【缉毒卫队测试包】第43期 20180105

Luca.l

ccav

Dust-;羅錠

Symantec Files Submitted

#	Filename	MD5	Determination	Signature Protection Name	RR Seq#
1	18.1.5.zip	0x7CD8EF3CC6E8EA04D2E373A556B0F09C	Archive	N/A	N/A
2	180105-7.PUP.RegUtility.exe.infected	0x2C24B38901884C3DD4647F248609A80B	Clean	N/A	N/A

540923555

WD干掉7个

你好，再见

2605276004x 发表于 2018-1-6 16:06
还是撤掉百度吧！百度的bd引擎和慧眼引擎早不更新了，云估计也要死。你电脑上有百度杀毒吗？很想知道这款 ...

当辅助可以，查杀时高时低的。。。

pal家族

一天过去了
瑞星v17
杀了5个、

weber001

腾讯电脑管家

【扫描结果】

扫描文件数:8
发现风险数:4
已处理风险数:4

小飞侠.net

X-Sec Antivirus ---（Windows 10 Creators Update（Redstone 2）....）：

Start Time: Sun Jan  7 09:32:35 2018
Scan Type: Custom Scan
Scan Target: C:\Users\Admin\Desktop\AVtest100\39141fb7180105
Heuristic Engine: Enabled
Cloud Engine: Enabled
Resolve Threats: Scan only
Database Version: 2018.01.06.01
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-1.Trojan.Emotet.exe.infected -> Cloud:Trojan.Win32.Emotet
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-2.Trojan.Johnnie.exe.infected -> Malware.Win32.RiskSign.Be!BS
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-3.Exploit.Emotet-Downloader.doc.infected -> Cloud:Macro.MSWord.Downloader
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-5.Backdoor.Rmansys.exe.infected -> Cloud:Trojan.Win32.Downloader
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-6.Miner.Minexmr.exe.infected -> Trojan.Win32.CoinMiner.Aa
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-7.PUP.RegUtility.exe.infected -> Cloud:PUA.Win32.Generic
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-8.Miner.Minergate.exe.infected -> Cloud:Trojan.Win32.Generic
Elapsed Time: 00:00:32
Total File: 8
Skipped File: 0
Infected File: 7



瑞星---（Windows 10 Creators Update（Redstone 2）....）：云引擎（开）RDM+引擎（开）   
                瑞星反恶软引擎命令行扫描器（社区交流版）                 


编译于：Sep 22 2017   15:07:50

提示：
  - 本工具供社区交流使用，请勿用于其他用途
  - 本工具没有恶意软件删除、清除、隔离功能
  - 本工具包含开发中的新特性，结果仅供参考

* 命令行中的选项开关：-output-json -log=C:\瑞星RDM+引擎\ScanLog_180107092911.log
* 获取恶软签名库最新版本 ...
* 下载恶软签名库配置文件 ...
* 创建恶软签名库升级组件 ...
* 计算并下载增量文件 ...
* 升级恶软签名库 ...
* 恶软签名库升级成功
* 扫描目标 : (1) C:\Users\Admin\Desktop\AVtest100\39141fb7180105

* 加载恶软签名库： C:\瑞星RDM+引擎/malware.rmd
* 恶软签名库加载成功，发布序号为 3482
* 读取恶软签名库配置 ...
* 云辅助扫描组件初始化失败.
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
扫描开始: Sun Jan 07 09:29:30 2018

{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\39141fb7180105\\18.1.5\\180105-5.Backdoor.Rmansys.exe.infected","infect":{"engine":"sha1","signature":"c2hhMTo4Wy//HXiv6jgKZvAvjdgkzwrv2A","threat":"Backdoor.Generic!8.CE"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\39141fb7180105\\18.1.5\\180105-1.Trojan.Emotet.exe.infected","infect":{"engine":"sha1","signature":"c2hhMTrU4p0PxufH0RaakRejYitvF2LWhQ","threat":"Trojan.Dovs!8.EB4C"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\39141fb7180105\\18.1.5\\180105-6.Miner.Minexmr.exe.infected","infect":{"engine":"classic","threat":"Trojan.Win32/64.XMR-Miner!1.ADCC"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\39141fb7180105\\18.1.5\\180105-4.Backdoor.Blouiroet.exe.infected","infect":{"engine":"sha1","signature":"c2hhMTpMIZzKPU0Tn08E6YqUKreHeAzThg","threat":"Trojan.Blouiroet!8.ECDC"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\39141fb7180105\\18.1.5\\180105-2.Trojan.Johnnie.exe.infected","infect":{"engine":"sha1","signature":"c2hhMTp6/K7EaWI2S3fNjCTjz6g4VyjYow","threat":"Trojan.Farfli!8.FF"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\39141fb7180105\\18.1.5\\180105-8.Miner.Minergate.exe.infected","infect":{"engine":"sha1","signature":"c2hhMTr+QNr+4llwkDgnMGn+J+SRW5Mliw","threat":"Trojan.Injector!8.C4"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\39141fb7180105\\18.1.5\\180105-7.PUP.RegUtility.exe.infected","type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\39141fb7180105\\18.1.5\\180105-3.Exploit.Emotet-Downloader.doc.infected","type":"scan"}

扫描结束: Sun Jan 07 09:29:30 2018

总扫描耗时: 0:0:723(m:s:ms)
总扫描对象: 12
总扫描文件: 8
总恶意文件: 6
有效检出率: 75.00%



Emsisoft Emergency Kit - 版本 2017.12
上次更新： 2018/1/7 8:47:35
用户帐号： TECLAST\Admin
电脑名称： TECLAST
操作系统版本： Windows 10x64

Emsisoft Emergency Kit 绿色免费版
(已开启)加入 Emsisoft 云、更新源：测试版
    Bitdefender（B）+Emsisoft（A） 双引擎

扫描设置：

扫描方式： 自定义扫描
对象： Rootkits, 内存, C:\Users\Admin\Desktop\AVtest100\39141fb7180105\

检测流氓软件(PUPs)： On
扫描压缩包： On
扫描邮件存档： On
ADS数据流： On
文件扩展名过滤： Off
直接磁盘访问： Off

扫描开始于：        2018/1/7 9:24:48
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-4.Backdoor.Blouiroet.exe.infected -> (NSIS o) -> zlib_nsis0002         发现风险： Gen:Variant.Zusy.230926 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-1.Trojan.Emotet.exe.infected         发现风险： Backdoor.Emotet.E (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-5.Backdoor.Rmansys.exe.infected         发现风险： Trojan.GenericKD.12729852 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-3.Exploit.Emotet-Downloader.doc.infected         发现风险： W97M.Downloader.GOR (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-6.Miner.Minexmr.exe.infected         发现风险： Generic.Application.CoinMiner.1.506B11BD (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-8.Miner.Minergate.exe.infected         发现风险： Trojan-MSIL.Crypted.Gen (A) [288787]
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-2.Trojan.Johnnie.exe.infected         发现风险： Gen:Variant.Johnnie.24281 (B) [krnl.xmd]

已扫描        1760
发现        7

扫描完成后：        2018/1/7 9:25:05
扫描时间：        0:00:17



ESET Smart Security Premium 64位（高级启发式（Y）+压缩文件（Y）+自解压加壳（Y）+DNA智能签名（Y）++（Windows 10 Creators Update（Redstone 2）....）：Found nothing

-----7号？5年前前前前

日志
正在扫描日志
检测引擎的版本: 16694 (20180106)
日期: 2018/1/7  时间: 9:18:00
已扫描的磁盘、文件夹和文件: C:\Users\Admin\Desktop\AVtest100\39141fb7180105
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-1.Trojan.Emotet.exe.infected - Win32/Kryptik.GBGA 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-2.Trojan.Johnnie.exe.infected - Win32/Farfli.CLN 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-3.Exploit.Emotet-Downloader.doc.infected - VBA/TrojanDownloader.Agent.GCO 特洛伊木马 - 已清除
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-4.Backdoor.Blouiroet.exe.infected > NSIS > Client.exe - Win32/Delf.BBD 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-5.Backdoor.Rmansys.exe.infected - MSIL/TrojanDownloader.Tiny.RM 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-7.PUP.RegUtility.exe.infected - Win32/Adware.Regutility.A 应用程序 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\39141fb7180105\18.1.5\180105-8.Miner.Minergate.exe.infected - MSIL/Injector.SLR 特洛伊木马 的变种 - 通过删除清除 [1]
已扫描的对象数: 13
发现的威胁数: 7
已清除对象数: 7
完成时间: 9:18:08  总扫描时间: 8 秒 (00:00:08)

备注:
[1] 由于对象中仅包含病毒主体，因此已被删除。



火绒安全---（ Windows 7 Ultimate with SP1 简体中文旗舰版....）：部分未知文件已发送到seclab@huorong.cn，等处理中。。。

病毒库：2018/01/06 16:45
开始时间：2018/01/07 09:10
总计用时：00:00:04
扫描对象：51个
扫描文件：8个
发现风险：8个
已处理风险：0个
发现系统修复项：0个
处理系统修复项：0个

文件名称: C:\Users\xfxnet2000\Desktop\MX Player Pro\刘1\艾2\61647309\85014225\孙3\Windows Defender\AVTestZipX\18.1.5.7z
文件大小: 4.15 MB (4,352,985 字节)
修改时间: 2018年01月07日，09:07:13
MD5: c914eab0cffcdefd89c379ce60a3dd23
SHA1: 39f74867ab184eb444838cb7c9552808491452c2
SHA256: 58adfb1218b8eb265662d20ec3e9539da566881dd27194a66a9579b848d9e7aa
SHA512: 2299f5cba7b356f70c4b8720c00a63aa18c0b575a5e3119537cde3fb9cc91a550ddff39875588c613c80c5cbf9bee3f3092085ae9a62a2d735e820136c96eff8
CRC32: 39141fb7
计算时间: 0.13s



病毒详情

风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\刘1\艾2\61647309\85014225\孙3\Windows Defender\AVTestZipX\18.1.5\180105-1.Trojan.Emotet.exe.infected, 病毒名：Trojan/Generic!4DBCE1658D7D13AA, 病毒ID：[4dbce1658d7d13aa], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\刘1\艾2\61647309\85014225\孙3\Windows Defender\AVTestZipX\18.1.5\180105-5.Backdoor.Rmansys.exe.infected, 病毒名：Trojan/Generic!E3CA1A73FB1AEAF3, 病毒ID：[e3ca1a73fb1aeaf3], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\刘1\艾2\61647309\85014225\孙3\Windows Defender\AVTestZipX\18.1.5\180105-3.Exploit.Emotet-Downloader.doc.infected, 病毒名：HEUR:OMacro/Obfuscated.c, 病毒ID：[7e6f1720bf6936fa], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\刘1\艾2\61647309\85014225\孙3\Windows Defender\AVTestZipX\18.1.5\180105-2.Trojan.Johnnie.exe.infected, 病毒名：Trojan/Generic!9A68B21E7485CAAB, 病毒ID：[9a68b21e7485caab], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\刘1\艾2\61647309\85014225\孙3\Windows Defender\AVTestZipX\18.1.5\180105-6.Miner.Minexmr.exe.infected, 病毒名：HackTool/CoinMiner.a, 病毒ID：[94b329a11759cb2], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\刘1\艾2\61647309\85014225\孙3\Windows Defender\AVTestZipX\18.1.5\180105-8.Miner.Minergate.exe.infected, 病毒名：Trojan/Generic!90055109FB5A8A02, 病毒ID：[90055109fb5a8a02], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\刘1\艾2\61647309\85014225\孙3\Windows Defender\AVTestZipX\18.1.5\180105-7.PUP.RegUtility.exe.infected, 病毒名：HEUR:Trojan/Startpage.b, 病毒ID：[4fc3ef17cd6a1462], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\刘1\艾2\61647309\85014225\孙3\Windows Defender\AVTestZipX\18.1.5\180105-4.Backdoor.Blouiroet.exe.infected, 病毒名：Trojan/Generic!20006692655C7A1A, 病毒ID：[20006692655c7a1a], 处理结果：已忽略

su333777

"180105-1.Trojan.Emotet.exe.infected","Trojan.Gen.2","已通过删除清除","病毒","自动防护扫描","C:\Users\21169\Downloads\","DESKTOP-58M617D","21169","已删除","已删除","清除安全风险","隔离","已成功地删除了文件。","2018/1/12 18:37:26"
"180105-1.Trojan.Emotet.exe.infected","Trojan.Gen.2","已通过删除清除","病毒","自动防护扫描","C:\Users\21169\Downloads\","DESKTOP-58M617D","21169","已删除","已删除","清除安全风险","隔离","已成功地删除了文件。","2018/1/12 18:37:27"
"180105-2.Trojan.Johnnie.exe.infected","Trojan.Gen.2","已清除","病毒","自动防护扫描","C:\Users\21169\Downloads\","DESKTOP-58M617D","21169","已清除","C:\Users\21169\Downloads\","清除安全风险","隔离","已成功地修复了文件。","2018/1/12 18:37:44"
"180105-3.Exploit.Emotet-Downloader.doc.infected","W97M.Downloader","已隔离","病毒","自动防护扫描","C:\Users\21169\Downloads\","DESKTOP-58M617D","21169","受感染","隔离","清除安全风险","隔离","已经成功地隔离了文件。","2018/1/12 18:38:04"
"180105-4.Backdoor.Blouiroet.exe.infected","Trojan.Gen.2","已清除","病毒","自动防护扫描","C:\Users\21169\Downloads\","DESKTOP-58M617D","21169","已清除","C:\Users\21169\Downloads\","清除安全风险","隔离","已成功地修复了文件。","2018/1/12 18:38:31"
"180105-5.Backdoor.Rmansys.exe.infected","Trojan.Gen","已清除","病毒","自动防护扫描","C:\Users\21169\Downloads\","DESKTOP-58M617D","21169","已清除","C:\Users\21169\Downloads\","清除安全风险","隔离","已成功地修复了文件。","2018/1/12 18:38:50"
"180105-6.Miner.Minexmr.exe.infected","Trojan Horse","已隔离","病毒","自动防护扫描","C:\Users\21169\Downloads\","DESKTOP-58M617D","21169","受感染","隔离","清除安全风险","隔离","已经成功地隔离了文件。","2018/1/12 18:39:09"
"180105-8.Miner.Minergate.exe.infected","Trojan.Gen.2","已清除","病毒","自动防护扫描","C:\Users\21169\Downloads\","DESKTOP-58M617D","21169","已清除","C:\Users\21169\Downloads\","清除安全风险","隔离","已成功地修复了文件。","2018/1/12 18:39:27"
"180105-1.Trojan.Emotet.exe.infected","Trojan.Emotet","已通过删除清除","病毒","自动防护扫描","C:\Users\21169\Downloads\","DESKTOP-58M617D","21169","已删除","已删除","清除安全风险","隔离","已成功地删除了文件。","2018/1/12 18:37:27"
sep14