精睿样本测试（16.8.17）

神迹般存在

地址：

http://pan.baidu.com/s/1hrMptA0  提取密码  wxa2

http://www.vdisk.cn/down/index/19730859

密码：bbs.vc52.cn

数量：50



卡巴斯基安全软件2017：

删除30个，清除4个，未检测16个

已上报到卡巴斯基官方

Eset小粉絲

Avira 35X

[mw_shl_code=css,true]Start of the scan: Wednesday, 17 August, 2016  09:33

Starting the file scan:

Begin scan in 'C:\Users\User\Desktop\2016.8.17'
C:\Users\User\Desktop\2016.8.17\01.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Agent.0628244 macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.8.17\03.vir
  [DETECTION] Is the TR/Dropper.Gen Trojan
C:\Users\User\Desktop\2016.8.17\04.vir
  [DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
C:\Users\User\Desktop\2016.8.17\05.vir
  [DETECTION] Contains recognition pattern of the JS/Dldr.Locky.lks Java script virus
C:\Users\User\Desktop\2016.8.17\06.vir
  [DETECTION] Contains virus patterns of Adware ADWARE/DealPly.qxid
C:\Users\User\Desktop\2016.8.17\07.vir
  [DETECTION] Contains recognition pattern of the JS/Dldr.Locky.lks Java script virus
C:\Users\User\Desktop\2016.8.17\09.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Agent.804459 macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.8.17\10.vir
  [DETECTION] Is the TR/Agent.155366 Trojan
C:\Users\User\Desktop\2016.8.17\13.vir
  [DETECTION] Is the TR/Dropper.Gen Trojan
C:\Users\User\Desktop\2016.8.17\14.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Agent.0628244 macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.8.17\15.vir
  [DETECTION] Contains code of the W2000M/Agent.756516 macro virus
C:\Users\User\Desktop\2016.8.17\16.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Agent.0628244 macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.8.17\17.vir
    [0] Archive type: RAR
    --> Detallesymotivosdeladesvinculacionpermanentedelaempresa.exe
        [DETECTION] Is the TR/Dropper.VB.fjqp Trojan
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.8.17\18.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Agent.0628244 macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.8.17\19.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Agent.0628244 macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.8.17\22.vir
  [DETECTION] Contains recognition pattern of the VBS/Agent.saga.2 VBS script virus
C:\Users\User\Desktop\2016.8.17\23.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Agent.2122328 macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.8.17\26.vir
  [DETECTION] Contains recognition pattern of the EXP/FLASH.Pubenush.T.Gen exploit
C:\Users\User\Desktop\2016.8.17\29.vir
  [DETECTION] Is the TR/Dropper.Gen Trojan
C:\Users\User\Desktop\2016.8.17\31.vir
  [DETECTION] Is the TR/Dropper.MSIL.vwjg Trojan
C:\Users\User\Desktop\2016.8.17\32.vir
  [DETECTION] Contains recognition pattern of the JS/Dldr.Locky.lks Java script virus
C:\Users\User\Desktop\2016.8.17\34.vir
    [0] Archive type: ACE
    --> INV_JU300716.exe
        [DETECTION] Is the TR/Dropper.MSIL.xwyr Trojan
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.8.17\36.vir
  [DETECTION] Contains a recognition pattern of the (harmful) BDS/Agent.134144.36 back-door program
C:\Users\User\Desktop\2016.8.17\39.vir
  [DETECTION] Contains code of the W2000M/Agent.756516 macro virus
C:\Users\User\Desktop\2016.8.17\40.vir
  [DETECTION] Is the TR/ATRAPS.Gen Trojan
C:\Users\User\Desktop\2016.8.17\41.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Agent.0628244 macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.8.17\42.vir
  [DETECTION] Is the TR/Crypt.EPACK.hlre Trojan
C:\Users\User\Desktop\2016.8.17\43.vir
  [DETECTION] Contains recognition pattern of the JS/Dldr.Locky.4816 Java script virus
C:\Users\User\Desktop\2016.8.17\44.vir
  [DETECTION] Is the TR/Crypt.FKM.Gen Trojan
C:\Users\User\Desktop\2016.8.17\45.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Agent.0628244 macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.8.17\46.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Agent.0628244 macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.8.17\47.vir
  [DETECTION] Is the TR/Agent.48640.339 Trojan
C:\Users\User\Desktop\2016.8.17\48.vir
  [DETECTION] Is the TR/Dropper.VB.ofmg Trojan
C:\Users\User\Desktop\2016.8.17\49.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Agent.0628244 macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\User\Desktop\2016.8.17\50.vir
  [DETECTION] Is the TR/Dropper.MSIL.Gen Trojan[/mw_shl_code]

共和时代

AVG

心醉咖啡

360杀毒扫描日志

病毒库版本：
扫描时间：2016-08-17 09:32:25
扫描用时：00:00:30
扫描类型：右键扫描
扫描文件总数：50
项目总数：10
清除项目数：10

扫描选项
----------------------
扫描所有文件：是
扫描压缩包：是
发现病毒处理方式：由用户选择处理
扫描磁盘引导区：是
扫描 Rootkit：是
使用云查杀引擎：是
使用QVM人工智能引擎：是
扫描建议修复项：是
常规引擎设置：未使用

扫描内容
----------------------
F:\浏览器下载\2016.8.17


白名单设置
----------------------


扫描结果
======================
高危风险项
----------------------
F:\浏览器下载\2016.8.17\04.vir        Virus.Win32.VirLock.G        已修复
F:\浏览器下载\2016.8.17\02.vir        HEUR/QVM07.1.31A2.Malware.Gen        已删除
F:\浏览器下载\2016.8.17\25.vir        HEUR/QVM10.1.31A2.Malware.Gen        已删除
F:\浏览器下载\2016.8.17\13.vir        HEUR/QVM03.0.31A2.Malware.Gen        已删除
F:\浏览器下载\2016.8.17\31.vir        HEUR/QVM03.0.31A2.Malware.Gen        已删除
F:\浏览器下载\2016.8.17\42.vir        HEUR/QVM19.1.31A2.Malware.Gen        已删除
F:\浏览器下载\2016.8.17\40.vir        HEUR/QVM03.0.31A2.Malware.Gen        已删除
F:\浏览器下载\2016.8.17\48.vir        HEUR/QVM03.0.31A2.Malware.Gen        已删除
F:\浏览器下载\2016.8.17\36.vir        HEUR/QVM03.0.31A2.Malware.Gen        已删除
F:\浏览器下载\2016.8.17\50.vir        HEUR/QVM03.0.31A2.Malware.Gen        已删除



可疑文件上传结果
----------------------
f:\浏览器下载\2016.8.17\31.vir        上传失败
f:\浏览器下载\2016.8.17\36.vir        上传失败
f:\浏览器下载\2016.8.17\42.vir        上传成功

Luca.l

管家国际版
[mw_shl_code=xml,true][Scan information]

Start time:2016-8-17 09:35:38
Elapsed time:00:00:02
Scan type:Custom scan
Antivirus engines:Tencent cloud protection engine    Tencent antivirus engine II    Tencent system repair engine    Bitdefender local antivirus engine   
Scan status:Scan complete


[Scan Report]

Files scanned:50
Threats detected:34
Threats processed:34


---------------------
2016-8-17 09:35:42 MD5:3135fb5c0daee5ec7769a2df6aeaa98b C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\16.vir --> word/vbaProject.bin [W97M.Downloader.EDD]  [Delete success]
2016-8-17 09:35:42 MD5:0140b2c4ba1e3aa3c1a66b676060d25d C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\48.vir [Trojan.GenericKD.3460855]  [Delete success]
2016-8-17 09:35:42 MD5:1f46cbb2119dcc4a072ceaa338e8419a C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\41.vir --> word/vbaProject.bin [W97M.Downloader.EDD]  [Delete success]
2016-8-17 09:35:43 MD5:434cb2c7a6047606e0474a5fb071d8de C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\06.vir [Gen:Variant.Application.Bundler.DealPly.52]  [Delete success]
2016-8-17 09:35:43 MD5:87c62d30c7ea5734ebb25081d5683848 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\27.vir [Script.SWF.C283]  [Delete success]
2016-8-17 09:35:43 MD5:96b9acd2631137dfc7d0fabcb7960ff5 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\42.vir [Trojan.GenericKD.3458204]  [Delete success]
2016-8-17 09:35:43 MD5:3df5fa4e8b74faed3ae250518ebf8124 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\15.vir [W97M.Downloader.EDF]  [Clean success]
2016-8-17 09:35:43 MD5:5ae1e9135c7757e67aee72f7da7e7f07 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\50.vir [Gen:Variant.Razy.41942]  [Delete success]
2016-8-17 09:35:43 MD5:282fefae68a0e4b5e6bfbb2b271eff37 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\39.vir [W97M.Downloader.EDF]  [Clean success]
2016-8-17 09:35:43 MD5:c629dbf38977d682702f607c089e1b89 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\10.vir [Trojan.GenericKD.3471498]  [Delete success]
2016-8-17 09:35:43 MD5:a7a84b02a1e29a68e06f810660695133 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\20.vir [Trojan.JS.Downloader.FEM]  [Delete success]
2016-8-17 09:35:43 MD5:f356832c0371b5bf69cd1849d6c1c9c5 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\44.vir [Gen:Trojan.Heur.Qy1@uOZ8jGgG]  [Delete success]
2016-8-17 09:35:44 MD5:2267939275ce2720afebb9030e0c8b26 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\09.vir --> word/vbaProject.bin [W97M.Downloader.Donoff.J]  [Delete success]
2016-8-17 09:35:44 MD5:7f7ce2613fcbf489c616528943fe701e C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\14.vir --> word/vbaProject.bin [W97M.Downloader.EDD]  [Delete success]
2016-8-17 09:35:44 MD5:7665ef40d2bdcc2235d90fbbf492ac99 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\49.vir [Trojan.Agent.BXJM]  [Delete success]
2016-8-17 09:35:45 MD5:cc2671506ef36364e0b10a6d4ed1f86b C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\38.vir --> (INFECTED_JS) [JS:Trojan.Crypt.PJ]  [Delete success]
2016-8-17 09:35:45 MD5:ce109a05ee3189e031c8451f48fb5ff5 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\13.vir [Gen:Variant.Barys.25787]  [Delete success]
2016-8-17 09:35:45 MD5:ef69a801a5b7fcfb939285842874629f C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\19.vir --> word/vbaProject.bin [W97M.Downloader.EDD]  [Delete success]
2016-8-17 09:35:45 MD5:39da93e28c2600452e3b4e54382ed0c9 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\07.vir [Trojan.JS.Downloader.FEG]  [Delete success]
2016-8-17 09:35:46 MD5:fb886630a4634955fbb980032cfd49c4 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\46.vir --> word/vbaProject.bin [W97M.Downloader.EDD]  [Delete success]
2016-8-17 09:35:46 MD5:9eabe5020ddcc66a00af8cfbb5adc303 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\25.vir [Trojan.GenericKD.3458709]  [Delete success]
2016-8-17 09:35:46 MD5:3337cd1e1f0ff29d1cc45b04737a3f18 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\18.vir --> word/vbaProject.bin [W97M.Downloader.EDD]  [Delete success]
2016-8-17 09:35:46 MD5:602c1bf6fabc27e1601317019cef8d88 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\05.vir [Trojan.JS.Downloader.FEG]  [Delete success]
2016-8-17 09:35:46 MD5:fba5eac9b8d889bd092e3159356bb15e C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\45.vir --> word/vbaProject.bin [W97M.Downloader.EDD]  [Delete success]
2016-8-17 09:35:46 MD5:6e3ce9152ad7beed361fae3b0db38da4 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\02.vir [Trojan.GenericKD.3433329]  [Delete success]
2016-8-17 09:35:46 MD5:36e8c6fe174b27698039e41d4b56318b C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\34.vir --> INV_JU300716.exe [Trojan.GenericKD.3455749]  [Delete success]
2016-8-17 09:35:46 MD5:08dbeb658d4b7ab2524a8ddb340c7d4c C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\31.vir [Trojan.GenericKD.3457409]  [Delete success]
2016-8-17 09:35:46 MD5:c27064440d27b87b934e15e7a5ae7f38 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\17.vir --> Detallesymotivosdeladesvinculacionpermanentedelaempresa.exe [Gen:Variant.Razy.88313]  [Delete success]
2016-8-17 09:35:46 MD5:54c8044113d5417e0feaf2f6ac30f0fc C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\47.vir [Gen:Variant.Symmi.17147]  [Delete success]
2016-8-17 09:35:47 MD5:ff43dc1a520b92c1265aa44636a5db34 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\01.vir --> word/vbaProject.bin [W97M.Downloader.EDD]  [Delete success]
2016-8-17 09:35:47 MD5:e2e3f6bb2e4715c10e8991449e248d66 C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\43.vir [Trojan.JS.Downloader.FDJ]  [Delete success]
2016-8-17 09:35:47 MD5:b7e31a16e1740c59975c57b50359eb5a C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\04.vir [Win32.Virlock.Gen.3]  [Delete success]
2016-8-17 09:35:47 MD5:59535b55dfa3de51777ccb3d72d17dce C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\32.vir [Trojan.JS.Downloader.FEG]  [Delete success]
2016-8-17 09:35:47 MD5:860cd4faa0c855d8dd32770e438dc6fd C:\Users\Joyzz_Android01\Desktop\样本\2016.8.17\36.vir [Gen:Variant.Zusy.143337]  [Delete success]
---------------------
[/mw_shl_code]

轩夏

MSE

[mw_shl_code=css,true]Scan started on Wed Aug 17 09:42:41 2016

C:\Users\XuanXia\Desktop\2016.8.17\01.vir->word/vbaProject.bin                                                  Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.8.17\04.vir                                                                       Infected: Virus:Win32/Nabucur.D
C:\Users\XuanXia\Desktop\2016.8.17\05.vir                                                                       Infected: TrojanDownloader:JS/Nemucod
C:\Users\XuanXia\Desktop\2016.8.17\07.vir                                                                       Infected: TrojanDownloader:JS/Nemucod
C:\Users\XuanXia\Desktop\2016.8.17\09.vir->word/vbaProject.bin                                                  Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.8.17\11.vir                                                                       Infected: Trojan:VBS/Kalhine.A
C:\Users\XuanXia\Desktop\2016.8.17\13.vir                                                                       Infected: Trojan:Win32/Malex.gen!E [generic]
C:\Users\XuanXia\Desktop\2016.8.17\14.vir->word/vbaProject.bin                                                  Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.8.17\15.vir                                                                       Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.8.17\16.vir->word/vbaProject.bin                                                  Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.8.17\17.vir->Detallesymotivosdeladesvinculacionpermanentedelaempresa.exe          Infected: Backdoor:Win32/Xtrat.AC [non_writable_container]
C:\Users\XuanXia\Desktop\2016.8.17\18.vir->word/vbaProject.bin                                                  Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.8.17\19.vir->word/vbaProject.bin                                                  Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.8.17\22.vir                                                                       Infected: Worm:VBS/Jenxcus
C:\Users\XuanXia\Desktop\2016.8.17\25.vir                                                                       Infected: TrojanSpy:Win32/Ursnif.HP!bit
C:\Users\XuanXia\Desktop\2016.8.17\31.vir                                                                       Infected: Trojan:Win32/Skeeyah.A!bit
C:\Users\XuanXia\Desktop\2016.8.17\32.vir->[WsfCmtOut]->(SCRIPT0000)                                            Infected: TrojanDownloader:JS/Swabfex.P [non_writable_container]
C:\Users\XuanXia\Desktop\2016.8.17\34.vir->INV_JU300716.exe                                                     Infected: TrojanSpy:Win32/Skeeyah.A!rfn [non_writable_container]
C:\Users\XuanXia\Desktop\2016.8.17\36.vir                                                                       Infected: Backdoor:MSIL/Noancooe.C
C:\Users\XuanXia\Desktop\2016.8.17\38.vir                                                                       Infected: Worm:JS/Bondat!rfn
C:\Users\XuanXia\Desktop\2016.8.17\39.vir                                                                       Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.8.17\41.vir->word/vbaProject.bin                                                  Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.8.17\43.vir                                                                       Infected: TrojanDownloader:JS/Nemucod
C:\Users\XuanXia\Desktop\2016.8.17\45.vir->word/vbaProject.bin                                                  Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.8.17\46.vir->word/vbaProject.bin                                                  Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.8.17\49.vir->word/vbaProject.bin                                                  Infected: TrojanDownloader:O97M/Donoff
C:\Users\XuanXia\Desktop\2016.8.17\50.vir->[MSILRES:Dark Crypter v1.0 By Dark.exe]                              Infected: Backdoor:MSIL/Bladabindi.AL[non_writable_container]
C:\Users\XuanXia\Desktop\2016.8.17\50.vir->[MSILRES:Svchost.exe]                                                Infected: Backdoor:MSIL/Bladabindi!rfn [non_writable_container]
Successfully checked: C:\Users\XuanXia\Desktop\2016.8.17

Scan ended on Wed Aug 17 09:43:00 2016

Time: 19 second(s). [0h:00m:19s]
Files/second: 25 (825 Kb/s).
Objects scanned: 490.
Infected: 28. Suspicious: 0. Clean: 462. Different virus bodies: 15.
Files: 50. Directories: 1. Archives: 22. Packed: 8. Mail files: 0.
Warnings: 28. Scan errors: 0. Protected: 0. Damaged: 0. Unknown method: 0. Spanned: 0.[/mw_shl_code]

挥泪斩情思

NS

skycai

[mw_shl_code=css,true]Huorong Network Security Suite v3.0.44.0 (Last update: 2016-08-16 15:58)
Copyright (C) Huorong Borui (Beijing) Technology Co., Ltd. All rights reserved.

Scan engine version:v3.0.4.0
Signature database fingerprint: f2a3446:4159bab:4159bab:4159bab
Signature database timestamp: 2016-08-16 15:58

Scan started at:   2016-08-17 09:39:42

D:\Users\B85M\Desktop\2016.8.17\2016.8.17\01.vir >> word\vbaProject.bin: OMacro/Downloader.ja
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\04.vir: HVM:Virus/Nabucur.d
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\05.vir: TrojanDownloader/JS.Nemucod.dl
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\07.vir: TrojanDownloader/JS.Nemucod.dl
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\12.vir: Adware/Mindspark.a
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\13.vir: VirTool/MSIL.Injector.a
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\15.vir: OMacro/Downloader
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\14.vir >> word\vbaProject.bin: OMacro/Downloader.ja
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\16.vir >> word\vbaProject.bin: OMacro/Downloader.ja
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\18.vir >> word\vbaProject.bin: OMacro/Downloader.ja
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\19.vir >> word\vbaProject.bin: OMacro/Downloader.ja
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\22.vir: Worm/VBS.Jenxcus.b
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\32.vir: TrojanDownloader/JS.Nemucod.dl
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\36.vir: Trojan/MSIL.NanoCore.a
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\37.vir: TrojanDownloader/VBS.Agent.p
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\39.vir: OMacro/Downloader
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\41.vir >> word\vbaProject.bin: OMacro/Downloader.ja
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\42.vir: HVM:VirTool/Obfuscator.gen!A
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\45.vir >> word\vbaProject.bin: OMacro/Downloader.ja
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\46.vir >> word\vbaProject.bin: OMacro/Downloader.ja
D:\Users\B85M\Desktop\2016.8.17\2016.8.17\49.vir >> word\vbaProject.bin: OMacro/Downloader.ja

Scan completed at: 2016-08-17 09:40:02

Total:             50 file(s), 373 objects(s)
Infected:          21 file(s), 21 objects(s)
Deleted:           0 file(s), 0 failure(s)
Disinfected:       0 file(s), 0 failure(s)
Duration:          00:00:20
[/mw_shl_code]

alfred0156

瑞星新引擎（联网状态）
总扫描文件: 50
总恶意文件: 33
有效检出率: 66.00%
[mw_shl_code=css,true]扫描开始: Wed Aug 17 09:51:00 2016

:"C:\\Users\\alfred\\Desktop\\2016.8.17\\01.vir","infect":{"engine":"classic","threat":"Trojan.Obfus/VBA!1.A60A","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\03.vir","infect":{"engine":"cloud","threat":"Dropper.Generic!8.35E-AhuKEfLbiwE","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\02.vir","infect":{"engine":"cloud","threat":"Trojan.Agent!8.B1E-dMwrBIXfuKI","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\04.vir","infect":{"engine":"cloud","threat":"Trojan.Win32.Cridex.b-fIOsZazd8qG","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\06.vir","infect":{"engine":"cloud","threat":"PUA.DealPly!8.96-VKlrLVT2YZU","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\05.vir","infect":{"engine":"cloud","threat":"Downloader.Nemucod!8.34-k4Oryagg1IN","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\09.vir","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\08.vir","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\11.vir","infect":{"engine":"cloud","threat":"Trojan.Kryptik!8.8-4c2j2o9JrPK","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\07.vir","infect":{"engine":"cloud","threat":"Downloader.Nemucod!8.34-aLrQBjEsT7E","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\14.vir","infect":{"engine":"classic","threat":"Trojan.Obfus/VBA!1.A60A","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\15.vir","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\13.vir","infect":{"engine":"cloud","threat":"Dropper.Generic!8.35E-IPGCLPH5vgV","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\16.vir","infect":{"engine":"classic","threat":"Trojan.Obfus/VBA!1.A60A","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\10.vir","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\18.vir","infect":{"engine":"classic","threat":"Trojan.Obfus/VBA!1.A60A","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\19.vir","infect":{"engine":"classic","threat":"Trojan.Obfus/VBA!1.A60A","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\12.vir","infect":{"engine":"thunder","threat":"Malware.Generic!1kuVHbtCOlT@5","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\17.vir","infect":{"engine":"cloud","threat":"Trojan.Xtrat!8.260-r1xmsA4GQ8S","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\20.vir","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\23.vir","infect":{"engine":"classic","threat":"Trojan.Obfus/VBA@DT!1.A540","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\22.vir","infect":{"engine":"cloud","threat":"Trojan.Agent!1.A1C8-ReyAG{过}F{滤}WY6b","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\26.vir","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\27.vir","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\25.vir","infect":{"engine":"cloud","threat":"Trojan.GenKryptik!8.AA55-CglnNoW7zbK","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\24.vir","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\30.vir","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\29.vir","infect":{"engine":"cloud","threat":"Dropper.Generic!8.35E-BgR8F9gR82C","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\28.vir","infect":{"engine":"cloud","threat":"Malware.Agent!8.2C-iHi81JTrecQ","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\33.vir","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\34.vir","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\31.vir","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\36.vir","infect":{"engine":"cloud","threat":"Backdoor.Noancooe!8.176-uFZesAKLS0V","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\35.vir","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\32.vir","infect":{"engine":"cloud","threat":"Downloader.Nemucod!8.34-JEDgQBIH05Q","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\39.vir","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\37.vir","infect":{"engine":"cloud","threat":"Downloader.Agent!8.B23-Cdzcy5sURdH","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\21.vir","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\41.vir","infect":{"engine":"classic","threat":"Trojan.Obfus/VBA!1.A60A","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\42.vir","infect":{"engine":"cloud","threat":"Spyware.Zbot!8.16B-HqIaqyFEveO","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\43.vir","infect":{"engine":"cloud","threat":"Trojan.DL-Obfus/JS!1.A509-NElx5AM5HmE","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\40.vir","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\46.vir","infect":{"engine":"classic","threat":"Trojan.Obfus/VBA!1.A60A","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\45.vir","infect":{"engine":"classic","threat":"Trojan.Obfus/VBA!1.A60A","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\47.vir","infect":{"engine":"cloud","threat":"Trojan.Agent!8.B1E-jOAJUT1QTGQ","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\48.vir","infect":{"engine":"cloud","threat":"Trojan.GenKryptik!8.AA55-FlGRptlXSHT","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\49.vir","infect":{"engine":"classic","threat":"Trojan.Obfus/VBA!1.A60A","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\50.vir","infect":{"engine":"cloud","threat":"Trojan.Win32.Strictor.a-2I1iOTxh3XG","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\38.vir","infect":{"engine":"cloud","threat":"Trojan.ObfusJS/Heur!1.A4CA-spJM4UhjLwU","type":"scan"
:"C:\\Users\\alfred\\Desktop\\2016.8.17\\44.vir","type":"scan"

扫描结束: Wed Aug 17 09:51:03 2016

总共耗时: 0:2:839(m:s:ms)[/mw_shl_code]

AVG
高严重性;"36";"0";"36"
中等严重性;"1";"0";"1"
已扫描：;"C:\Users\alfred\Desktop\2016.8.17"
已启动：;"2016/8/17, 9:53:05"
已完成：;"2016/8/17, 9:53:07"
项目数：;"81"
[mw_shl_code=css,true]名称;"说明";"状态";"状态";"优先级"
C:\Users\alfred\Desktop\2016.8.17\39.vir;"发现病毒 W97M/Downloader.AW";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\45.vir;"发现病毒 W97M/Downloader";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\47.vir;"特洛伊木马 Agent5.AQND";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\46.vir;"发现病毒 W97M/Downloader";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\17.vir;"特洛伊木马 Atros3.CNMF";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\27.vir;"特洛伊木马 Exploit.SWF_c.ARJ";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\34.vir;"特洛伊木马 MSIL10.AYBH";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\50.vir;"特洛伊木马 Bladabindi2.AZGU.dropper";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\10.vir;"特洛伊木马 Downloader.Generic14.BDCO";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\09.vir;"发现病毒 W97M/Downloader";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\23.vir;"发现病毒 W97M/Downloader";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\26.vir;"发现病毒 SWF/Exploit";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\13.vir;"特洛伊木马 Zbot.APEY";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\29.vir;"特洛伊木马 ILHeur.EPY";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\05.vir;"发现病毒 JS/Downloader.Agent.43_7";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\35.vir;"特洛伊木马 Exploit_c.ADLT";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\07.vir;"发现病毒 JS/Downloader.Agent.43_7";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\16.vir;"发现病毒 W97M/Downloader";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\48.vir;"特洛伊木马 Atros3.COTE";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\49.vir;"发现病毒 W97M/Downloader";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\22.vir;"发现病毒 VBS/Agent";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\01.vir;"发现病毒 W97M/Downloader";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\41.vir;"发现病毒 W97M/Downloader";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\14.vir;"发现病毒 W97M/Downloader";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\42.vir;"特洛伊木马 Ransom_s.DC";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\19.vir;"发现病毒 W97M/Downloader";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\04.vir;"特洛伊木马 LockScreen.BO";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\31.vir;"特洛伊木马 Atros3.COHZ";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\15.vir;"发现病毒 W97M/Downloader.AW";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\18.vir;"发现病毒 W97M/Downloader";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\06.vir;"广告软件 DealApp.AKFI";"未解决";"未解决";"中等"
C:\Users\alfred\Desktop\2016.8.17\25.vir;"特洛伊木马 Generic_r.MFW";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\20.vir;"发现病毒 JS/Downloader.Agent.45_M";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\36.vir;"特洛伊木马 Atros3.FRB";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\43.vir;"发现病毒 JS/Downloader.Agent";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\32.vir;"发现病毒 JS/Downloader.Agent.43_7";"未解决";"未解决";"高"
C:\Users\alfred\Desktop\2016.8.17\02.vir;"发现 Win32/DH{IzYK?}";"未解决";"未解决";"高"
[/mw_shl_code]

360_HBM

心醉咖啡 发表于 2016-8-17 09:34
360杀毒扫描日志

病毒库版本：

修正后缀，OEM全关，32X