精睿样本测试（16.10.17）

显示全部楼层 · 发表于 2016-10-17 21:23:27

本帖最后由小飞侠.net 于 2016-10-17 21:25 编辑

360杀毒扫描日志

病毒库版本：2016-10-17 17:03
扫描时间：2016-10-17 21:20:42
扫描用时：00:00:57
扫描类型：右键扫描
扫描文件总数：50
项目总数：26
清除项目数：26

扫描选项
----------------------
扫描所有文件：是
扫描压缩包：是
发现病毒处理方式：由用户选择处理
扫描磁盘引导区：是
扫描 Rootkit：是
使用云查杀引擎：是
使用QVM人工智能引擎：是
扫描建议修复项：是
常规引擎设置：BitDefender Avira(小红伞)

扫描内容
----------------------
文件名称: C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17.7z
文件大小: 5.26 MB (5517737 字节)
修改时间: 2016年10月17日，21:18:38
MD5: 2FD1519BBFE64B5925A09940C99D22FE
SHA1: 6BB6B01CC9F46CE04F38FA0863D0CB778B4EAEA5
SHA256: 51603281EE092EB18480689C58D92167C50484808B21F9D7DBF715237DF3B3AB
CRC32: C4E3A129
计算时间: 0.61s

[mw_shl_code=javascript,true]扫描结果
======================
高危风险项
----------------------
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\16.vir virus.office.gen.85 已修复
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\30.vir virus.office.gen.80 已修复
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\32.vir heur.macro.drop.eb 已修复
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\40.vir virus.office.obfuscated.1 已修复
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\44.vir virus.office.gen.95 已修复
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\03.vir 感染型病毒(Win32/Trojan.Dropper.064) 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\04.vir 感染型病毒(Win32/Trojan.1a3) 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\09.vir 感染型病毒(Win32/Backdoor.72c) 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\13.vir 感染型病毒(Win32/Trojan.Downloader.db4) 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\17.vir HEUR/QVM10.1.896E.Malware.Gen 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\20.vir 木马程序(Trojan.Generic) 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\21.vir 感染型病毒(Win32/Trojan.f6e) 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\22.vir 感染型病毒(Win32/Trojan.40f) 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\28.vir HEUR/QVM03.0.896E.Malware.Gen 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\31.vir HEUR/QVM18.1.896E.Malware.Gen 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\34.vir 感染型病毒(Win32/Trojan.Dropper.7c7) 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\36.vir 木马程序(Trojan.Generic) 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\41.vir 木马程序(Trojan.Generic) 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\50.vir 感染型病毒(Win32/Trojan.Dropper.b73) 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\02.vir virus.js.gen.1 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\05.vir js.url.downloader.k2 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\18.vir virus.js.gen.1 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\19.vir W97M.Downloader.ELP 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\25.vir virus.js.gen.1 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\42.vir virus.js.gen.90 已删除
C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\王馨妍\Windows Defender\AVTestZipX\2016.10.17\2016.10.17\46.vir virus.js.gen.90 已删除[/mw_shl_code]

显示全部楼层 · 发表于 2016-10-17 22:18:41

监控+扫描一共杀这么多

剩下17个
仅剩的EXE好像没有问题

结果：检测33个，删除33个

显示全部楼层 · 发表于 2016-10-18 01:25:36

luxiao200888 发表于 2016-10-17 14:01
我对比了BD和FS，差别在47。
这个文件加密了，BD其实也没扫出来，不过@linzh 把它算入检测到的了。
也 ...

难道更改文件后缀名文件的md5值也会跟着更改吗。。好吧我的锅

显示全部楼层 · 发表于 2016-10-18 09:50:55

星云劫发表于 2016-10-17 10:15
瑞星安全云终端，纯扫描干掉3个。这个有点厉害啊，敢与曾创下零杀的金山毒霸一战。
一个小时后二扫 ...

请问二扫为默认设置吗，二扫前做更新了没有？

显示全部楼层 · 发表于 2016-10-18 09:56:26

轩夏发表于 2016-10-17 11:09
卡巴

[mw_shl_code=css,true]2016-10-17 11:06:40 C:%users\XuanXia\Desktop\2016.10.17\01.vir ...

剩余卡巴处理了，请更新病毒库

显示全部楼层 · 发表于 2016-10-18 10:02:14

Johnkay.Young 发表于 2016-10-18 09:50
请问二扫为默认设置吗，二扫前做更新了没有？

你好，二扫前我有更新了一下病毒库，然后之前我有在设置里面打开了打开了二次扫描加速，请问是不是瑞星之前的扫描缓存会影响到他的二次检测？

显示全部楼层 · 发表于 2016-10-18 10:04:45

星云劫发表于 2016-10-18 10:02
你好，二扫前我有更新了一下病毒库，然后之前我有在设置里面打开了打开了二次扫描加速，请问是不是瑞星之 ...

缓存的话可能性不是太大。
主要原因应该还是库的更新。
星大可否抽空尝试过一段时间再次扫描（不做更新、产品设置也不改变），观察它的云的检测能力怎样。

显示全部楼层 · 发表于 2016-10-18 10:10:56

Johnkay.Young 发表于 2016-10-18 10:04
缓存的话可能性不是太大。
主要原因应该还是库的更新。
星大可否抽空尝试过一段时间再次扫描（不做更新 ...

感谢提醒，我会试试的。

然后，额，不瞒您说，我只是小白。

显示全部楼层 · 发表于 2016-10-18 10:21:50

火绒4.0杀38个
Huorong Security Anti-Malware Scan Log
Copyright (C) Huorong Security Lab. All rights reserved.

Scan engine version: v3.0.4.0
Signature database fingerprint: c72759b:15be893:d1b1ba9:d1b1ba9
Signature database timestamp: Mon Oct 17 16:37:25 2016

Scan started at: Tue Oct 18 10:19:30 2016

C:\Users\Vtest\Desktop\2016.10.17\01.vir: HEUR:OMacro/WinA.d [1386f22bff89fad9] (killed)
C:\Users\Vtest\Desktop\2016.10.17\02.vir: VirTool/JS.Obfuscator.d [c62154e135a8d809] (killed)
C:\Users\Vtest\Desktop\2016.10.17\05.vir: TrojanDownloader/JS.Nemucod [86824a4ff4e12961] (killed)
C:\Users\Vtest\Desktop\2016.10.17\06.vir: Trojan/Generic!C258A5DF0A69F5B3 [c258a5df0a69f5b3] (killed)
C:\Users\Vtest\Desktop\2016.10.17\07.vir: OMacro/Downloader [d00dd97ea838be72] (killed)
C:\Users\Vtest\Desktop\2016.10.17\09.vir: Trojan/Spamthru [62da93d51b2d4653] (killed)
C:\Users\Vtest\Desktop\2016.10.17\11.vir: Trojan/HTML.Phishing [99e59b6903cd2612] (killed)
C:\Users\Vtest\Desktop\2016.10.17\12.vir >> word\embeddings\oleObject1.bin: TrojanDownloader/VBS.Agent [771c4a2545ba4e89] (killed)
C:\Users\Vtest\Desktop\2016.10.17\15.vir >> x\xmlxmxmlxmlxmlxmlxmlxmlxmlxmlxmlxmlxmlxmlxmlxmllxmlxmlxmlt.class: Trojan/Java.Adwind [d59432a0f74ce3c0] (killed)
C:\Users\Vtest\Desktop\2016.10.17\15.vir >> x\xmlxmxmlxmlxmlxmlxmlxmlxmlxmlxmlxmlxmlxmlxmlxmllxmlxmlxmlx.class: Trojan/Java.Adwind [c5e5c98c1cd4288e] (killed)
C:\Users\Vtest\Desktop\2016.10.17\15.vir >> x\xmlxmxmlxmlxmlxmlxmlxmlxmlxmlxmlxmlxmlxmlxmlxmllxmlxmlxmle.class: Trojan/Java.Adwind [91aa762a194b10b9] (killed)
C:\Users\Vtest\Desktop\2016.10.17\16.vir: TrojanDownloader/VBS.Agent [9f35caea9c4c4b55] (killed)
C:\Users\Vtest\Desktop\2016.10.17\17.vir: Trojan/Generic!390D8954D7379D58 [390d8954d7379d58] (killed)
C:\Users\Vtest\Desktop\2016.10.17\18.vir: TrojanDownloader/JS.Nemucod.ej [14d3ca5237b63b4a] (killed)
C:\Users\Vtest\Desktop\2016.10.17\20.vir: Trojan/Generic!84B332CBECF7AFA9 [84b332cbecf7afa9] (killed)
C:\Users\Vtest\Desktop\2016.10.17\21.vir: Trojan/Injector.dl [cec17aa3dea03ae5] (killed)
C:\Users\Vtest\Desktop\2016.10.17\22.vir: TrojanSpy/Bebloh [0bca63f5b685d7c7] (killed)
C:\Users\Vtest\Desktop\2016.10.17\24.vir: Trojan/JS.Obfuscated [f7113e3e538340d7] (killed)
C:\Users\Vtest\Desktop\2016.10.17\25.vir: TrojanDownloader/JS.Nemucod [7a448fc8a8e655f8] (killed)
C:\Users\Vtest\Desktop\2016.10.17\26.vir: Trojan/Linux.Agent [0418377c5d1087e2] (killed)
C:\Users\Vtest\Desktop\2016.10.17\28.vir: HEUR:Trojan/Cryobf [2716bfdc84f95a7c] (killed)
C:\Users\Vtest\Desktop\2016.10.17\29.vir: OMacro/Downloader.at [52d01eeae3cb6cee] (killed)
C:\Users\Vtest\Desktop\2016.10.17\30.vir: OMacro/Downloader.at [52d01eeae3cb6cee] (killed)
C:\Users\Vtest\Desktop\2016.10.17\31.vir: Trojan/Generic!02B5E710892E7E78 [02b5e710892e7e78] (killed)
C:\Users\Vtest\Desktop\2016.10.17\32.vir >> word\vbaProject.bin: OMacro/Downloader [c46c7a2347741903] (killed)
C:\Users\Vtest\Desktop\2016.10.17\33.vir >> word\document.xml: OMacro/Fraud [256e905412b92656] (killed)
C:\Users\Vtest\Desktop\2016.10.17\34.vir: Trojan/Generic!17CA4C6283BE69B7 [17ca4c6283be69b7] (killed)
C:\Users\Vtest\Desktop\2016.10.17\36.vir: Trojan/Generic!EDBA702492E6AE34 [edba702492e6ae34] (killed)
C:\Users\Vtest\Desktop\2016.10.17\38.vir >> [NSIS].nsi: Trojan/Generic!E2785C5E829EF137 [e2785c5e829ef137] (killed)
C:\Users\Vtest\Desktop\2016.10.17\39.vir: TrojanDownloader/JS.Nemucod.fm [cde3cbc6dd446a62] (killed)
C:\Users\Vtest\Desktop\2016.10.17\40.vir: OMacro/Downloader [8a2121ef1fd66e7a] (killed)
C:\Users\Vtest\Desktop\2016.10.17\41.vir: Trojan/Generic!94A21C65B3E46911 [94a21c65b3e46911] (killed)
C:\Users\Vtest\Desktop\2016.10.17\42.vir: TrojanDownloader/JS.Nemucod [281e989cb27e2327] (killed)
C:\Users\Vtest\Desktop\2016.10.17\43.vir: OMacro/Downloader.at [52d01eeae3cb6cee] (killed)
C:\Users\Vtest\Desktop\2016.10.17\44.vir: HEUR:OMacro/WinA.d [1386f22bff89fad9] (killed)
C:\Users\Vtest\Desktop\2016.10.17\46.vir: TrojanDownloader/JS.Nemucod.fm [cde3cbc6dd446a62] (killed)
C:\Users\Vtest\Desktop\2016.10.17\48.vir >> 48: Exploit/SWF.Exkit [29b0a51475d725a6] (killed)
C:\Users\Vtest\Desktop\2016.10.17\50.vir: TrojanSpy/AutoIt.Agent.b [f828744bd56b3daf] (killed)

Scan completed at: Tue Oct 18 10:19:51 2016

Total:          50 file(s), 225 object(s)
Infected:       36 file(s), 38 object(s)
Deleted:          7 file(s), 0 failure(s)
Disinfected:    18 file(s), 0 failure(s)
Duration:       00:00:21 (21 seconds)
Ratio:          2 file(s)/s, 10 object(s)/s (1,625 KB/s, 416 phys.KB/s)

显示全部楼层 · 发表于 2016-10-18 10:47:24

本帖最后由驭龙于 2016-10-18 10:49 编辑

ELOHIM 发表于 2016-10-17 10:44
警戒线，不能再低啦。。。

二十四小时以后，补杀这些样本，传说中的WDUO效果么？哈哈
[mw_shl_code=css,true]Result Count:7
Threat Name:Trojan:Win32/Rundas!plock
ID:2147711527
Severity:5
Number of Resources:1
Resource Schema:file
Resource Path:E:\VIR\VC52\2016.10.17\40.vir.doc
Extended Info:42226965628613
Threat Name:Trojan:Java/Adwind.Q
ID:2147707636
Severity:5
Number of Resources:1
Resource Schema:file
Resource Path:E:\VIR\VC52\2016.10.17\15.vir.zip
Extended Info:140284793452467
Threat Name:Backdoor:Win32/Tofsee.T
ID:2147683703
Severity:5
Number of Resources:1
Resource Schema:file
Resource Path:E:\VIR\VC52\2016.10.17\20.vir.exe
Extended Info:24632750500291
Threat Name:Trojan:Win32/Dynamer!ac
ID:2147684005
Severity:5
Number of Resources:5
Resource Schema:file
Resource Path:E:\VIR\VC52\2016.10.17\50.vir.exe
Extended Info:24631871102541
Resource Schema:file
Resource Path:E:\VIR\VC52\2016.10.17\17.vir.exe->(VFS:#0)
Extended Info:24631669831528
Resource Schema:file
Resource Path:E:\VIR\VC52\2016.10.17\17.vir.exe
Extended Info:24631669831528
Resource Schema:file
Resource Path:E:\VIR\VC52\2016.10.17\04.vir.exe
Extended Info:24633227568822
Resource Schema:containerfile
Resource Path:E:\VIR\VC52\2016.10.17\17.vir.exe
Extended Info:0
End Scan[/mw_shl_code]

[病毒样本] 精睿样本测试（16.10.17）

本帖子中包含更多资源