精睿样本测试（16.11.30）

SEP14 21X
话说这SEP14抽风挺麻烦呀，第一次扫描一个A杀都没有，第二次转眼冒出来四个。。。

tmcss

ESS9 Kill 27x（Fix 2x）
[mw_shl_code=css,true]日志
正在扫描日志
病毒库版本: 14526 (20161129)
日期: 2016/11/30  时间: 10:04:26
已扫描的磁盘、文件夹和文件: C:\Users\Mistet\Desktop\2016.11.30
C:\Users\Mistet\Desktop\2016.11.30\01.vir - Win32/IStartSurf.BF 潜在的不受欢迎应用程序 - 扫描完成后再选择处理方式
C:\Users\Mistet\Desktop\2016.11.30\03.vir - JS/TrojanDownloader.Nemucod.BRB 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\04.vir - JS/TrojanDownloader.Agent.PGX 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\05.vir > ZIP > word/embeddings/oleObject1.bin > OLEDATA > AdobeReaderPlugin.scr - Win32/TrojanDownloader.Delf.BYF 特洛伊木马 - 扫描完成后再选择处理方式
C:\Users\Mistet\Desktop\2016.11.30\07.vir - VBS/TrojanDownloader.Agent.OQK 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\08.vir - JS/TrojanDownloader.Nemucod.BQM 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\11.vir - Win32/Adware.FileFinder.AS 应用程序 的变种 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\12.vir - JS/TrojanDownloader.Nemucod.BQG 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\13.vir > EZIRIZ > protected.exe > DOTNETREACTOR - 不支持的选项
C:\Users\Mistet\Desktop\2016.11.30\15.vir - VBA/TrojanDropper.Agent.SN 特洛伊木马 - 已清除
C:\Users\Mistet\Desktop\2016.11.30\16.vir - JS/TrojanDownloader.Agent.PGY 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\17.vir - JS/TrojanDownloader.Nemucod.BQG 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\18.vir - VBS/TrojanDownloader.Agent.OQK 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\19.vir - JS/TrojanDownloader.Agent.PGY 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\21.vir > ZIP > word/embeddings/oleObject1.bin > OLEDATA > Ricardo.ch_Bestellung_22.11.2016.exe > ZIP > 01zyxKyL_29575.1w - JS/Retefe.I 特洛伊木马 - 扫描完成后再选择处理方式
C:\Users\Mistet\Desktop\2016.11.30\23.vir - JS/TrojanDownloader.Nemucod.BKM 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\24.vir > CWS > file.swf - SWF/Exploit.ExKit.BES 特洛伊木马 的变种 - 已删除
C:\Users\Mistet\Desktop\2016.11.30\25.vir - JS/TrojanDownloader.Agent.PGX 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\27.vir - Win32/Injector.DHZZ 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\30.vir - VBA/Obfuscated.AK 特洛伊木马 - 已清除
C:\Users\Mistet\Desktop\2016.11.30\32.vir - JS/TrojanDownloader.Nemucod.BQI 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\37.vir - JS/TrojanDownloader.Nemucod.BPU 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\39.vir > ZIP > word/vbaProject.bin - PowerShell/Rozena.G 特洛伊木马 - 扫描完成后再选择处理方式
C:\Users\Mistet\Desktop\2016.11.30\40.vir - MSIL/Agent.RLY 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\41.vir > BASE64 > 41.vir - 正常
C:\Users\Mistet\Desktop\2016.11.30\42.vir - MSIL/TrojanDownloader.Agent.CQT 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\47.vir - MSIL/HackTool.BruteForce.FY 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\48.vir - JS/TrojanDownloader.Agent.PGX 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\49.vir - VBA/Obfuscated.AK 特洛伊木马 - 已清除
C:\Users\Mistet\Desktop\2016.11.30\50.vir > NSIS > Script.nsi - NSIS/Injector.KQ 特洛伊木马 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\50.vir > NSIS > OmUbZTb.AAq75 - 压缩文件已损坏 － 文件无法解压。
C:\Users\Mistet\Desktop\2016.11.30\50.vir > NSIS > System.dll - 压缩文件已损坏 － 文件无法解压。
C:\Users\Mistet\Desktop\2016.11.30\01.vir - Win32/IStartSurf.BF 潜在的不受欢迎应用程序 - 通过删除清除 [1]
C:\Users\Mistet\Desktop\2016.11.30\05.vir > ZIP > word/embeddings/oleObject1.bin > OLEDATA > AdobeReaderPlugin.scr - Win32/TrojanDownloader.Delf.BYF 特洛伊木马 - 已删除
C:\Users\Mistet\Desktop\2016.11.30\21.vir > ZIP > word/embeddings/oleObject1.bin > OLEDATA > Ricardo.ch_Bestellung_22.11.2016.exe > ZIP > 01zyxKyL_29575.1w - JS/Retefe.I 特洛伊木马 - 已删除
C:\Users\Mistet\Desktop\2016.11.30\39.vir > ZIP > word/vbaProject.bin - PowerShell/Rozena.G 特洛伊木马 - 已删除
已扫描的对象数: 127
发现的威胁数: 28
已清除对象数: 28
完成时间: 10:04:40  总扫描时间: 14 秒 (00:00:14)

备注:
[1] 由于对象中仅包含病毒主体，因此已被删除。
[/mw_shl_code]

猪头无双

avast



@ys0516    你没算准，还有修复





剩余情况如下，含修复


剩余文件上报

Eset小粉絲

Avira 25x
[mw_shl_code=css,true]Start of the scan: Wednesday, 30 November, 2016  10:15

Starting the file scan:

Begin scan in 'C:\Users\Ivan\Desktop\2016.11.30'
C:\Users\Ivan\Desktop\2016.11.30\01.vir
  [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\Users\Ivan\Desktop\2016.11.30\03.vir
  [DETECTION] Contains recognition pattern of the JS/Dldr.Locky.PLOW Java script virus
C:\Users\Ivan\Desktop\2016.11.30\04.vir
  [DETECTION] Contains recognition pattern of the JS/Dldr.Locky.aipkza Java script virus
C:\Users\Ivan\Desktop\2016.11.30\05.vir
    [0] Archive type: ZIP
    --> word/embeddings/oleObject1.bin
        [1] Archive type: OLE
      --> Object
          [DETECTION] Is the TR/AD.Nagram.leufq Trojan
          [WARNING]   Infected files in archives cannot be repaired
C:\Users\Ivan\Desktop\2016.11.30\07.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\Ivan\Desktop\2016.11.30\08.vir
  [DETECTION] Contains recognition pattern of the JS/Dldr.Locky.valmf Java script virus
C:\Users\Ivan\Desktop\2016.11.30\11.vir
  [DETECTION] Contains virus patterns of Adware ADWARE/FileFinder.ID
C:\Users\Ivan\Desktop\2016.11.30\12.vir
  [DETECTION] Contains recognition pattern of the JS/Dldr.Locky.74030 Java script virus
C:\Users\Ivan\Desktop\2016.11.30\13.vir
  [DETECTION] Is the TR/Ipac.jkvki Trojan
C:\Users\Ivan\Desktop\2016.11.30\17.vir
  [DETECTION] Contains recognition pattern of the JS/Dldr.Locky.74030 Java script virus
C:\Users\Ivan\Desktop\2016.11.30\18.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\Ivan\Desktop\2016.11.30\21.vir
    [0] Archive type: ZIP
    --> word/embeddings/oleObject1.bin
        [1] Archive type: OLE
      --> AV00000023.AV$
          [2] Archive type: ZIP SFX (self extracting)
        --> 01zyxKyL_29575.1w
            [DETECTION] Contains code of the W97M/Dldr.Agent.fnuxc Word macro virus
            [WARNING]   Infected files in archives cannot be repaired
Successful Cloud SDK initialization and license check.
The file 'C:\Users\Ivan\Desktop\2016.11.30\22.vir' has been uploaded to the Protection Cloud and analyzed. SHA256 = A4AAFD31E12AD898AAAB6861FF89E4C9861C92DC95C924F3D4712ADEADB6C038
C:\Users\Ivan\Desktop\2016.11.30\22.vir (SHA-256: a4aafd31e12ad898aaab6861ff89e4c9861c92dc95c924f3d4712adeadb6c038)
  [INFO]      The file 'C:\Users\Ivan\Desktop\2016.11.30\22.vir' has been uploaded to the Protection Cloud and analyzed.
C:\Users\Ivan\Desktop\2016.11.30\23.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\Ivan\Desktop\2016.11.30\25.vir
  [DETECTION] Contains recognition pattern of the JS/Dldr.Locky.aipkza Java script virus
C:\Users\Ivan\Desktop\2016.11.30\26.vir
    [0] Archive type: RAR SFX (self extracting)
    --> folder_fix.bat
        [DETECTION] Contains recognition pattern of the BAT/Agent.asdj batch virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\Ivan\Desktop\2016.11.30\27.vir
  [DETECTION] Is the TR/Crypt.Xpack.bwkac Trojan
C:\Users\Ivan\Desktop\2016.11.30\30.vir
  [DETECTION] Contains suspicious code HEUR/Macro.Agent
Retry 1 for the file 'C:\Users\Ivan\Desktop\2016.11.30\31.vir'. SHA256 = EEC0A2EDA6064F35383A68737D8C99C7CB1FCDD9B1117DC7490897AD653CA429
Retry 2 for the file 'C:\Users\Ivan\Desktop\2016.11.30\31.vir'. SHA256 = EEC0A2EDA6064F35383A68737D8C99C7CB1FCDD9B1117DC7490897AD653CA429
The file 'C:\Users\Ivan\Desktop\2016.11.30\31.vir' has been uploaded to the Protection Cloud and analyzed. SHA256 = EEC0A2EDA6064F35383A68737D8C99C7CB1FCDD9B1117DC7490897AD653CA429
C:\Users\Ivan\Desktop\2016.11.30\31.vir (SHA-256: eec0a2eda6064f35383a68737d8c99c7cb1fcdd9b1117dc7490897ad653ca429)
  [INFO]      The file 'C:\Users\Ivan\Desktop\2016.11.30\31.vir' has been uploaded to the Protection Cloud and analyzed.
C:\Users\Ivan\Desktop\2016.11.30\32.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
The file 'C:\Users\Ivan\Desktop\2016.11.30\33.vir' has been uploaded to the Protection Cloud and analyzed. SHA256 = 8B946AEA991593C01354DE66BB22C9A886F35AEE662E89518EA0C0B6BCB1210A
C:\Users\Ivan\Desktop\2016.11.30\33.vir (SHA-256: 8b946aea991593c01354de66bb22c9a886f35aee662e89518ea0c0b6bcb1210a)
  [INFO]      The file 'C:\Users\Ivan\Desktop\2016.11.30\33.vir' has been uploaded to the Protection Cloud and analyzed.
C:\Users\Ivan\Desktop\2016.11.30\34.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains suspicious code HEUR/Macro.Dropper
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\Ivan\Desktop\2016.11.30\37.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\Ivan\Desktop\2016.11.30\39.vir
    [0] Archive type: ZIP
    --> word/vbaProject.bin
        [DETECTION] Contains code of the W2000M/Agent.96381150 macro virus
        [WARNING]   Infected files in archives cannot be repaired
C:\Users\Ivan\Desktop\2016.11.30\40.vir
  [DETECTION] Is the TR/Agent.unmdj Trojan
C:\Users\Ivan\Desktop\2016.11.30\42.vir
  [DETECTION] Is the TR/Samca.tvjul Trojan
C:\Users\Ivan\Desktop\2016.11.30\48.vir
  [DETECTION] Contains recognition pattern of the JS/Dldr.Locky.aipkza Java script virus
C:\Users\Ivan\Desktop\2016.11.30\49.vir
  [DETECTION] Contains suspicious code HEUR/Macro.Agent[/mw_shl_code]

Dolby123

猪头无双 发表于 2016-11-30 10:09
avast

一样，隔离区扫描TOTAL DETECT = 16X

ys0516

猪头无双 发表于 2016-11-30 10:09
avast

啊 怎么看修复了啊 。我一般都是右键扫描，然后结果文件直接选删除的。
我重新试了自动修复，直接修复失败后移至隔离区 这次还剩下37X

dongwenqi

轩夏 发表于 2016-11-30 09:18
卡巴
[mw_shl_code=css,true]2016-11-30 09:17:36        C:%users\XuanXia\Desktop\2016.11.30\01.vir                not-a-vi ...

剩余的样本还在吗？如果在的，打包发来

洛神颉

Virus4 发表于 2016-11-30 09:37
瑞星新引擎kill 28

是云终端还是17？调查杀设置了吗？解压时监控有提醒没？

大蜘蛛监控查杀15，右键扫描0.

Virus4

洛神颉 发表于 2016-11-30 11:17
是云终端还是17？调查杀设置了吗？解压时监控有提醒没？

新引擎。

ccboxes

BD
Total Kill 28x Fix 4x