精睿样本测试（16.7.27）

轩夏

地址：

https://pan.baidu.com/s/1mixtEyO  提取密码  yjpb

密码：bbs.vc52.cn
数量：50

挥泪斩情思

NS

检出26X，其中修复4X，剩余24X

Eset小粉絲

Avira 37X

[mw_shl_code=css,true]Start of the scan: Wednesday, 27 July, 2016  09:32

Starting the file scan:

Begin scan in 'C:\Users\User\Desktop\2016.7.27'
C:\Users\User\Desktop\2016.7.27\01.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Agent.75960 macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.27\03.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\User\Desktop\2016.7.27\04.vir
  [DETECTION] Is the TR/ATRAPS.lyip Trojan
C:\Users\User\Desktop\2016.7.27\05.vir
    [0] Archive type: RAR
    --> INQUIRY.JAR
        [1] Archive type: ZIP
      --> server/a/iIIiiiiiII.class
          [DETECTION] Contains recognition pattern of the JAVA/Agent.234 Java virus
          [WARNING]   Infected files in archives cannot be repaired
      --> server/main/Start.class
          [DETECTION] Contains recognition pattern of the JAVA/Agent.946 Java virus
          [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.27\07.vir
  [DETECTION] Contains code of the W2000M/Agent.9391605 macro virus
C:\Users\User\Desktop\2016.7.27\08.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\User\Desktop\2016.7.27\09.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\User\Desktop\2016.7.27\10.vir
  [DETECTION] Contains code of the W2000M/Agent.9391605 macro virus
C:\Users\User\Desktop\2016.7.27\11.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\User\Desktop\2016.7.27\13.vir
  [DETECTION] Is the TR/Agent.Elmo.A.67 Trojan
C:\Users\User\Desktop\2016.7.27\14.vir
  [DETECTION] Contains recognition pattern of the JS/Dldr.Locky.kse Java script virus
C:\Users\User\Desktop\2016.7.27\15.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\User\Desktop\2016.7.27\16.vir
    [0] Archive type: ZIP
    --> n.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddjv Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> y.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddjt Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> x.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddju Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> z.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.jaks.2 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> s.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.jaks.7 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> w.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddjw Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> o.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddjs Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> p.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddns Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> k.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddnu Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> j.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.jaks.5 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> q.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddnt Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> c.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.jaks.4 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> a.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddnv Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Alo.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.jaks.3 Java virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.27\17.vir
  [DETECTION] Is the TR/Agent.julj Trojan
C:\Users\User\Desktop\2016.7.27\18.vir
  [DETECTION] Contains recognition pattern of the EXP/PDFAgent.132 exploit
C:\Users\User\Desktop\2016.7.27\20.vir
  [DETECTION] Is the TR/Dropper.MSIL.kuve Trojan
C:\Users\User\Desktop\2016.7.27\21.vir
  [DETECTION] Contains virus patterns of Adware ADWARE/iBryte.gutr
C:\Users\User\Desktop\2016.7.27\23.vir
  [DETECTION] Contains recognition pattern of the VBS/Kryptik.AJ VBS script virus
C:\Users\User\Desktop\2016.7.27\24.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\User\Desktop\2016.7.27\25.vir
  [DETECTION] Is the TR/Dropper.MSIL.inqx Trojan
C:\Users\User\Desktop\2016.7.27\26.vir
  [DETECTION] Contains recognition pattern of the VBS/Dldr.Nemucod.AM VBS script virus
C:\Users\User\Desktop\2016.7.27\27.vir
  [DETECTION] Is the TR/Crypt.Xpack.18054 Trojan
C:\Users\User\Desktop\2016.7.27\30.vir
    [0] Archive type: ZIP
    --> Internet/u.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5474.12 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/s.class
        [DETECTION] Contains recognition pattern of the JAVA/Dldr.Agent.54337 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/w.class
        [DETECTION] Contains recognition pattern of the JAVA/Dldr.Agent.54338 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/z.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5474.15 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/b.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5475 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/y.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5474.14 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/d.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5474.3 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/p.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5474.10 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/l.class
        [DETECTION] Contains recognition pattern of the JAVA/Dldr.Agent.54335 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/r.class
        [DETECTION] Contains recognition pattern of the JAVA/Dldr.Agent.54336 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/n.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5474.9 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/g.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5474.4 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/q.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5474.11 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/j.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5474.7 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/h.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5474.5 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/c.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5474.2 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/Done.class
        [DETECTION] Contains recognition pattern of the JAVA/Dldr.Agent.54334 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/x.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5474.13 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/m.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5474.8 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/o.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5474.11 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Internet/i.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5474.6 Java virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.27\31.vir
  [DETECTION] Is the TR/Dropper.MSIL.watp Trojan
C:\Users\User\Desktop\2016.7.27\32.vir
    [0] Archive type: ZIP
    --> n.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddjv Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> y.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddjt Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> x.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddju Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> z.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.jaks.2 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> s.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.jaks.7 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> w.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddjw Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> o.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddjs Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> p.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddns Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> k.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddnu Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> j.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.jaks.5 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> q.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddnt Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> c.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.jaks.4 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> a.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.ddnv Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Alo.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.jaks.3 Java virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.27\33.vir
  [DETECTION] Contains recognition pattern of the VBS/Dldr.Nemucod.AM VBS script virus
C:\Users\User\Desktop\2016.7.27\36.vir
  [DETECTION] Is the TR/Dldr.Agent.jxza Trojan
C:\Users\User\Desktop\2016.7.27\37.vir
  [DETECTION] Is the TR/Spy.kkaq Trojan
C:\Users\User\Desktop\2016.7.27\41.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\User\Desktop\2016.7.27\42.vir
  [DETECTION] Contains a recognition pattern of the (harmful) BDS/Agent.109056.31 back-door program
C:\Users\User\Desktop\2016.7.27\44.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\User\Desktop\2016.7.27\45.vir
    [0] Archive type: ZIP
    --> xl/embeddings/oleObject1.bin
        [1] Archive type: OLE
      --> Object
          [DETECTION] Contains recognition pattern of the JS/Drop.Agent.AM Java script virus
          [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.27\46.vir
  [DETECTION] Contains a recognition pattern of the (harmful) BDS/Backdoor.Gen back-door program
C:\Users\User\Desktop\2016.7.27\47.vir
  [DETECTION] Contains recognition pattern of the VBS/Dldr.Nemucod.AM VBS script virus
C:\Users\User\Desktop\2016.7.27\48.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Dldr.Agent.dfgh macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.7.27\49.vir
  [DETECTION] Contains recognition pattern of the KIT/Ste.ap.181344 construction kit
C:\Users\User\Desktop\2016.7.27\50.vir
    [0] Archive type: ZIP
    --> Kjsio/l.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.54334654.1 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/h.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5433465 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/n.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.44146 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/x.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5433465.5 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/w.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.54334654.2 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/s.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.67866 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/f.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5433466 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/r.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5433465.4 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/q.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5433465.2 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/g.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.44147 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/m.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5433412 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/b.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.544545 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/c.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.54334453 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/a.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5433467 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/i.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5433454 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/z.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.54334567 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/Error.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.54334765 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/d.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.54334654 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/v.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5433465.3 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/u.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.867787 Java virus
        [WARNING]   Infected files in archives cannot be repaired
    --> Kjsio/j.class
        [DETECTION] Contains recognition pattern of the JAVA/Adwind.5433465.1 Java virus
        [WARNING]   Infected files in archives cannot be repaired[/mw_shl_code]

轩夏

MSE

[mw_shl_code=css,true]Scan started on Wed Jul 27 09:11:11 2016

C:\Users\XuanXia\Desktop\2016.7.27\01.vir->word/vbaProject.bin                           Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.7.27\02.vir                                                Infected: TrojanDownloader:JS/Nemucod.FT
C:\Users\XuanXia\Desktop\2016.7.27\03.vir->[WsfCmtOut]->(SCRIPT0001)                     Infected: TrojanDownloader:JS/Nemucod.FJ [non_writable_container]
C:\Users\XuanXia\Desktop\2016.7.27\04.vir                                                Infected: Trojan:Win32/Kovter
C:\Users\XuanXia\Desktop\2016.7.27\06.vir->(VFS:dup2patcher.dll)                         Infected: HackTool:Win32/Keygen [non_writable_container]
C:\Users\XuanXia\Desktop\2016.7.27\07.vir                                                Infected: Trojan:O97M/Madeba.A!det
C:\Users\XuanXia\Desktop\2016.7.27\08.vir                                                Infected: TrojanDownloader:JS/Nemucod.OOF
C:\Users\XuanXia\Desktop\2016.7.27\09.vir                                                Infected: TrojanDownloader:JS/Nemucod
C:\Users\XuanXia\Desktop\2016.7.27\10.vir                                                Infected: Trojan:O97M/Madeba.A!det
C:\Users\XuanXia\Desktop\2016.7.27\11.vir                                                Infected: TrojanDownloader:JS/Nemucod.FT
C:\Users\XuanXia\Desktop\2016.7.27\14.vir                                                Infected: TrojanDownloader:JS/Nemucod.FJ
C:\Users\XuanXia\Desktop\2016.7.27\15.vir                                                Infected: TrojanDownloader:JS/Nemucod
C:\Users\XuanXia\Desktop\2016.7.27\16.vir->y.class                                       Infected: Trojan:Java/Adwind.P
C:\Users\XuanXia\Desktop\2016.7.27\16.vir->q.class                                       Infected: Trojan:Java/Adwind.P
C:\Users\XuanXia\Desktop\2016.7.27\17.vir                                                Infected: Backdoor:MSIL/Bladabindi
C:\Users\XuanXia\Desktop\2016.7.27\20.vir                                                Infected: Backdoor:MSIL/Bladabindi!rfn
C:\Users\XuanXia\Desktop\2016.7.27\25.vir                                                Infected: Backdoor:MSIL/Bladabindi.AJ
C:\Users\XuanXia\Desktop\2016.7.27\26.vir                                                Infected: TrojanDownloader:JS/Nemucod.FK
C:\Users\XuanXia\Desktop\2016.7.27\27.vir                                                Infected: Backdoor:MSIL/Bladabindi
C:\Users\XuanXia\Desktop\2016.7.27\30.vir->Internet/c.class                              Infected: Trojan:Java/Adwind.P
C:\Users\XuanXia\Desktop\2016.7.27\30.vir->Internet/Done.class                           Infected: Trojan:Java/Adwind.P
C:\Users\XuanXia\Desktop\2016.7.27\31.vir                                                Infected: Backdoor:MSIL/Bladabindi
C:\Users\XuanXia\Desktop\2016.7.27\32.vir->y.class                                       Infected: Trojan:Java/Adwind.P
C:\Users\XuanXia\Desktop\2016.7.27\32.vir->q.class                                       Infected: Trojan:Java/Adwind.P
C:\Users\XuanXia\Desktop\2016.7.27\33.vir                                                Infected: TrojanDownloader:JS/Nemucod.FJ
C:\Users\XuanXia\Desktop\2016.7.27\37.vir                                                Infected: Backdoor:MSIL/Bladabindi!rfn
C:\Users\XuanXia\Desktop\2016.7.27\41.vir                                                Infected: TrojanDownloader:JS/Swabfex.C
C:\Users\XuanXia\Desktop\2016.7.27\42.vir                                                Infected: Backdoor:MSIL/Bladabindi
C:\Users\XuanXia\Desktop\2016.7.27\44.vir->[WsfCmtOut]->(SCRIPT0001)                     Infected: TrojanDownloader:JS/Nemucod.FJ [non_writable_container]
C:\Users\XuanXia\Desktop\2016.7.27\45.vir->xl/embeddings/oleObject1.bin->(Ole Stream 0)  Infected: TrojanProxy:JS/Kovonionz.B
C:\Users\XuanXia\Desktop\2016.7.27\46.vir                                                Infected: Worm:Win32/Cridex.E
C:\Users\XuanXia\Desktop\2016.7.27\47.vir                                                Infected: TrojanDownloader:JS/Nemucod.FJ
C:\Users\XuanXia\Desktop\2016.7.27\48.vir->word/vbaProject.bin                           Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.7.27\49.vir                                                Infected: TrojanSpy:Win32/Plimrost.B
C:\Users\XuanXia\Desktop\2016.7.27\50.vir->Kjsio/x.class                                 Infected: Trojan:Java/Adwind.P
C:\Users\XuanXia\Desktop\2016.7.27\50.vir->Kjsio/g.class                                 Infected: Trojan:Java/Adwind.P
C:\Users\XuanXia\Desktop\2016.7.27\50.vir->Kjsio/v.class                                 Infected: Trojan:Java/Adwind.P
Successfully checked: C:\Users\XuanXia\Desktop\2016.7.27

Scan ended on Wed Jul 27 09:11:16 2016[/mw_shl_code]

蓝天二号

McAfee 24X

心醉咖啡

毒霸kill14X

Microsoftheihei

卡巴kill30   fix3

540923555

WD占位

联网扫描+修复=35个，未处理样本15个

欧阳宣

趋势英文版检测14，修复2个。

wu5920

查杀对象 95，实际查杀25x