十分可疑的文件，大家来看看

jianfuyindidi

gdata阻止下载，管家不报

245867683

驭龙 发表于 2015-10-27 09:20
大家的WD都不报，这确实是奇怪的情况，能把"C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-x ...

驭龙

245867683 发表于 2015-10-27 12:27

感谢提供日志，通过日志看，你那里之所以杀，是因为DSS＝动态签名服务的云杀，而我们这些没有杀的是因为没有收到服务器的DSS，所以没有杀，很可能是因为后期服务器不在发送这个DSS，而你那里有本地的DSS，所以一直杀，当然也不排除我们的云有问题       
@wjy19800315              

2015-10-26T04:53:01.758Z Task(GetDeviceTicket -AccessKey E91A2D4A-11BB-6826-AB45-DCFF3AEE3721 -UserTicket) launched as logged in live user
2015-10-26T04:53:01.908Z Task(GetDeviceTicket -AccessKey F485BF1D-5B07-87CC-6808-4C2F999B5D0C ) launched as network service
Internal signature match:subtype=Persist, sigseq=0x00000555EB4D8C74, signame=#PERSIST_Arsen:PoorCertRep:ML2:Block, cached=false, resource="\\?\C:\Users\xxxx\Desktop\beefhfcija.7z->beefhfcija.exe"
Internal signature match:subtype=Lowfi, sigseq=0x00000555D857A53F, signame=#LowFiPEEXEHasIOAVURL, cached=false, resource="\\?\C:\Users\xxxx\Desktop\beefhfcija.7z->beefhfcija.exe"
Dynamic Signature has been received
Dynamic Signature Type:Signature Update
Signature Path:C:\ProgramData\Microsoft\Windows Defender\Scans\\RtSigs\Data\33af46131f8122b16228e633cfa83cc0c5e8184b
Dynamic Signature Compilation Timestamp:
2015-10-26T04:53:54.766Z Dynamic signature received
2015-10-26T04:53:54.826Z DETECTIONEVENT Trojan:Win32/Spursint.A containerfile:C:\Users\xxxx\Desktop\beefhfcija.7z;file:C:\Users\xxxx\Desktop\beefhfcija.7z->beefhfcija.exe;webfile:C:\ProgramData\Microsoft\Windows Defender\LocalCopy\{B9E7008A-2063-49A7-9EF9-BB870E479573}-beefhfcija.7z|https://att.kafan.cn/forum.php?mo ... DUxMDQ3OHwxODU5NjE2 360chrome.exe;webfile:C:\Users\xxxx\Desktop\beefhfcija.7z|https://att.kafan.cn/forum.php?mo ... DUxMDQ3OHwxODU5NjE2 360chrome.exe;
2015-10-26T04:53:54.826Z DETECTION_ADD Trojan:Win32/Spursint.A containerfile:C:\Users\xxxx\Desktop\beefhfcija.7z
2015-10-26T04:53:54.826Z DETECTION_ADD Trojan:Win32/Spursint.A file:C:\Users\xxxx\Desktop\beefhfcija.7z->beefhfcija.exe
2015-10-26T04:53:54.826Z DETECTION_ADD Trojan:Win32/Spursint.A webfile:C:\ProgramData\Microsoft\Windows Defender\LocalCopy\{B9E7008A-2063-49A7-9EF9-BB870E479573}-beefhfcija.7z|https://att.kafan.cn/forum.php?mo ... DUxMDQ3OHwxODU5NjE2 360chrome.exe
2015-10-26T04:53:54.826Z DETECTION_ADD Trojan:Win32/Spursint.A webfile:C:\Users\xxxx\Desktop\beefhfcija.7z|https://att.kafan.cn/forum.php?mo ... DUxMDQ3OHwxODU5NjE2 360chrome.exe
Begin Resource Scan
Scan ID:{B604E894-A4F6-4FA2-AC3E-C57E7E184D9E}
Scan Source:4
Start Time:10-25-2015 21:53:52
End Time:10-25-2015 21:53:54
Explicit resource to scan
Resource Schema:webfile
Resource Path:C:\Users\xxxx\Desktop\beefhfcija.7z|https://att.kafan.cn/forum.php?mo ... DUxMDQ3OHwxODU5NjE2 360chrome.exe
Result Count:1
Threat Name:Trojan:Win32/Spursint.A
ID:2147705703
Severity:5
Number of Resources:3

wjy19800315

驭龙 发表于 2015-10-27 13:16
感谢提供日志，通过日志看，你那里之所以杀，是因为DSS＝动态签名服务的云杀，而我们这些没有杀的是因为 ...

收到，谢谢
稍后rq恢复补上

愉欣

jianfuyindidi 发表于 2015-10-27 10:57
gdata阻止下载，管家不报

什么管家？是腾讯的么？

驭龙

wjy19800315 发表于 2015-10-27 13:20
收到，谢谢
稍后rq恢复补上

今天无意间重新测试一下，我这里收到DSS杀

尘梦幽然

伽蓝迹丶舞风 发表于 2015-10-25 20:36
诺顿扫描miss

以后这个家族应该都能检测一些了。