MSIL:Bladabindi-CI

猥琐大叔

BFAX

火绒:

ELOHIM

解压失败，
微软干掉。

ELOHIM

解压失败，
微软干掉。

学雷锋做人

Microsoftheihei

发重了，编辑掉

1446547521

诺顿云抽风，扫描，声纳，下载分析均无反应

nick20010117

FS断网双击

xiaoxiaode1994

AVG        Could be a Trojan horse ILCrypt        2016-02-15
腾讯（Tencent）        Win32.Trojan.Generic.Lhxf        2016-02-15
Avast        MSIL:Agent-CIB        2016-02-15
瑞星（Rising）        PE:Backdoor.Bot!1.6675        2016-02-15
IKARUS        Trojan.ILCrypt        2016-02-15
GDATA        Gen:Heur.MSIL.Krypt.2        2016-02-15
微软（MSE）        Backdoor:MSIL/Bladabindi.AL        2016-02-15
小红伞（Avira）        TR/Dropper.Gen        2016-02-15
ESET        a variant of MSIL/Bladabindi.AZ trojan        2016-02-15

https://virusbook.cn/report/scan ... 6564d-1455519520468

aboringman

virhunter，病毒猎手，呵呵

AVG：

扫描：killed（by WP）；

"";"Could be a Trojan horse ILCrypt, https://att.kafan.cn/forum.php?mod=attachment&aid=Mjc1NjE5NXwxM2VkY2NiYXwxNDU1NTIxNzY2fDEwMDA1MDF8MTk2MzAwNw%3D%3D";"Object was blocked";"URL";"2016/2/15, 15:36:09"

"";"Could be a Trojan horse ILCrypt, https://att.kafan.cn/forum.php?mod=attachment&aid=Mjc1NjE5NXwxM2VkY2NiYXwxNDU1NTIxNzY2fDEwMDA1MDF8MTk2MzAwNw%3D%3D:\virhunter.exe";"Unresolved";"Embedded element in the archive, email attachment, cookie etc.";"2016/2/15, 15:36:09"

双击：关闭监控，实机双击，IDP击杀之（Unknown报法再现）。

"";"Unknown, C:\Users\killer\AppData\Local\Temp\taskmgr.exe";"Healed, Moved to Virus Vault";"File or Directory";"2016/2/15, 15:39:16"
"";", C:\Users\killer\Desktop\virhunter.exe";"Object was blocked";"Process";"2016/2/15, 15:39:16"
"";", C:\Users\killer\Desktop\virhunter.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/2/15, 15:39:16"
"";", HKEY_USERS\S-1-5-21-540828005-2055914412-3868506426-1000\SOFTWARE\927023F818E6CE8EF3CCB347194B0A7E";"Deleted, Moved to Virus Vault";"Registry key";"2016/2/15, 15:39:16"
"";", C:\Users\killer\AppData\Local\Temp\taskmgr.exe";"Object was blocked";"Process";"2016/2/15, 15:39:16"