精睿样本测试（16.7.25）

轩夏

地址：

https://pan.baidu.com/s/1mhBq3ag  提取密码  u2yg

密码：bbs.vc52.cn
数量：50

Eset小粉絲

Avira 33X

[mw_shl_code=css,true]Starting the file scan:

Begin scan in 'C:\Users\User\Desktop\2016.7.25'
C:\Users\User\Desktop\2016.7.25\01.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Dldr.Agent.dfgh macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.25\02.vir
  [DETECTION] Is the TR/Crypt.ZPACK.ltvd Trojan
C:\Users\User\Desktop\2016.7.25\03.vir
  [DETECTION] Is the TR/PSW.Siggen.84480 Trojan
C:\Users\User\Desktop\2016.7.25\04.vir
  [DETECTION] Contains code of the W2000M/Agent.3957665 macro virus
C:\Users\User\Desktop\2016.7.25\05.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Dldr.Agent.dfgh macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.25\06.vir
  [DETECTION] Is the TR/Agent.kzez Trojan
C:\Users\User\Desktop\2016.7.25\08.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\User\Desktop\2016.7.25\09.vir
  [DETECTION] Contains code of the ANDROID/SMSSpy.AR.Gen virus
C:\Users\User\Desktop\2016.7.25\10.vir
  [DETECTION] Is the TR/ATRAPS.A.8328 Trojan
C:\Users\User\Desktop\2016.7.25\14.vir
  [DETECTION] Is the TR/Crypt.Xpack.qgbk Trojan
C:\Users\User\Desktop\2016.7.25\15.vir
  [DETECTION] Contains recognition pattern of the EXP/CVE-2010-3333 exploit
C:\Users\User\Desktop\2016.7.25\16.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Dldr.Agent.dhk macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.25\17.vir
  [DETECTION] Contains code of the X2000M/Agent.659727 Excel macro virus
C:\Users\User\Desktop\2016.7.25\18.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Dldr.Agent.dhk macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.25\20.vir
    [0] Archive type: ZIP
    --> r.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.sds Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> h.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.SDS.2 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> v.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.SDS.1 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> n.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.gline.1134 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> t.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.gline.1131 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> f.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.SDS.3 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kap.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.gline.1135 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> i.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.gline.1138 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> o.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.44163 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> s.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.gline.1133 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> j.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.gline.1137 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> k.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.gline.1136 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> w.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.gline.1130 Java virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.25\21.vir
  [DETECTION] Is the TR/Dropper.MSIL.aepz Trojan
C:\Users\User\Desktop\2016.7.25\22.vir
  [DETECTION] Is the TR/Dropper.Gen Trojan
C:\Users\User\Desktop\2016.7.25\26.vir
  [DETECTION] Is the TR/Dropper.VB.vayn Trojan
C:\Users\User\Desktop\2016.7.25\27.vir
  [DETECTION] Is the TR/Dropper.MSIL.yfqm Trojan
C:\Users\User\Desktop\2016.7.25\28.vir
  [DETECTION] Contains recognition pattern of the EXP/FLASH.Pubenush.S.Gen exploit
C:\Users\User\Desktop\2016.7.25\29.vir
  [DETECTION] Contains recognition pattern of the JS/Dldr.Locky.icir Java script virus
C:\Users\User\Desktop\2016.7.25\30.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\User\Desktop\2016.7.25\31.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Dldr.Agent.AM.45050 macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.25\32.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Dldr.Agent.AM.32150 macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.25\33.vir
  [DETECTION] Contains code of the W2000M/Agent.9391551 macro virus
C:\Users\User\Desktop\2016.7.25\35.vir
  [DETECTION] Contains recognition pattern of the VBS/Dldr.Nemucod.AM VBS script virus
C:\Users\User\Desktop\2016.7.25\36.vir
  [DETECTION] Contains recognition pattern of the VBS/Dldr.Nemucod.AM VBS script virus
C:\Users\User\Desktop\2016.7.25\38.vir
    [0] Archive type: RAR SFX (self extracting)
    --> a.exe
        [DETECTION] Is the TR/ATRAPS.Gen Trojan
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.25\39.vir
    [0] Archive type: NSIS
    --> ProgramFilesDir/servicew.exe
        [DETECTION] Is the TR/Crypt.ZPACK.vhsn Trojan
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.25\41.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\User\Desktop\2016.7.25\43.vir
    [0] Archive type: ZIP
    --> 587088pm.scr
        [DETECTION] Is the TR/Dropper.MSIL.Gen4 Trojan
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.25\44.vir
  [DETECTION] Is the TR/Dropper.VB.wndt Trojan
C:\Users\User\Desktop\2016.7.25\46.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus[/mw_shl_code]

轩夏

MSE

[mw_shl_code=css,true]Scan started on Mon Jul 25 09:24:20 2016

C:\Users\XuanXia\Desktop\2016.7.25\01.vir->word/vbaProject.bin         Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.7.25\02.vir                              Infected: Worm:Win32/Gamarue
C:\Users\XuanXia\Desktop\2016.7.25\03.vir                              Infected: Worm:Win32/Gamarue.AU
C:\Users\XuanXia\Desktop\2016.7.25\04.vir                              Infected: Trojan:O97M/Madeba.A!det
C:\Users\XuanXia\Desktop\2016.7.25\05.vir->word/vbaProject.bin         Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.7.25\07.vir                              Infected: Ransom:Win32/Teerac.B!bit
C:\Users\XuanXia\Desktop\2016.7.25\08.vir->[WsfCmtOut]->(SCRIPT0001)   Infected: TrojanDownloader:JS/Nemucod.FJ [non_writable_container]
C:\Users\XuanXia\Desktop\2016.7.25\16.vir->word/vbaProject.bin         Infected: TrojanDownloader:O97M/Donoff.BY
C:\Users\XuanXia\Desktop\2016.7.25\17.vir                              Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.7.25\18.vir->word/vbaProject.bin         Infected: TrojanDownloader:O97M/Donoff.BY
C:\Users\XuanXia\Desktop\2016.7.25\19.vir->[Eval]                      Infected: TrojanDownloader:JS/Nemucod.GG [non_writable_container]
C:\Users\XuanXia\Desktop\2016.7.25\19.vir->[FunctionPacked]            Infected: TrojanDownloader:JS/Nemucod.GG [non_writable_container]
C:\Users\XuanXia\Desktop\2016.7.25\20.vir->v.class                     Infected: Trojan:Java/Adwind.P
C:\Users\XuanXia\Desktop\2016.7.25\20.vir->o.class                     Infected: Trojan:Java/Adwind.P
C:\Users\XuanXia\Desktop\2016.7.25\21.vir                              Infected: Trojan:Win32/Lamooc.A
C:\Users\XuanXia\Desktop\2016.7.25\22.vir                              Infected: PWS:MSIL/Mintluks.A
C:\Users\XuanXia\Desktop\2016.7.25\24.vir                              Infected: Trojan:Win32/Pdfphish.AF
C:\Users\XuanXia\Desktop\2016.7.25\27.vir                              Infected: HackTool:MSIL/Boilod.B
C:\Users\XuanXia\Desktop\2016.7.25\29.vir                              Infected: TrojanDownloader:JS/Nemucod.FJ
C:\Users\XuanXia\Desktop\2016.7.25\30.vir->[WsfCmtOut]->(SCRIPT0001)   Infected: TrojanDownloader:JS/Nemucod.FJ [non_writable_container]
C:\Users\XuanXia\Desktop\2016.7.25\31.vir->word/vbaProject.bin         Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.7.25\33.vir                              Infected: Trojan:O97M/Madeba.A!det
C:\Users\XuanXia\Desktop\2016.7.25\34.vir                              Infected: Trojan:O97M/Madeba.A!det
C:\Users\XuanXia\Desktop\2016.7.25\35.vir                              Infected: TrojanDownloader:JS/Nemucod.FJ
C:\Users\XuanXia\Desktop\2016.7.25\36.vir                              Infected: TrojanDownloader:JS/Nemucod.FJ
C:\Users\XuanXia\Desktop\2016.7.25\37.vir                              Infected: Ransom:Win32/Cerber.A
C:\Users\XuanXia\Desktop\2016.7.25\38.vir                              Infected: Backdoor:MSIL/Bladabindi.AJ
C:\Users\XuanXia\Desktop\2016.7.25\39.vir                              Infected: Trojan:Win32/Skeeyah.A!rfn
C:\Users\XuanXia\Desktop\2016.7.25\39.vir->(nsis-5-servicew.exe)       Infected: Trojan:Win32/Docidor.A [non_writable_container]
C:\Users\XuanXia\Desktop\2016.7.25\41.vir->[WsfCmtOut]->(SCRIPT0001)   Infected: TrojanDownloader:JS/Nemucod.FJ [non_writable_container]
C:\Users\XuanXia\Desktop\2016.7.25\43.vir->587088pm.scr                Infected: Trojan:MSIL/Nagoot
C:\Users\XuanXia\Desktop\2016.7.25\46.vir                              Infected: TrojanDownloader:JS/Nemucod
C:\Users\XuanXia\Desktop\2016.7.25\47.vir                              Infected: Trojan:Win32/Kovter
Successfully checked: C:\Users\XuanXia\Desktop\2016.7.25

Scan ended on Mon Jul 25 09:24:38 2016

Time: 18 second(s). [0h:00m:18s]
Files/second: 14 (908 Kb/s).
Objects scanned: 256.
Infected: 33. Suspicious: 0. Clean: 223. Different virus bodies: 20.
Files: 88. Directories: 1. Archives: 24. Packed: 10. Mail files: 2.
Warnings: 33. Scan errors: 0. Protected: 0. Damaged: 0. Unknown method: 0. Spanned: 0.[/mw_shl_code]

蓝天二号

卡巴斯基

欧阳宣

管家国际版检测34，修复3个
[mw_shl_code=css,true]2016-7-25 09:48:51 MD5:877b6f8d14a483385ae902a746841bb3 D:\Virus\2016.7.25\41.vir [Trojan.JS.Agent.MHR]  [Delete success]
2016-7-25 09:48:51 MD5:bed78fec0824601c636d8e3152c875b7 D:\Virus\2016.7.25\49.vir [Trojan.Agent.BWFU]  [Delete success]
2016-7-25 09:48:51 MD5:80a84fa40711ea7addabcad608d1d6c4 D:\Virus\2016.7.25\29.vir [Trojan.JS.Downloader.DPW]  [Delete success]
2016-7-25 09:48:51 MD5:0929230644a301857bac09379257883a D:\Virus\2016.7.25\10.vir [Trojan.GenericKD.3384867]  [Delete success]
2016-7-25 09:48:51 MD5:40f40e7d6e4088c60115987f3d089bcb D:\Virus\2016.7.25\16.vir [Trojan.Msword.NWF]  [Delete success]
2016-7-25 09:48:51 MD5:37bf789bb9ff0ed80f4755f0af83d7d9 D:\Virus\2016.7.25\36.vir [Trojan.JS.Downloader.DPK]  [Delete success]
2016-7-25 09:48:51 MD5:775cd7b2f75d4b74a159f8a0874cf6d5 D:\Virus\2016.7.25\02.vir [Trojan.GenericKD.3422535]  [Delete success]
2016-7-25 09:48:51 MD5:3f93244d383279d750f848fbe61b7e24 D:\Virus\2016.7.25\20.vir [Trojan.GenericKD.3400843]  [Delete success]
2016-7-25 09:48:51 MD5:08fd392ed1d20bcee32149b43044f40e D:\Virus\2016.7.25\05.vir [Trojan.Doc.Downloader.NO]  [Delete success]
2016-7-25 09:48:52 MD5:7f98476c5ed42f958c4464fb58516036 D:\Virus\2016.7.25\38.vir [Trojan.GenericKD.3119003]  [Delete success]
2016-7-25 09:48:52 MD5:15d44917245968f2ac9aa10456ea6f41 D:\Virus\2016.7.25\21.vir [Gen:Variant.Razy.79145]  [Delete success]
2016-7-25 09:48:52 MD5:d6b2e1b4c0496e6f586a16372eb0fdc5 D:\Virus\2016.7.25\06.vir [Gen:Variant.Graftor.269175]  [Delete success]
2016-7-25 09:48:52 MD5:ec077bee243a9364e317a5f6f015c0c7 D:\Virus\2016.7.25\35.vir [Trojan.JS.Downloader.DPK]  [Delete success]
2016-7-25 09:48:52 MD5:80c90b224fb9fd9d058f75a2b1aaf25f D:\Virus\2016.7.25\03.vir [Trojan.GenericKD.3417845]  [Delete success]
2016-7-25 09:48:52 MD5:98a939787fb99baa73f7f57a0abce3b9 D:\Virus\2016.7.25\18.vir [Trojan.Msword.NWE]  [Delete success]
2016-7-25 09:48:52 MD5:55b3a6611e33b7a349f8218995772339 D:\Virus\2016.7.25\47.vir [Gen:Variant.Graftor.294466]  [Delete success]
2016-7-25 09:48:52 MD5:b5acc06b5dd7316f38234e049fcd515f D:\Virus\2016.7.25\39.vir [Trojan.Generic.17813203]  [Delete success]
2016-7-25 09:48:52 MD5:cf449e4af0e98ed5dd574840d8ae0bac D:\Virus\2016.7.25\25.vir [Gen:Variant.Razy.77185]  [Delete success]
2016-7-25 09:48:53 MD5:7c2cf90407e5b89adb2f58010cb5cfc4 D:\Virus\2016.7.25\09.vir --> mailcap [Android.Trojan.AutoSMS.PG]  [Delete success]
2016-7-25 09:48:53 MD5:ea217c5f805ccc39fd946e231a029eb2 D:\Virus\2016.7.25\33.vir [W97M.Downloader.DVD]  [Clean success]
2016-7-25 09:48:53 MD5:5811b4f2188d27dae0393a9fd160b972 D:\Virus\2016.7.25\04.vir [W97M.Downloader.DVB]  [Clean success]
2016-7-25 09:48:53 MD5:0a8411a68b93e2424ba865049900a30e D:\Virus\2016.7.25\17.vir [W97M.Downloader.DXG]  [Clean success]
2016-7-25 09:48:53 MD5:bf508e8744fb7a89c588eaf91ff96a6a D:\Virus\2016.7.25\37.vir [Trojan.GenericKD.3418606]  [Delete success]
2016-7-25 09:48:53 MD5:3bcd71f3722c50b3a31771b3884f0dd7 D:\Virus\2016.7.25\42.vir [Trojan.Generic.16977284]  [Delete success]
2016-7-25 09:48:53 MD5:08edccad8394ddf54531e30afc034746 D:\Virus\2016.7.25\26.vir [Trojan.Generic.17797500]  [Delete success]
2016-7-25 09:48:53 MD5:216dedeb0d9f7680a3de65f7887dcac6 D:\Virus\2016.7.25\08.vir [Trojan.JS.Agent.MHR]  [Delete success]
2016-7-25 09:48:53 MD5:63eb8d9362074d24d52a3bc6db98ea7c D:\Virus\2016.7.25\31.vir --> word/vbaProject.bin [W97M.Downloader.DUT]  [Delete success]
2016-7-25 09:48:54 MD5:0f1d7407e9e3fe3aa68e5b53f53870af D:\Virus\2016.7.25\01.vir [Trojan.Doc.Downloader.NN]  [Delete success]
2016-7-25 09:48:54 MD5:6bb174882abd641b27c840570f6cbb71 D:\Virus\2016.7.25\22.vir [Gen:Variant.Kazy.342013]  [Delete success]
2016-7-25 09:48:54 MD5:66570af335a3553403374643dc33fded D:\Virus\2016.7.25\44.vir [Trojan.GenericKD.3418540]  [Delete success]
2016-7-25 09:48:54 MD5:8a727b8dd9e5230caf0d4e1058ee6d02 D:\Virus\2016.7.25\27.vir [Trojan.Generic.17427354]  [Delete success]
2016-7-25 09:48:54 MD5:104f42786e18225bbb2926679ce0f657 D:\Virus\2016.7.25\30.vir [Trojan.Agent.BWFN]  [Delete success]
2016-7-25 09:48:54 MD5:1ea4c086a8b42d2def524d7aac3c95dc D:\Virus\2016.7.25\43.vir --> 587088pm.scr [Trojan.GenericKD.3419187]  [Delete success]
2016-7-25 09:48:54 MD5:7a4d3d2b9b280e7b8eae6aff279e61f6 D:\Virus\2016.7.25\07.vir [Trojan.GenericKD.3408402]  [Delete success][/mw_shl_code]

欧阳宣

TAV太惨……9个

Panda:
一扫：删除11X+修复4X=15X
二扫：无新增检测。

BD Free：35X

540923555

WD占位

联网扫描+修复=32个，未处理样本18个

wu5920

火绒  

skycai