精睿样本测试（16.7.7）

显示全部楼层 · 发表于 2016-7-7 09:55:27

NS kill 11x

[mw_shl_code=css,true]已解决的威胁:
W32.Neshuta
类型: 异常
风险: 高 (高隐藏, 高删除, 高性能, 高隐私)
类别: 病毒
状态: 完全解决
-----------
1 个受感染文件
c:\users\lzh62\downloads\2016.7.7\20.vir - 已删除
1 个浏览器缓存

Backdoor.Graybird
类型: 异常
风险: 高 (高隐藏, 高删除, 高性能, 高隐私)
类别: 病毒
状态: 需要重新启动
-----------
16 个注册表项
HKEY_USERS\S-1-5-21-2085570801-3891203369-793262110-1001\Software\Microsoft\Windows\CurrentVersion\Policies\System->DisableRegistryTools:0 - 已修复
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\->UpdatesDisableNotify:0 - 已修复
HKEY_USERS\S-1-5-21-2085570801-3891203369-793262110-1001\Software\Microsoft\Windows\CurrentVersion\Policies\System\->DisableTaskMgr:0 - 已修复
HKEY_USERS\S-1-5-21-2085570801-3891203369-793262110-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\->ShowSuperHidden:1 - 已修复
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\->ShowSuperHidden:1 - 已修复
HKEY_USERS\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\->ShowSuperHidden:1 - 已修复
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\->ShowSuperHidden:1 - 已修复
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\->ShowSuperHidden:1 - 已修复
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\->AntiVirusDisableNotify:0 - 已修复
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\->Start:2 - 已修复
HKEY_USERS\S-1-5-21-2085570801-3891203369-793262110-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\->NofolderOptions:0 - 已修复
HKEY_USERS\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\->NofolderOptions:0 - 已修复
HKEY_USERS\S-1-5-21-2085570801-3891203369-793262110-1001\Software\Microsoft\Internet Explorer\New Windows\->PopupMgr:yes - 已修复
HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\New Windows\->PopupMgr:yes - 已修复
HKEY_USERS\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\Software\Microsoft\Internet Explorer\New Windows\->PopupMgr:yes - 已修复
HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\New Windows\->PopupMgr:yes - 已修复
2 个文件
C:\Users\lzh62\AppData\Local\virtualstore\windows\syswow64\installed.dat - 需要重新启动
C:\Windows\SysWOW64\Installed.dat - 需要重新启动
1 个受感染文件
c:\users\lzh62\downloads\2016.7.7\17.vir - 已删除
1 个浏览器缓存

1 个系统操作

Trojan.Gen
类型: 异常
风险: 高 (高隐藏, 高删除, 高性能, 高隐私)
类别: 病毒
状态: 完全解决
-----------
1 个受感染文件
c:\users\lzh62\downloads\2016.7.7\08.vir - 已删除
1 个浏览器缓存

Heur.AdvML.B
类型: 异常
风险: 高 (高隐藏, 高删除, 高性能, 高隐私)
类别: 启发式病毒
状态: 完全解决
-----------
1 个受感染文件
c:\users\lzh62\downloads\2016.7.7\28.vir - 已删除
1 个浏览器缓存

SAPE.Heur.812D0
类型: 异常
风险: 高 (高隐藏, 高删除, 高性能, 高隐私)
类别: 启发式病毒
状态: 完全解决
-----------
1 个受感染文件
c:\users\lzh62\downloads\2016.7.7\40.vir - 已删除
1 个浏览器缓存

W32.Extrat
类型: 异常
风险: 高 (高隐藏, 高删除, 高性能, 高隐私)
类别: 病毒
状态: 完全解决
-----------
18 个注册表项
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\->Load - 已修复
HKEY_USERS\S-1-5-21-2085570801-3891203369-793262110-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\->Hidden:1 - 已修复
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\->Hidden:1 - 已修复
HKEY_USERS\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\->Hidden:1 - 已修复
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\->Hidden:1 - 已修复
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\->Hidden:1 - 已修复
HKEY_USERS\S-1-5-21-2085570801-3891203369-793262110-1001\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\->Shell:Explorer.exe - 已修复
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\->Shell:Explorer.exe - 已修复
HKEY_USERS\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\->Shell:Explorer.exe - 已修复
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\->Shell:Explorer.exe - 已修复
HKEY_USERS\S-1-5-21-2085570801-3891203369-793262110-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced->ShowSuperHidden:1 - 已修复
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced->ShowSuperHidden:1 - 已修复
HKEY_USERS\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced->ShowSuperHidden:1 - 已修复
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced->ShowSuperHidden:1 - 已修复
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced->ShowSuperHidden:1 - 已修复
HKEY_USERS\S-1-5-21-2085570801-3891203369-793262110-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\->NofolderOptions:0 - 已修复
HKEY_USERS\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\->NofolderOptions:0 - 已修复
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\->Shell:Explorer.exe - 已修复
1 个受感染文件
c:\users\lzh62\downloads\2016.7.7\29.vir - 已删除
1 个浏览器缓存

Trojan.Gen.2
类型: 异常
风险: 高 (高隐藏, 高删除, 高性能, 高隐私)
类别: 病毒
状态: 完全解决
-----------
1 个受感染文件
c:\users\lzh62\downloads\2016.7.7\39.vir - 已删除
1 个浏览器缓存

Trojan Horse
类型: 异常
风险: 高 (高隐藏, 高删除, 高性能, 高隐私)
类别: 病毒
状态: 完全解决
-----------
1 个受感染文件
c:\users\lzh62\downloads\2016.7.7\13.vir - 已删除
1 个浏览器缓存

JS.Downloader
类型: 异常
风险: 高 (高隐藏, 高删除, 高性能, 高隐私)
类别: 病毒
状态: 完全解决
-----------
2 个受感染文件
c:\users\lzh62\downloads\2016.7.7\33.vir - 已删除
c:\users\lzh62\downloads\2016.7.7\23.vir - 已删除
1 个浏览器缓存

Heur.AdvML.B
类型: 异常
风险: 高 (高隐藏, 高删除, 高性能, 高隐私)
类别: 启发式病毒
状态: 完全解决
-----------
1 个受感染文件
c:\users\lzh62\downloads\2016.7.7\47.vir - 已删除
1 个浏览器缓存[/mw_shl_code]

显示全部楼层 · 发表于 2016-7-7 09:56:10

EIS  33X
[mw_shl_code=css,true]Emsisoft Internet Security - Version 11.9.0.6513
Last update: 2016/7/7 9:50:04
Initiated by: 养一座城疼一个名字的回声
Computer name: 养一座城疼一个名字的回声
OS version: Windows 10x64

Scan settings:

Scan type:
Objects: C:\Users\pc\Desktop\2016.7.7

Detect PUPs: On
Scan archives: On
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off

Scan start: 2016/7/7 9:52:37
C:\Users\pc\Desktop\2016.7.7\08.vir    Trojan.Generic.15885455 (B)
C:\Users\pc\Desktop\2016.7.7\07.vir -> word/vbaProject.bin    W97M.Downloader.DSB (B)
C:\Users\pc\Desktop\2016.7.7\10.vir    Trojan.JS.Downloader.DNX (B)
C:\Users\pc\Desktop\2016.7.7\02.vir -> word/vbaProject.bin    W97M.Downloader.DSB (B)
C:\Users\pc\Desktop\2016.7.7\05.vir    Trojan.GenericKD.3377823 (B)
C:\Users\pc\Desktop\2016.7.7\04.vir    Trojan.GenericKD.3375519 (B)
C:\Users\pc\Desktop\2016.7.7\12.vir    Trojan.GenericKD.3379266 (B)
C:\Users\pc\Desktop\2016.7.7\20.vir -> (REMOVED_NULLS) -> (objdata) -> (Embedded EXE g)    Trojan.Generic.15741110 (B)
C:\Users\pc\Desktop\2016.7.7\16.vir    W97M.Downloader.DLZ (B)
C:\Users\pc\Desktop\2016.7.7\15.vir    W97M.Downloader.DRS (B)
C:\Users\pc\Desktop\2016.7.7\13.vir    Gen:Variant.Razy.76027 (B)
C:\Users\pc\Desktop\2016.7.7\20.vir -> (REMOVED_NULLS) -> (objdata) -> (Package)    Trojan.Generic.15741110 (B)
C:\Users\pc\Desktop\2016.7.7\20.vir -> (objdata) -> (Embedded EXE g)    Trojan.Generic.15741110 (B)
C:\Users\pc\Desktop\2016.7.7\20.vir -> (objdata) -> (Package)    Trojan.Generic.15741110 (B)
C:\Users\pc\Desktop\2016.7.7\23.vir    Trojan.GenericKD.3380075 (B)
C:\Users\pc\Desktop\2016.7.7\24.vir -> word/vbaProject.bin    W97M.Downloader.DSB (B)
C:\Users\pc\Desktop\2016.7.7\27.vir    W97M.Downloader.DRN (B)
C:\Users\pc\Desktop\2016.7.7\32.vir    Trojan.GenericKD.3380424 (B)
C:\Users\pc\Desktop\2016.7.7\29.vir    Trojan.GenericKD.3380051 (B)
C:\Users\pc\Desktop\2016.7.7\37.vir    Trojan.GenericKD.3359971 (B)
C:\Users\pc\Desktop\2016.7.7\35.vir -> word/vbaProject.bin    W97M.Downloader.DSB (B)
C:\Users\pc\Desktop\2016.7.7\33.vir -> (INFECTED_JS)    JS:Trojan.JS.Downloader.FE (B)
C:\Users\pc\Desktop\2016.7.7\42.vir    Trojan.GenericKD.3380059 (B)
C:\Users\pc\Desktop\2016.7.7\40.vir    Trojan.GenericKD.3381538 (B)
C:\Users\pc\Desktop\2016.7.7\41.vir -> word/vbaProject.bin    W97M.Downloader.DSB (B)
C:\Users\pc\Desktop\2016.7.7\46.vir -> word/vbaProject.bin    W97M.Downloader.DSB (B)
C:\Users\pc\Desktop\2016.7.7\47.vir    Gen:Variant.Symmi.66036 (B)
C:\Users\pc\Desktop\2016.7.7\45.vir -> word/vbaProject.bin    W97M.Downloader.DSB (B)
C:\Users\pc\Desktop\2016.7.7\39.vir    Dropped:Application.Generic.1643718 (B)
C:\Users\pc\Desktop\2016.7.7\44.vir -> (JAVASCRIPT 1)    Trojan.JS.Agent.MFH (B)
C:\Users\pc\Desktop\2016.7.7\48.vir -> word/vbaProject.bin    W97M.Downloader.DSB (B)
C:\Users\pc\Desktop\2016.7.7\49.vir    Trojan.GenericKD.3323355 (B)
C:\Users\pc\Desktop\2016.7.7\50.vir    Gen:Variant.Strictor.87967 (B)

Scanned 50
Found 33

Scan end: 2016/7/7 9:52:39
Scan time: 0:00:02[/mw_shl_code]

显示全部楼层 · 发表于 2016-7-7 10:09:26

本帖最后由 Microsoftheihei 于 2016-7-7 10:11 编辑

fsp
剩余双击
word文档全是死毒
DGkill all exe
js被修复 html的衍生物被击杀

最终计算机无异常，所有活毒全被击杀

显示全部楼层 · 发表于 2016-7-7 10:13:41

修正后缀名后360 35X（含修复），除了16号样本和20号样本（RTF格式）没有修复（无法检出），其余感染宏病毒的word文档全部修复！

显示全部楼层 · 发表于 2016-7-7 10:39:21

腾讯管家33X
不得不说腾讯国际版用的BD库真是太新.....

显示全部楼层 · 发表于 2016-7-7 11:13:36

本帖最后由霄栋于 2016-7-7 17:19 编辑

CIS 8.4 : 4X

放假了，接着搞速智

江民：检出 0

显示全部楼层 · 发表于 2016-7-7 11:19:37

金山毒霸11 ：15

显示全部楼层 · 发表于 2016-7-7 11:25:29

费尔1X

未双击

显示全部楼层 · 发表于 2016-7-7 11:34:12

Avira 25X

[mw_shl_code=css,true]Start of the scan: Thursday, 7 July, 2016  11:23

Starting the file scan:

Begin scan in 'C:\Users\User\Desktop\2016.7.7'
C:\Users\User\Desktop\2016.7.7\02.vir
[0] Archive type: ZIP
--> word/vbaProject.bin
      [DETECTION] Contains code of the W2000M/Agent.79160 macro virus
      [WARNING] Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.7\04.vir
  [DETECTION] Is the TR/Dropper.MSIL.ggzz Trojan
C:\Users\User\Desktop\2016.7.7\05.vir
  [DETECTION] Is the TR/Dropper.MSIL.vpwf Trojan
C:\Users\User\Desktop\2016.7.7\07.vir
[0] Archive type: ZIP
--> word/vbaProject.bin
      [DETECTION] Contains code of the W2000M/Agent.79160 macro virus
      [WARNING] Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.7\08.vir
  [DETECTION] Is the TR/Dropper.Gen Trojan
C:\Users\User\Desktop\2016.7.7\12.vir
  [DETECTION] Is the TR/Crypt.Xpack.ywdq Trojan
C:\Users\User\Desktop\2016.7.7\13.vir
  [DETECTION] Is the TR/AD.Locky.Y.qgwt Trojan
C:\Users\User\Desktop\2016.7.7\14.vir
  [DETECTION] Contains recognition pattern of the HTML/ADODB.Exploit.Gen HTML script virus
C:\Users\User\Desktop\2016.7.7\15.vir
  [DETECTION] Contains code of the W2000M/Agent.58141 macro virus
C:\Users\User\Desktop\2016.7.7\16.vir
  [DETECTION] Contains code of the W2000M/Agent.163839 macro virus
C:\Users\User\Desktop\2016.7.7\20.vir
  [DETECTION] Contains code of the W32/Neshta.A Windows virus
C:\Users\User\Desktop\2016.7.7\24.vir
[0] Archive type: ZIP
--> word/vbaProject.bin
      [DETECTION] Contains code of the W2000M/Agent.79160 macro virus
      [WARNING] Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.7\28.vir
  [DETECTION] Contains virus patterns of Adware ADWARE/DealPly.fcns
C:\Users\User\Desktop\2016.7.7\29.vir
  [DETECTION] Is the TR/Dropper.VB.wtfr Trojan
C:\Users\User\Desktop\2016.7.7\35.vir
[0] Archive type: ZIP
--> word/vbaProject.bin
      [DETECTION] Contains code of the W2000M/Agent.79160 macro virus
      [WARNING] Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.7\37.vir
  [DETECTION] Is the TR/Crypt.ZPACK.ehoz Trojan
C:\Users\User\Desktop\2016.7.7\41.vir
[0] Archive type: ZIP
--> word/vbaProject.bin
      [DETECTION] Contains code of the W2000M/Agent.79160 macro virus
      [WARNING] Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.7\42.vir
  [DETECTION] Is the TR/Crypt.Xpack.fwkl Trojan
C:\Users\User\Desktop\2016.7.7\45.vir
[0] Archive type: ZIP
--> word/vbaProject.bin
      [DETECTION] Contains code of the W2000M/Agent.79160 macro virus
      [WARNING] Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.7\46.vir
[0] Archive type: ZIP
--> word/vbaProject.bin
      [DETECTION] Contains code of the W2000M/Agent.79160 macro virus
      [WARNING] Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.7\47.vir
  [DETECTION] Is the TR/Dropper.VB.pcyf Trojan
C:\Users\User\Desktop\2016.7.7\48.vir
[0] Archive type: ZIP
--> word/vbaProject.bin
      [DETECTION] Contains code of the W2000M/Agent.79160 macro virus
      [WARNING] Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.7\50.vir
  [DETECTION] Contains recognition pattern of the DR/Delphi.Gen dropper
C:\Users\User\Desktop\2016.7.7\10.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\User\Desktop\2016.7.7\33.vir
  [DETECTION] Contains recognition pattern of the JS/Dldr.Locky.LQ Java script virus[/mw_shl_code]

显示全部楼层 · 发表于 2016-7-7 11:38:31

360_HBM 发表于 2016-7-7 10:13
修正后缀名后360 35X（含修复），除了16号样本和20号样本（RTF格式）没有修复（无法检出），其余感染宏病毒 ...

有開BD Avira嗎？

[病毒样本] 精睿样本测试（16.7.7）

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源