【缉毒卫队测试包】第44期 20180518

Nocria

VIPRE killed 7x.


AAP blocked 180518-09-Worm.Mansabo.exe

a27573

ESET kill 9/10

1. 时间;扫描程序;对象类型;对象;威胁;操作;用户;信息;哈希;此处首次所见
   
2. 2018/5/18 19:24:07;文件系统实时防护;文件;F:\病毒\收集\包(长期)\缉毒卫队\jdwd180518\180518-06-Backdoor.Bladabindi.exe.infected;MSIL/Bladabindi.BC 特洛伊木马;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\7-Zip\7zG.exe (D9CB36B2A1FA92D8866A63C48E94F04D7E96062D).;F581CED2BB72F3E603A4390F0468BB2748E95D96;2018/5/18 19:23:58
   
3. 2018/5/18 19:24:07;文件系统实时防护;文件;F:\病毒\收集\包(长期)\缉毒卫队\jdwd180518\180518-04-Java.Adwind.jar.infected;Generik.CMWIVCT 特洛伊木马 的变种;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\7-Zip\7zG.exe (D9CB36B2A1FA92D8866A63C48E94F04D7E96062D).;8C25285D5151F66F0BFBF25EF065712A82152B8F;2018/5/18 19:23:58
   
4. 2018/5/18 19:24:07;文件系统实时防护;文件;F:\病毒\收集\包(长期)\缉毒卫队\jdwd180518\180518-07-Backdoor.LokiBot.exe.infected;Win32/Injector.DYAX 特洛伊木马 的变种;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\7-Zip\7zG.exe (D9CB36B2A1FA92D8866A63C48E94F04D7E96062D).;3F194B07AC25D3ACA1CE39C069508DB64572A981;2018/5/18 19:23:58
   
5. 2018/5/18 19:24:07;文件系统实时防护;文件;F:\病毒\收集\包(长期)\缉毒卫队\jdwd180518\180518-02-Backdoor.Apost.exe.infected;Win32/Tabuvys.H 特洛伊木马 的变种;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\7-Zip\7zG.exe (D9CB36B2A1FA92D8866A63C48E94F04D7E96062D).;21F52A5F8C6139701CC6810985F77DBF514A0967;2018/5/18 19:23:58
   
6. 2018/5/18 19:24:08;文件系统实时防护;文件;F:\病毒\收集\包(长期)\缉毒卫队\jdwd180518\180518-03-Miner.Luckybbjason.exe.infected;多个威胁;通过删除清除;JINXY\宇;在新建的文件上发生事件。;DA50D00A1C61E22F247C9E36A299858FD9FE2D38;
   
7. 2018/5/18 19:24:14;文件系统实时防护;文件;F:\病毒\收集\包(长期)\缉毒卫队\jdwd180518\180518-05-PUP.SilentInstall.exe.infected;Win32/SilentInstall.A 潜在的不受欢迎应用程序;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\7-Zip\7zG.exe (D9CB36B2A1FA92D8866A63C48E94F04D7E96062D).;C5EE59D876C13221264644D3B3825B88AD10B9C9;2018/5/18 19:23:58
   
8. 2018/5/18 19:24:17;文件系统实时防护;文件;F:\病毒\收集\包(长期)\缉毒卫队\jdwd180518\180518-10.PUP.ASK.exe.infected;Win32/Bundled.Toolbar.Ask.R 潜在的不安全应用程序 的变种;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\7-Zip\7zG.exe (D9CB36B2A1FA92D8866A63C48E94F04D7E96062D).;C5EE027F491413820AEAE49E258FD355F23DF5A7;2018/5/18 19:23:58
   

复制代码

1. 日志
   
2. F:\病毒\收集\包(长期)\缉毒卫队\jdwd180518\180518-01-Backdoor.Lokibot.exe.infected - Win32/Injector.DYBI 特洛伊木马 的变种 - 通过删除清除 [1]
   
3. F:\病毒\收集\包(长期)\缉毒卫队\jdwd180518\180518-09-Worm.Mansabo.exe.infected - Win32/Injector.DYBH 特洛伊木马 的变种 - 通过删除清除 [1]
   

复制代码

心醉咖啡

毒霸

1. 扫描时间：[2018-05-18 19:30:33]
   
2. 扫描用时：[00:00:18]
   
3. 扫描类型：自定义查杀
   
4. 扫描文件总数：289
   
5. 扫描速度：15文件/秒
   
6. 发现威胁：3个
   
7. 清除威胁：3个
   
8. =============================================
   
9. [2018-05-18 19:31:03]
   
10. 威胁：f:\浏览器下载\jdwd180518\180518-03-miner.luckybbjason.exe.infected
    
11. 类型：win32.troj.undef.(kcloud)
    
12. 处理方式：删除
    
13. 
    
14. [2018-05-18 19:31:03]
    
15. 威胁：f:\浏览器下载\jdwd180518\180518-05-pup.silentinstall.exe.infected
    
16. 类型：win32.troj.generic_a.a.(kcloud)
    
17. 处理方式：删除
    
18. 
    
19. [2018-05-18 19:31:03]
    
20. 威胁：f:\浏览器下载\jdwd180518\180518-06-backdoor.bladabindi.exe.infected
    
21. 类型：heur.ssc.2763936.1216.(kcloud)
    
22. 处理方式：删除
    
23. 
    

复制代码

Jerry.Lin

AVIRA MISS jar

KLL ALL OTHER

wangyuhe

迈克菲扫描杀7x,剩05,08,10

WCMS

BD 8/10

popu111

360TS: 5xZemana: 4x

引领五基生活

1. Basic Info:
   
2. ---------------------
   
3. Database Version: 2018.05.17.01
   
4. Program Version: 2.1.1.0
   
5. Heuristic Engine: Enabled
   
6. Cloud Engine: Enabled
   
7. Enhanced Mode: Disabled
   
8. Backup Before Resolve: Yes
   
9. Resolve Threats: Scan only
   
10. Scan Priority: Normal
    
11. ---------------------
    
12. Targets:
    
13. ---------------------
    
14. C:\Users\Administrator\Desktop\jdwd180518
    
15. ---------------------
    
16. 2018/05/18 20:55:56 Threat Detected: C:\Users\Administrator\Desktop\jdwd180518\180518-02-Backdoor.Apost.exe.infected -- [Cloud] Cloud:Trojan.Win32.Generic
    
17. 2018/05/18 20:55:57 Threat Detected: C:\Users\Administrator\Desktop\jdwd180518\180518-01-Backdoor.Lokibot.exe.infected -- [Cloud] Cloud:Trojan.Win32.LokiBot
    
18. 2018/05/18 20:56:05 Threat Detected: C:\Users\Administrator\Desktop\jdwd180518\180518-03-Miner.Luckybbjason.exe.infected -- [Cloud] Cloud:Trojan.Win64.CoinMiner
    
19. 2018/05/18 20:56:05 Threat Detected: C:\Users\Administrator\Desktop\jdwd180518\180518-06-Backdoor.Bladabindi.exe.infected -- [Classic] Backdoor.Win32.Bladabindi.A
    
20. 2018/05/18 20:56:06 Threat Detected: C:\Users\Administrator\Desktop\jdwd180518\180518-08-VBA.Powershell.doc.infected -- [Cloud] Cloud:Exploit.RTF.Generic
    
21. 2018/05/18 20:56:06 Threat Detected: C:\Users\Administrator\Desktop\jdwd180518\180518-09-Worm.Mansabo.exe.infected -- [Cloud] Cloud:Trojan.Win32.Injector
    
22. 2018/05/18 20:56:07 Threat Detected: C:\Users\Administrator\Desktop\jdwd180518\180518-10.PUP.ASK.exe.infected -- [Classic] Adware.Win32.AskPartner.A!BS
    
23. 2018/05/18 20:56:07 Threat Detected: C:\Users\Administrator\Desktop\jdwd180518\180518-07-Backdoor.LokiBot.exe.infected -- [Cloud] Cloud:Trojan.Win32.LokiBot

复制代码

X-Sec 8x

余下

1. 180518-05-PUP.SilentInstall.exe.infected
   
2. 180518-04-Java.Adwind.jar.infected

复制代码

欧阳宣

Malwarebytes

File: 7
Backdoor.NJRat, C:\USERS\JEFF6\DOWNLOADS\JDWD180518\180518-06-BACKDOOR.BLADABINDI.EXE.INFECTED, No Action By User, [4116], [277642],1.0.5158
Trojan.MalPack, C:\USERS\JEFF6\DOWNLOADS\JDWD180518\180518-03-MINER.LUCKYBBJASON.EXE.INFECTED, No Action By User, [3831], [515612],1.0.5158
Backdoor.NanoCore, C:\USERS\JEFF6\DOWNLOADS\JDWD180518\180518-01-BACKDOOR.LOKIBOT.EXE.INFECTED, No Action By User, [943], [523060],1.0.5158
PUP.Optional.ASK.Generic, C:\USERS\JEFF6\DOWNLOADS\JDWD180518\180518-10.PUP.ASK.EXE.INFECTED, No Action By User, [1953], [345551],1.0.5158
Spyware.LokiBot, C:\USERS\JEFF6\DOWNLOADS\JDWD180518\180518-07-BACKDOOR.LOKIBOT.EXE.INFECTED, No Action By User, [4396], [522647],1.0.5158
MachineLearning/Anomalous.100%, C:\USERS\JEFF6\DOWNLOADS\JDWD180518\180518-09-WORM.MANSABO.EXE.INFECTED, No Action By User, [0], [392687],1.0.5158
Generic.Malware/Suspicious, C:\USERS\JEFF6\DOWNLOADS\JDWD180518\180518-02-BACKDOOR.APOST.EXE.INFECTED, No Action By User, [0], [392686],1.0.5158

ziyerain2015

5-7-9-10
其他查杀