10x

Eset小粉絲

pkuyzy 发表于 2016-7-12 23:29
哎，BD应付新病毒总感觉差了一点

行的

Eset小粉絲

Avira 3X

[mw_shl_code=css,true]C:\Users\User\Downloads\Compressed\712\3a4dd19883086935ebadcfe6bccda692.exe
  [DETECTION] Is the TR/Dropper.Gen Trojan
C:\Users\User\Downloads\Compressed\712\51728e14e21f45aa92328c3b3c85e30f.exe
  [DETECTION] Is the TR/Dropper.Gen5 Trojan
C:\Users\User\Downloads\Compressed\712\78bd26a7b51d835b2c8796399cbfb1c3.exe
  [DETECTION] Is the TR/Crypt.Xpack.nska Trojan[/mw_shl_code]

关了实时后，MSE 2X     火绒 1X

km2002

费尔扫描4X  大蜘蛛扫描4X 小A扫描9X

km2002

cfhdrty 发表于 2016-7-12 23:27
4f69和78bd被锁了，但是不知为何没杀，小A实际应该检出了9个

我这启发开最高 敏感度开最高 开了增强 9个刚好  

230f4

pkuyzy 发表于 2016-7-12 23:29
哎，BD应付新病毒总感觉差了一点

云。。。云。。云。。。。。。。

好吧我也很无奈

没事有ATC，不过我真觉得BD也应该认真研发下静态启发式。

cfhdrty

km2002 发表于 2016-7-12 23:44
我这启发开最高 敏感度开最高 开了增强 9个刚好

我是默认的，也锁了文件，看来小A有点迷啊

aboringman

AVG：

扫描：kill 7 files；

"Trojan horse Generic_vb.MGA, c:\Users\Killer\Desktop\712\c2681c22dca018276932dc10fbf1631f.exe";"Secured";"2016/7/13, 0:09:55";"File or Directory";"d:\Haozip\HaoZip.exe"

"Trojan horse Generic_vb.MGB, c:\Users\Killer\Desktop\712\9499720ee52b12174208be425c5a2292.exe";"Secured";"2016/7/13, 0:09:55";"File or Directory";"d:\Haozip\HaoZip.exe"

"Trojan horse Generic_vb.MFT, c:\Users\Killer\Desktop\712\8e27c7bc031fc975994a4f2d311d739d.exe";"Secured";"2016/7/13, 0:09:55";"File or Directory";"d:\Haozip\HaoZip.exe"

"Trojan horse Generic37.CFVF, c:\Users\Killer\Desktop\712\78bd26a7b51d835b2c8796399cbfb1c3.exe";"Secured";"2016/7/13, 0:09:54";"File or Directory";"d:\Haozip\HaoZip.exe"

"Trojan horse Generic_vb.MFZ, c:\Users\Killer\Desktop\712\51728e14e21f45aa92328c3b3c85e30f.exe";"Secured";"2016/7/13, 0:09:54";"File or Directory";"d:\Haozip\HaoZip.exe"

"Trojan horse Generic_r.LEP, c:\Users\Killer\Desktop\712\3a4dd19883086935ebadcfe6bccda692.exe";"Secured";"2016/7/13, 0:09:53";"File or Directory";"d:\Haozip\HaoZip.exe"

"Trojan horse Generic_vb.MFY, c:\Users\Killer\Desktop\712\0c2c231c34943c773f79fcf83c2eda09.exe";"Secured";"2016/7/13, 0:09:53";"File or Directory";"d:\Haozip\HaoZip.exe"

双击：实机双击，IDP双杀余一。【剩下的那个报错退出，不知道是什么鬼】

"";"IDP.Program.D1B0A5C0, C:\Users\Killer\Desktop\712\4f695e13f72334a049f5056fb63222bc.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/7/13, 0:10:58"

"";", C:\Users\Killer\AppData\Roaming\{7BD6BFAF-095E-0C2D-1534-B9629ADB78CC}\charmap.exe";"Object was blocked";"Process";"2016/7/13, 0:10:58"

"";", C:\Windows\System32\cmd.exe";"Object was blocked";"Process";"2016/7/13, 0:10:58"

"";", C:\Windows\System32\taskkill.exe";"Object was blocked";"Process";"2016/7/13, 0:10:58"

"";", C:\Windows\System32\PING.EXE";"Object was blocked";"Process";"2016/7/13, 0:10:58"

"";", C:\Users\Killer\AppData\Roaming\{7BD6BFAF-095E-0C2D-1534-B9629ADB78CC}\charmap.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/7/13, 0:10:58"

"";", C:\Users\Killer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\charmap.lnk";"Healed, Moved to Virus Vault";"File or Directory";"2016/7/13, 0:10:58"

"";", C:\Users\Killer\Desktop\712\4f695e13f72334a049f5056fb63222bc.exe";"Object was blocked";"Process";"2016/7/13, 0:10:58"

"";", HKEY_USERS\S-1-5-21-3481082169-311058013-23538480-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\CHARMAP";"Deleted, Moved to Virus Vault";"Registry value";"2016/7/13, 0:10:58"

"";", HKEY_USERS\S-1-5-21-3481082169-311058013-23538480-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\\CHARMAP";"Deleted, Moved to Virus Vault";"Registry value";"2016/7/13, 0:10:58"

"";", HKEY_USERS\S-1-5-21-3481082169-311058013-23538480-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER";"Deleted, Moved to Virus Vault";"Registry key";"2016/7/13, 0:10:58"

"";", HKEY_USERS\S-1-5-21-3481082169-311058013-23538480-1000\SOFTWARE\MICROSOFT\COMMAND PROCESSOR\\AUTORUN";"Deleted, Moved to Virus Vault";"Registry value";"2016/7/13, 0:10:58"

"";", HKEY_USERS\S-1-5-21-3481082169-311058013-23538480-1000\CONTROL PANEL\DESKTOP\\SCRNSAVE.EXE";"Deleted, Moved to Virus Vault";"Registry value";"2016/7/13, 0:10:58"





"";"IDP.Trojan.E13F31C, C:\Users\Killer\Desktop\712\620fd2666f81e4a161932700756415f8.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/7/13, 0:11:30"

"";", C:\Users\Killer\Desktop\712\620fd2666f81e4a161932700756415f8.exe";"Object was blocked";"Process";"2016/7/13, 0:11:30"

剩余样本：

km2002

cfhdrty 发表于 2016-7-13 00:10
我是默认的，也锁了文件，看来小A有点迷啊

我扫的时候是都有弹窗 会不会是弹窗没响应 但是小A还是有发现病毒 所以正常阻止了