三个可疑文件

显示全部楼层 · 发表于 2016-10-26 08:11:56

密码：infected

显示全部楼层 · 发表于 2016-10-26 08:35:24

管家扫描miss

显示全部楼层 · 发表于 2016-10-26 09:15:51

ESET kill 2x

我靠！ ess 10 各种不适应。

连找个扫描日志都要找半天。

解压 kill 1x

[mw_shl_code=css,true]时间;扫描程序;对象类型;对象;威胁;操作;用户;信息;哈希;此处首次所见
2016/10/26 9:12:40;文件系统实时防护;文件;Z:\TEMP\malware\infected.wsf;JS/TrojanDownloader.Nemucod.BHS 特洛伊木马;通过删除清除;PC-XXX;在应用程序新建的文件上发生事件: D:\Program Files\7-Zip\7zG.exe (7B2B7BD690776565686AAD9757F184B43F0673AC).;54F9D14FE122B3D9485213DD5D8FE04284166212;2016/10/26 8:08:06
[/mw_shl_code]

右键二扫 kill 1x

[mw_shl_code=css,true]日志
正在扫描日志
病毒库版本: 14337 (20161025)
日期: 2016/10/26 时间: 9:12:55
已扫描的磁盘、文件夹和文件: Z:\TEMP\malware
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > mls/World.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitq.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitw.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitz.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitd.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbita.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitg.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitu.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbite.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitt.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbiti.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitb.class - Java/Adwind.AAG 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitv.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitf.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitp.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbits.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitj.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitr.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitx.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitk.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitc.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitn.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbith.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbity.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitl.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbito.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitm.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitaa.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitpa.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitza.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitya.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitga.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
Z:\TEMP\malware\ORIGINAL SHIPPING DOCUMENT _04.jar > ZIP > z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitsa.class - Java/Adwind.AAH 特洛伊木马 - 通过删除清除 [1]
已扫描的对象数: 41
发现的威胁数: 33
已清除对象数: 33
完成时间: 9:12:55 总扫描时间: 0 秒 (00:00:00)

备注:
[1] 由于对象中仅包含病毒主体，因此已被删除。[/mw_shl_code]

显示全部楼层 · 发表于 2016-10-26 09:35:30

卡巴
infected.wsf
Trojan-Downloader.JS.Agent.mwn
ORIGINAL SHIPPING DOCUMENT _04.jar
HEUR:Trojan.Java.Agent.gen

显示全部楼层 · 发表于 2016-10-26 13:30:25

Avira KILL ALL

[mw_shl_code=css,true]Start of the scan: Wednesday, 26 October, 2016  13:29

Starting the file scan:

Begin scan in 'C:\Users\User\Downloads\malware\ORIGINAL SHIPPING DOCUMENT _04.jar'
C:\Users\User\Downloads\malware\ORIGINAL SHIPPING DOCUMENT _04.jar
[0] Archive type: ZIP
--> z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitw.class
      [DETECTION] Contains recognition pattern of the JAVA/Adwind.sdvsvk Java virus
      [WARNING] Infected files in archives cannot be repaired
--> z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbiti.class
      [DETECTION] Contains recognition pattern of the JAVA/Adwind.sdvsvl Java virus
      [WARNING] Infected files in archives cannot be repaired
--> z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitb.class
      [DETECTION] Contains recognition pattern of the JAVA/Adwind.sdvsvm Java virus
      [WARNING] Infected files in archives cannot be repaired
--> z/rabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbitrabbity.class
      [DETECTION] Contains recognition pattern of the JAVA/Adwind.sdvsvj Java virus
      [WARNING] Infected files in archives cannot be repaired
Begin scan in 'C:\Users\User\Downloads\malware\Ubra-crypted-102.exe'
C:\Users\User\Downloads\malware\Ubra-crypted-102.exe
  [DETECTION] Is the TR/Dldr.Agent.psbpn Trojan
Begin scan in 'C:\Users\User\Downloads\malware\infected.wsf'
C:\Users\User\Downloads\malware\infected.wsf
  [DETECTION] Contains recognition pattern of the JS/Dldr.Locky.BCN Java script virus[/mw_shl_code]

显示全部楼层 · 发表于 2016-10-26 18:28:20

火绒

显示全部楼层 · 发表于 2016-10-26 19:36:12

360TS 解压1x
右键0x

[可疑文件] 三个可疑文件

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源