DETECTION] Is the TR/Crypt.Xpack.287833 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '7e67df45.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\47.vir
  [DETECTION] Is the TR/Crypt.ZPACK.185590 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '3be3f27a.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\46.vir
  [DETECTION] Is the TR/Crypt.Xpack.287424 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '44f8c018.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\45.vir
  [DETECTION] Contains a recognition pattern of the (harmful) BDS/XHX.174.2 back-door program
  [NOTE]      The file was moved to the quarantine directory under the name '0840ec53.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\44.vir
  [DETECTION] Is the TR/Crypt.ZPACK.185594 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '7458ac03.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\43.vir
  [DETECTION] Is the TR/Patched.Ren.Gen Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '59028349.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\42.vir
  [DETECTION] Is the TR/Agent.589824.721 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '406ab8d2.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\41.vir
  [DETECTION] Contains virus patterns of Adware ADWARE/Amonetize.Gen7
  [NOTE]      The file was moved to the quarantine directory under the name '2c3694e2.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\40.vir
  [DETECTION] Is the TR/Dropper.VB.37191 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '5d8fad74.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\37.vir
  [DETECTION] Is the TR/AD.Golroted.Y.487 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '53959dbb.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\36.vir
  [DETECTION] Is the TR/AD.Teerac.Y.36 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '16bce4f8.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\35.vir
  [DETECTION] Is the TR/Rogue.AI.11225 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '1fb7e05c.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\34.vir
  [DETECTION] Is the TR/AD.Teerac.Y.36 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '47f6f935.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\33.vir
  [DETECTION] Is the TR/Crypt.Xpack.287656 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '6b0280f8.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\32.vir
  [DETECTION] Is the TR/Crypt.ZPACK.185539 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '55fce021.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\30.vir
  [DETECTION] Contains recognition pattern of the WORM/Palevo.AC worm
  [NOTE]      The file was moved to the quarantine directory under the name '36f2cb54.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\29.vir
  [DETECTION] Is the TR/Drop.Stuxnet.A Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '103a8b46.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\28.vir
  [DETECTION] Is the TR/Dropper.Gen Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '22aef0e3.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\26.vir
  [DETECTION] Is the TR/Crypt.XPACK.Gen7 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '28ebdb9b.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\25.vir
  [DETECTION] Is the TR/Upatre.45056.CY Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '17b8bfdd.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\23.vir
  [DETECTION] Contains virus patterns of Adware ADWARE/Kraddare.53248
  [NOTE]      The file was moved to the quarantine directory under the name '6994b3fb.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\22.vir
  [DETECTION] Is the TR/Crypt.ZPACK.185574 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '3cecb73f.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\21.vir
  [DETECTION] Is the TR/Dropper.MSIL.204994 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '317ac617.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\18.vir
  [DETECTION] Is the TR/Crypt.ZPACK.htreu Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '2d27d217.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\17.vir
  [DETECTION] Is the TR/Rogue.1378855 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '1cf49fd9.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\16.vir
  [DETECTION] Is the TR/Kryptik.bqup.8 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '70a28bec.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\15.vir
  [DETECTION] Contains code of the ANDROID/Zsone.B virus
  [NOTE]      The file was moved to the quarantine directory under the name '3938aeea.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\14.vir
  [DETECTION] Is the TR/EquationDrug.bgec Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '62ada63c.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\13.vir
  [DETECTION] Is the TR/Dldr.Delphi.Gen Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '041faad5.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\11.vir
  [DETECTION] Contains a recognition pattern of the (harmful) BDS/Sub7.215.Srv back-door program
  [NOTE]      The file was moved to the quarantine directory under the name '5391d87f.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\10.vir
  [DETECTION] Is the TR/Crypt.Xpack.252216 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '71e18f0a.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\08.vir
  [DETECTION] Is the TR/Dropper.MSIL.170466 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '19f1f585.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\07.vir
  [DETECTION] Is the TR/Crypt.ZPACK.84562 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '3987f101.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\05.vir
  [DETECTION] Is the TR/Crypt.Xpack.287177 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '6ca3b7ab.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\04.vir
  [DETECTION] Is the TR/Dropper.VB.37090 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '0d839614.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\03.vir
  [DETECTION] Is the TR/Crypt.Xpack.287424 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '682fd49c.qua'!
C:\Documents and Settings\Administrator\桌面\2015.10.3\01.vir
  [DETECTION] Is the TR/Crypt.CFI.Gen Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '0df8a03c.qua'!


End of the scan: 2015年10月3日  10:44
Used time: 00:10 Minute(s)

The scan has been done completely.

      1 Scanned directories
    154 Files were scanned
     41 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      0 Files were deleted
      0 Viruses and unwanted programs were repaired
     39 Files were moved to quarantine
      0 Files were renamed
      0 Files cannot be scanned
    113 Files not concerned
     25 Archives were scanned
     12 Warnings
     39 Notes
[/mw_shl_code]

学雷锋做人

360：28个

FD：35个

MXCERILYF!

360卫士领航版（只开启自主引擎）
文件后缀为vir时：杀28个

文件后缀为exe时：补杀4个

文件后缀为zip时：补杀6个

共查杀38个，剩余12个

毛豆新人

CIS  kill 21x

2015.10.3\41.vir         Application.Win32.Amonetize.DAXQ@349629376        
2015.10.3\29.vir         Worm.Win32.Stuxnet.a@124415607          
2015.10.3\35.vir         TrojWare.Win32.Kryptik.BPRE@310528666          
2015.10.3\11.vir         Backdoor.Win32.SubSeven.215@129539          
2015.10.3\08.vir         Malware@#17dpsbb6s04kv          
2015.10.3\10.vir         Malware@#2whg053dn95z          
2015.10.3\14.vir         Malware@#3khb5x99d6bnb                  
2015.10.3\16.vir         Malware@#249tg1dagbuid        
2015.10.3\30.vir         MalCrypt.Indus!@105441913          
2015.10.3\47.vir|Ekim_Fatura_Turkcell.exe         Malware@#3qt1k2xql8ack        
2015.10.3\26.vir|my_photo_sexyy_38274923823748923749823798423.exe         Malware@#2jarv7dv3w2nb          
2015.10.3\15.vir|classes.dex         Malware@#3o51y9i2c9oa9          
2015.10.3\17.vir|mcwsazmq.exe         Malware@#1y5xlgtnznpu2          
2015.10.3\23.vir|webboraset.exe         ApplicUnwnt@#315k4gmvcvbjh          
2015.10.3\01.vir|PlutoCrypt\UnPackMe_PlutoCrypt.exe         Malware@#318srbpcq19g0          
2015.10.3\43.vir         Backdoor.Win32.Hupigon.akxc@102328892        
2015.10.3\35.vir         TrojWare.Win32.Kryptik.BPRE@310528666                  
2015.10.3\47.vir|Ekim_Fatura_Turkcell.exe         Malware@#3qt1k2xql8ack          
2015.10.3\23.vir|webboraset.exe         ApplicUnwnt@#315k4gmvcvbjh        
2015.10.3\30.vir         MalCrypt.Indus!@105441913  
2015.10.3\29.vir         Worm.Win32.Stuxnet.a@124415607        
2015.10.3\11.vir         Backdoor.Win32.SubSeven.215@129539        
2015.10.3\18.vir         Malware@#2xk2plhgbq0sw          
2015.10.3\16.vir         Malware@#249tg1dagbuid          
2015.10.3\26.vir|my_photo_sexyy_38274923823748923749823798423.exe         Malware@#2jarv7dv3w2nb        
2015.10.3\17.vir|mcwsazmq.exe         Malware@#1y5xlgtnznpu2          
2015.10.3\08.vir         Malware@#17dpsbb6s04kv          
2015.10.3\10.vir         Malware@#2whg053dn95z        
2015.10.3\15.vir|classes.dex         Malware@#3o51y9i2c9oa9          
2015.10.3\02.vir         Malware@#28bh68tw581zl          
2015.10.3\45.vir         Malware@#393ar32ybj9k        
2015.10.3\49.vir         Malware@#9dge22wa1y0y          
2015.10.3\50.vir         TrojWare.Win32.VB.MIS@105706870        

MXCERILYF!

金山毒霸-现在检出33个

文件后缀为exe时：未检出任何剩余样本

文件后缀为zip时：未检出任何剩余样本

877906025Z

毒霸24，改exe补1其他格式懒得改了

877906025Z

877906025Z 发表于 2015-10-3 10:58
毒霸24，改exe补1其他格式懒得改了

不对第一个数字是34

877906025Z

MXCERILYF! 发表于 2015-10-3 10:51
金山毒霸-检出32个

谁告诉你改格式毒霸不杀