【05.17】#VirusPackage 8x

，就一个.

20点 迈克菲杀7个，剩余4.exe号miss
22.20分咖啡清空

心醉咖啡

毒霸扫描miss

祭丿祀

191196846 发表于 2018-5-17 17:49
是的呢

https://bbs.kafan.cn/thread-2122984-1-1.html

你这是WIN7系统吗？

x291502676

，就一个. 发表于 2018-5-17 20:01
迈克菲杀7个，剩余4.exe号miss

行为防护没拦截么？

Jerry.Lin

祭丿祀 发表于 2018-5-17 21:30
你这是WIN7系统吗？

win10 14393

祭丿祀

191196846 发表于 2018-5-17 22:27
win10 14393

用的是147版本还是148？

Jerry.Lin

祭丿祀 发表于 2018-5-17 22:53
用的是147版本还是148？

148

欧阳宣

Malwarebytes

File: 7
Trojan.PasswordStealer.VB, C:\USERS\JEFF6\DOWNLOADS\VIRUS8X 0517\(6).EXE, No Action By User, [10031], [522743],1.0.5146
Spyware.PasswordStealer, C:\USERS\JEFF6\DOWNLOADS\VIRUS8X 0517\(5).EXE, No Action By User, [3499], [522478],1.0.5146
Trojan.Emotet, C:\USERS\JEFF6\DOWNLOADS\VIRUS8X 0517\(8).EXE, No Action By User, [6237], [522487],1.0.5146
Trojan.Emotet, C:\USERS\JEFF6\DOWNLOADS\VIRUS8X 0517\(7).EXE, No Action By User, [6237], [522487],1.0.5146
Generic.Malware/Suspicious, C:\USERS\JEFF6\DOWNLOADS\VIRUS8X 0517\(3).EXE, No Action By User, [0], [392686],1.0.5146
MachineLearning/Anomalous.95%, C:\USERS\JEFF6\DOWNLOADS\VIRUS8X 0517\(2).EXE, No Action By User, [0], [392687],1.0.5146
MachineLearning/Anomalous.96%, C:\USERS\JEFF6\DOWNLOADS\VIRUS8X 0517\(1).EXE, No Action By User, [0], [392687],1.0.5146

小飞侠.net

分卷压缩上传吧，网盘好慢。

小飞侠.net

                          ,,,                               ,,,      
X-Sec Antivirus ---（Windows 10 Creators Update（Redstone 4）....1803）：

Basic Info:
---------------------
Database Version: 2018.05.09.01
Program Version: [图片]2.1.1.0
Heuristic Engine: Enabled
Cloud Engine: Enabled
Enhanced Mode: Disabled
Backup Before Resolve: Yes
Resolve Threats: Scan only
Scan Priority: Normal
---------------------
Targets:
---------------------
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic
---------------------
2018/05/19 09:37:52 Threat Detected: C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(1).exe -- [Classic] [图片]Trojan.Win32.Generic.Ec
2018/05/19 09:37:56 Threat Detected: C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(2).exe -- [Cloud] Cloud:Trojan.Win32.Injector
2018/05/19 09:37:56 Threat Detected: C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(3).exe -- [Cloud] Cloud:Trojan.Win32.Injector
2018/05/19 09:38:00 Threat Detected: C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(4).exe -- [Cloud] Cloud:Trojan.Win32.LokiBot
2018/05/19 09:38:01 Threat Detected: C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(5).exe -- [Cloud] Cloud:Trojan.Win32.Infostealer
2018/05/19 09:38:01 Threat Detected: C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(6).exe -- [Cloud] Cloud:Trojan.Win32.Trickbot
2018/05/19 09:38:01 Threat Detected: C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(7).exe -- [Cloud] Cloud:Trojan.Win32.Emotet
2018/05/19 09:38:02 Threat Detected: C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(8).exe -- [Cloud] Cloud:Trojan.Win32.Emotet


  瑞星---（Windows 10 Creators Update（Redstone 4）....1803）：云引擎（开）RDM+引擎（开）   
                瑞星反恶软引擎命令行扫描器（社区交流版）                 


编译于：Sep 22 2017   15:07:50

提示：
  - 本工具供社区交流使用，请勿用于其他用途
  - 本工具没有恶意软件删除、清除、隔离功能
  - 本工具包含开发中的新特性，结果仅供参考

* 命令行中的选项开关：-output-json -log=C:\瑞星RDM+引擎\ScanLog_180519093404.log
* 获取恶软签名库最新版本 ...
* 下载恶软签名库配置文件 ...
* 创建恶软签名库升级组件 ...
* 计算并下载增量文件 ...
* 升级恶软签名库 ...
* 恶软签名库升级成功
* 扫描目标 : (1) C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic

* 加载恶软签名库： C:\瑞星RDM+引擎/malware.rmd
* 恶软签名库加载成功，发布序号为 4263
* 读取恶软签名库配置 ...
* 云辅助扫描组件初始化失败.
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
扫描开始: Sat May 19 09:34:20 2018

{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\Virus8x 0517Generic\\Virus8x 0517\\(8).exe","infect":{"engine":"tfe","signature":"dGZlOgFnTNvq2CJzVQ","threat":"Trojan.Crypto!8.364"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\Virus8x 0517Generic\\Virus8x 0517\\(7).exe","infect":{"engine":"sha1","signature":"c2hhMTrn11JC2Eyp/1uhJOYCeZ11Acp6Ug","threat":"Trojan.Crypto!8.364"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\Virus8x 0517Generic\\Virus8x 0517\\(2).exe","infect":{"engine":"rdmk","signature":"cmRtazo12L1EIkiBCukH25SX6fL/","threat":"Malware.Heuristic!ET#96%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\Virus8x 0517Generic\\Virus8x 0517\\(6).exe","infect":{"engine":"sha1","signature":"c2hhMTosIiz5dquTxjpJS6ssS/NbDjyJSg","threat":"Dropper.VB!8.B2E"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\Virus8x 0517Generic\\Virus8x 0517\\(3).exe","infect":{"engine":"sha1","signature":"c2hhMTqA2THCzn4qpwH9tQI4qlQFTKJYjg","threat":"Trojan.VBKrypt!8.5C0"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\Virus8x 0517Generic\\Virus8x 0517\\(1).exe","infect":{"engine":"c64","signature":"YzY0OkMVSs29mvNK","threat":"Dropper.Generic!8.35E"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\Virus8x 0517Generic\\Virus8x 0517\\(5).exe","infect":{"engine":"sha1","signature":"c2hhMTrkFb2tfY6bYaDTEiPvFfxM3Dflmw","threat":"Trojan.Injector!1.AFE3"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\Virus8x 0517Generic\\Virus8x 0517\\(4).exe","type":"scan"}

扫描结束: Sat May 19 09:34:21 2018

总扫描耗时: 0:0:722(m:s:ms)
总扫描对象: 8
总扫描文件: 8
总恶意文件: 7
有效检出率: 87.50%



Emsisoft Emergency Kit - 版本 2018.3
上次更新： 2018/5/19 8:42:49
用户帐号： TECLAST\Admin
电脑名称： TECLAST
操作系统版本： Windows 10x64

Emsisoft Emergency Kit 绿色免费版
(已开启)加入 Emsisoft 云、更新源：测试版
    Bitdefender（B）+Emsisoft（A） 双引擎

扫描设置：

扫描方式： 自定义扫描
对象： Rootkits, C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\

检测流氓软件(PUPs)： On
扫描压缩包： On
扫描邮件存档： Off
ADS数据流： On
文件扩展名过滤： Off
直接磁盘访问： Off

扫描开始于：        2018/5/19 9:28:50
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(3).exe         发现风险： Trojan.GenericKD.30811134 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(2).exe         发现风险： Trojan.GenericKD.40256695 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(6).exe         发现风险： Gen:Variant.Johnnie.100193 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(4).exe         发现风险： Gen:Variant.Graftor.490740 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(7).exe         发现风险： Gen:Variant.Razy.323527 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(5).exe         发现风险： Gen:Variant.Zusy.284821 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(1).exe         发现风险： Trojan.GenericKD.40252203 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(8).exe         发现风险： Gen:Variant.Razy.323527 (B) [krnl.xmd]

已扫描        602
发现        8

扫描完成后：        2018/5/19 9:29:00
扫描时间：        0:00:10



ESET Smart Security Premium 64位（高级启发式（Y）+压缩文件（Y）+自解压加壳（Y）+DNA智能签名（Y）++（Windows 10 Creators Update（Redstone 4）....1803）：

日志
正在扫描日志
检测引擎的版本: 17409P (20180518)
日期: 2018/5/19  时间: 9:24:59
已扫描的磁盘、文件夹和文件: C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(1).exe - MSIL/TrojanDropper.Agent.DNB 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(2).exe - Win32/Injector.BMCZ 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(3).exe - Win32/Injector.DYAS 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(4).exe - Win32/Injector.DYBG 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(5).exe - Win32/Injector.DYAC 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(6).exe - Win32/[图片]TrickBot.AQ 特洛伊木马 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(7).exe - Win32/Kryptik.GGUO 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\Virus8x 0517Generic\Virus8x 0517\(8).exe - Win32/Kryptik.GGUO 特洛伊木马 的变种 - 通过删除清除 [1]
已扫描的对象数: 8
发现的威胁数: 8
已清除对象数: 8
完成时间: 9:25:13  总扫描时间: 14 秒 (00:00:14)

备注:
[1] 由于对象中仅包含病毒主体，因此已被删除。



Dr.Web CureIt! 简体中文绿色免费版---（Windows 10 Creators Update（Redstone 4）....1803）：

-----------------------------------------------------------------------------
Start scanning
-----------------------------------------------------------------------------
Command line used:-rpcep:\pipe\1818656EB -rpcpr:np

Limit the use of the computer resources to 100%
Instances used for this session: 10
Object(s) to scan:
- C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360


C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\py01uap1.exe:Zone.Identifier - Ok
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517Generic.zipx is ZIP archive
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517Generic.zipx - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517Generic.zipx - archive
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(5).exe - infected with Trojan.DownLoader26.45824
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(5).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517.rar:Zone.Identifier - Ok
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517.rar is RAR archive
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517.rar - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517.rar - archive
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(3).exe - is hacktool program Tool.PassView.1875
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(4).exe - infected with Trojan.PWS.Stealer.23680
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(8).exe - infected with Trojan.Siggen7.54431
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(4).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(3).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(8).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(7).exe - infected with Trojan.DownLoad4.11425
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(7).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(6).exe - infected with Trojan.PWS.Stealer.23819
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(6).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(2).exe - infected with Trojan.DownLoader19.57204
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(2).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(1).exe - infected with Trojan.DownLoader26.9526
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(1).exe - infected
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\py01uap1.exe is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\py01uap1.exe\data001 - packed by BINARYRES
>>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\py01uap1.exe\data001 - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\py01uap1.exe\data002 is BINARYRES container
>>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\py01uap1.exe\data002\data002 - packed by FLY-CODE
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\py01uap1.exe - container

Total 183050735 bytes in 13 files scanned (17 objects)
Total 5 files (9 objects) are clean
Total 8 files are infected
Scan time is 00:00:02.003


火绒安全---（ Windows 7 Ultimate with SP1 简体中文旗舰版....）：部分未知文件已发送到seclab@huorong.cn，等处理中。。。

病毒库：2018-05-18 16:00
开始时间：2018-05-19 08:57
总计用时：00:00:02
扫描对象：8个
扫描文件：8个
发现风险：8个
已处理风险：0个
发现系统修复项：0个
处理系统修复项：0个

病毒详情

风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(1).exe, 病毒名：Trojan/Generic!3D3522F5FAC38903, 病毒ID：[3d3522f5fac38903], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(4).exe, 病毒名：HEUR:Trojan/VBCode.be, 病毒ID：[58ecd128ab121f57], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(3).exe, 病毒名：Trojan/Generic!E0C6A580F9BF1BD5, 病毒ID：[e0c6a580f9bf1bd5], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(6).exe, 病毒名：Trojan/Generic!D133AE1EE623DD5B, 病毒ID：[d133ae1ee623dd5b], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(7).exe, 病毒名：Trojan/Generic!A9D229493864F8C7, 病毒ID：[a9d229493864f8c7], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(5).exe, 病毒名：Trojan/Generic!B8BD7D2787AB03ED, 病毒ID：[b8bd7d2787ab03ed], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(8).exe, 病毒名：Trojan/Generic!9901C13E6D8B8753, 病毒ID：[9901c13e6d8b8753], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517\(2).exe, 病毒名：HEUR:Trojan/FakeSoft, 病毒ID：[30b88d191ab94225], 处理结果：已忽略

文件名称: C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\Virus8x 0517.rar
文件大小: 1.81 MB (1,906,260 字节)
修改时间: 2018年05月19日，08:49:01
MD5: 3F74E3AEA27FFDE85EFBC74DC7ACD672
SHA1: 9A33A43F0D5AC9ADB29E19662E64377E9704A0D5
SHA256: 66FAA7E73645AE8C432307558E9020D024AB0B01921EC98C57CC964AFA346915
SHA512: 4E9838D53E0350C506C51E9B0CBF8FE23D384A1E501F2D3C51E557111E23DF9CBE0FACDDBB68DF252DE4ED30C95AD21883691BB1160C3CDABA0C696FA8223FA9
CRC32: 56EDE3E7
计算时间: 0.05s