123
返回列表 发新帖
楼主: 神龟Turmi
收起左侧

[病毒样本] 【缉毒卫队测试包】第48期 20180524

  [复制链接]
skycai
发表于 2018-5-25 07:33:29 | 显示全部楼层
iobit用的是哪家的引擎
??
dongwenqi
发表于 2018-5-25 08:03:32 | 显示全部楼层
skycai 发表于 2018-5-25 07:33
iobit用的是哪家的引擎
??

应该是BD引擎
abc277399
头像被屏蔽
发表于 2018-5-25 08:41:33 | 显示全部楼层
360杀毒扫描日志

病毒库版本:2018-05-24 19:30
扫描时间:2018-05-25 08:40:23
扫描用时:00:00:04
扫描类型:右键扫描
扫描文件总数:14
项目总数:10
清除项目数:10

扫描选项
----------------------
扫描所有文件:否
扫描压缩包:否
发现病毒处理方式:由用户选择处理
扫描磁盘引导区:是
扫描 Rootkit:否
使用云查杀引擎:是
使用QVM人工智能引擎:是
扫描建议修复项:是
常规引擎设置:Avira(小红伞)

扫描内容
----------------------
C:\Users\A\Desktop\新建文件夹


白名单设置
----------------------


扫描结果
======================
高危风险项
----------------------
C:\Users\A\Desktop\新建文件夹\jdwd180524.7z        virus.exp.21711882.d        已删除
C:\Users\A\Desktop\新建文件夹\jdwd180524\180524-1-CVE-2017-1188.rtf.infected        virus.exp.21711882.d        已删除
C:\Users\A\Desktop\新建文件夹\jdwd180524\180524-2-RAT.131186113135.exe.infected        感染型病毒(Win32/Trojan.396)        已删除
C:\Users\A\Desktop\新建文件夹\jdwd180524\modifed\180524-2-RAT.131186113135.exe.infected        感染型病毒(Win32/Trojan.396)        已删除
C:\Users\A\Desktop\新建文件夹\jdwd180524\modifed\180524-6-PUP.ConvertAD.exe.infected        HEUR/QVM10.1.6183.Malware.Gen        已删除
C:\Users\A\Desktop\新建文件夹\jdwd180524\modifed\180524-5-PWS.Myexternalip.exe.infected        感染型病毒(Win32/Trojan.PSW.dee)        已删除
C:\Users\A\Desktop\新建文件夹\jdwd180524\modifed\180524-7-RAT.Aataki.exe.infected        感染型病毒(Win32/Trojan.536)        已删除
C:\Users\A\Desktop\新建文件夹\jdwd180524\180524-5-PWS.Myexternalip.exe.infected        HEUR/QVM05.1.630E.Malware.Gen        已删除
C:\Users\A\Desktop\新建文件夹\jdwd180524\180524-6-PUP.ConvertAD.exe.infected        感染型病毒(Win32/Trojan.Adware.280)        已删除
C:\Users\A\Desktop\新建文件夹\jdwd180524\180524-7-RAT.Aataki.exe.infected        TR.Dropper.MSIL.175378        已删除

lqgeren
发表于 2018-5-25 08:52:44 | 显示全部楼层
ESET endpoint6.6 + 5月24日
余3个未报警。

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
con16
发表于 2018-5-25 09:26:33 | 显示全部楼层
CIS 掃描抓到七隻
mengrufeihua
头像被屏蔽
发表于 2018-5-25 20:25:12 | 显示全部楼层
提示: 该帖被管理员或版主屏蔽
b17273896
发表于 2018-5-25 20:59:59 | 显示全部楼层
emsisoft隔离11个

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
潘基炫
发表于 2018-5-26 16:36:05 | 显示全部楼层
卡巴9x
这几天忙,好久没上卡饭了

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
小飞侠.net
发表于 2018-5-27 19:35:41 | 显示全部楼层
本帖最后由 小飞侠.net 于 2018-5-27 20:17 编辑

                        X-Sec Antivirus ---(Windows 10 Creators Update(Redstone 4)....1803):
Basic Info:
---------------------
Database Version: 2018.05.25.01
Program Version: [图片]2.1.1.0
Heuristic Engine: Enabled
Cloud Engine: Enabled
Enhanced Mode: Disabled
Backup Before Resolve: Yes
Resolve Threats: Scan only
Scan Priority: Normal
---------------------
Targets:
---------------------
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86
---------------------
2018/05/27 20:18:09 Threat Detected: C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-2-RAT.131186113135.exe.infected -- [Cloud] Cloud:Trojan.Win32.Infostealer
2018/05/27 20:18:09 Threat Detected: C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-1-CVE-2017-1188.rtf.infected -- [Cloud] Cloud:Exploit.RTF.Generic
2018/05/27 20:18:10 Threat Detected: C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-6-PUP.ConvertAD.exe.infected -- [Cloud] Cloud:Trojan.Win32.Generic
2018/05/27 20:18:10 Threat Detected: C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-7-RAT.Aataki.exe.infected -- [Classic] Backdoor.Win32.Agent.BQ
2018/05/27 20:18:23 Threat Detected: C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-8-PUP.Oleacc.exe.infected -- [Cloud] Cloud:Trojan.Win32.Kryptic
2018/05/27 20:18:24 Threat Detected: C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\modifed\180524-2-RAT.131186113135.exe.infected -- [Cloud] Cloud:Trojan.Win32.Infostealer
2018/05/27 20:18:26 Threat Detected: C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-5-PWS.Myexternalip.exe.infected -- [Cloud] Cloud:Trojan.Win32.Injector
2018/05/27 20:18:26 Threat Detected: C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\modifed\180524-6-PUP.ConvertAD.exe.infected -- [Cloud] Cloud:Trojan.Win32.Generic
2018/05/27 20:18:26 Threat Detected: C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\modifed\180524-7-RAT.Aataki.exe.infected -- [Classic] Backdoor.Win32.Agent.BQ

瑞星---(Windows 10 Creators Update(Redstone 4)....1803):云引擎(开)RDM+引擎(开)   

                瑞星反恶软引擎命令行扫描器(社区交流版)                 


编译于:Sep 22 2017   15:07:50

提示:
  - 本工具供社区交流使用,请勿用于其他用途
  - 本工具没有恶意软件删除、清除、隔离功能
  - 本工具包含开发中的新特性,结果仅供参考

* 命令行中的选项开关:-output-json -log=C:\瑞星RDM+引擎\ScanLog_180527201142.log
* 获取恶软签名库最新版本 ...
* 下载恶软签名库配置文件 ...
* 创建恶软签名库升级组件 ...
* 计算并下载增量文件 ...
* 升级恶软签名库 ...
* 恶软签名库升级成功
* 扫描目标 : (1) C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86

* 加载恶软签名库: C:\瑞星RDM+引擎/malware.rmd
* 恶软签名库加载成功,发布序号为 4299
* 读取恶软签名库配置 ...
* 云辅助扫描组件初始化失败.
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
扫描开始: Sun May 27 20:11:47 2018

{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\jdwd180524Agent053F0D86\\jdwd180524\\180524-2-RAT.131186113135.exe.infected","infect":{"engine":"sha1","signature":"c2hhMTo3ySjCZe4Arf5D3G6qWE7XAneQPQ","threat":"Trojan.Kryptik!8.8"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\jdwd180524Agent053F0D86\\jdwd180524\\180524-1-CVE-2017-1188.rtf.infected","infect":{"engine":"sha1","signature":"c2hhMTpNCynWAskAySkyMIsFVVT+9YsYAw","threat":"Exploit.Generic!8.3E1"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\jdwd180524Agent053F0D86\\jdwd180524\\180524-7-RAT.Aataki.exe.infected","infect":{"engine":"sha1","signature":"c2hhMTrrLFw7epuweh62UpcE9ZBVATAyzw","threat":"Backdoor.Pontoeb!1.6637"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\jdwd180524Agent053F0D86\\jdwd180524\\180524-6-PUP.ConvertAD.exe.infected","infect":{"engine":"rdmk","signature":"cmRtazqgIaVoIKsKFDkHlxXII8pT","threat":"Malware.Heuristic!ET#87%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\jdwd180524Agent053F0D86\\jdwd180524\\180524-5-PWS.Myexternalip.exe.infected","infect":{"engine":"sha1","signature":"c2hhMTpPfCewOdAr7f2EygoNy56edDYpsw","threat":"Trojan.Injector!1.AFE3"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\jdwd180524Agent053F0D86\\jdwd180524\\180524-8-PUP.Oleacc.exe.infected","infect":{"engine":"sha1","signature":"c2hhMTq0QYt53UpCqQ1uaTvThSgFKmjJaw","threat":"Trojan.Kryptik!8.8"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\jdwd180524Agent053F0D86\\jdwd180524\\modifed\\180524-2-RAT.131186113135.exe.infected","infect":{"engine":"sha1","signature":"c2hhMTqBLJCY813WmFZxaO/Jd5gtXsOGJA","threat":"Trojan.Kryptik!8.8"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\jdwd180524Agent053F0D86\\jdwd180524\\modifed\\180524-6-PUP.ConvertAD.exe.infected","infect":{"engine":"rdmk","signature":"cmRtazqgIaVoIKsKFDkHlxXII8pT","threat":"Malware.Heuristic!ET#87%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\jdwd180524Agent053F0D86\\jdwd180524\\modifed\\180524-5-PWS.Myexternalip.exe.infected","infect":{"engine":"sha1","signature":"c2hhMTrXZ49/oJYJ9NXnkcAU24NL5Tn+Kg","threat":"Trojan.Injector!1.AFE3"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\jdwd180524Agent053F0D86\\jdwd180524\\modifed\\180524-7-RAT.Aataki.exe.infected","infect":{"engine":"sha1","signature":"c2hhMTrbTq/8Dg9isAxbNDsKgaJJzYb//g","threat":"Backdoor.Pontoeb!1.6637"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\jdwd180524Agent053F0D86\\jdwd180524\\modifed\\180524-8-PUP.Oleacc.exe.infected","infect":{"engine":"sha1","signature":"c2hhMTp/PdI2YRh6yCsBheIAeJEfFN5vmg","threat":"Trojan.Kryptik!8.8"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\jdwd180524Agent053F0D86\\jdwd180524\\180524-3-Java.Adwind.jar.infected","type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\jdwd180524Agent053F0D86\\jdwd180524\\180524-4-Java.Downloader.jar.infected","type":"scan"}

扫描结束: Sun May 27 20:14:00 2018

总扫描耗时: 2:12:568(m:s:ms)
总扫描对象: 924
总扫描文件: 13
总恶意文件: 11
有效检出率: 84.62%



ESET Smart Security Premium 64位(高级启发式(Y)+压缩文件(Y)+自解压加壳(Y)+DNA智能签名(Y)++(Windows 10 Creators Update(Redstone 4)....1803):

日志
正在扫描日志
检测引擎的版本: 17453P (20180527)
日期: 2018/5/27  时间: 20:02:40
已扫描的磁盘、文件夹和文件: C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-1-CVE-2017-1188.rtf.infected > RTF > resource.ole2 - 可能是 Win32/Exploit.CVE-2017-11882.B 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-2-RAT.131186113135.exe.infected - MSIL/Kryptik.OBA 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-3-Java.Adwind.jar.infected - Java/Adwind.AAU 特洛伊木马 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-4-Java.Downloader.jar.infected - Generik.EXFBYCO 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-5-PWS.Myexternalip.exe.infected - Win32/Injector.DYDY 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-8-PUP.Oleacc.exe.infected > INNO > {tmp}\IMPORTANT.dll - Win32/Kryptik.GGLL 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\modifed\180524-2-RAT.131186113135.exe.infected - MSIL/Kryptik.OBA 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\modifed\180524-5-PWS.Myexternalip.exe.infected - Win32/Injector.DYDY 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\modifed\180524-7-RAT.Aataki.exe.infected - Generik.MGNLWTC 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\modifed\180524-8-PUP.Oleacc.exe.infected > INNO > {tmp}\IMPORTANT.dll - Win32/Kryptik.GGLL 特洛伊木马 的变种 - 通过删除清除 [1]
已扫描的对象数: 121
发现的威胁数: 10
已清除对象数: 10
完成时间: 20:03:26  总扫描时间: 46 秒 (00:00:46)

备注:
[1] 由于对象中仅包含病毒主体,因此已被删除。



火绒安全---( Windows 7 Ultimate with SP1 简体中文旗舰版....):部分未知文件已发送到seclab@huorong.cn,等处理中。。。

病毒库:2018-05-27 15:59
开始时间:2018-05-27 19:32
总计用时:00:00:11
扫描对象:1119个
扫描文件:13个
发现风险:2个
已处理风险:0个
发现系统修复项:0个
处理系统修复项:0个

文件名称: C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524.7z
文件大小: 4.78 MB (5,015,239 字节)
修改时间: 2018年05月27日,19:30:31
MD5: 222390BD7A5C88875B58B3A735A22BB9
SHA1: DAD5DA14A47C7709DFB7DC23DC931FFF7919C954
SHA256: 1ECE4CF94F551B7FE7E8BFE0C1BA916D43D4A8A0041104320C07C3F2A1BE031E
SHA512: 11DB5FAA863F4F521532399B7FA63A824DA7B17393584F3C9F9BF88E576EFBAEC1A8DBB7D463DC4ED43A3FDDECD2620CC4B5292B388D66CFDA19F002BC9A8B11
CRC32: 053F0D86
计算时间: 0.14s



病毒详情

风险路径:C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-7-RAT.Aataki.exe.infected, 病毒名:Backdoor/Agent.fe, 病毒ID:[f1a6501df2008b63], 处理结果:已忽略
风险路径:C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-7-RAT.Aataki.exe.infected, 病毒名:Backdoor/Agent.fe, 病毒ID:[f1a6501df2008b63], 处理结果:已忽略


Dr.Web CureIt! 简体中文绿色免费版---( Windows 7 Ultimate with SP1 简体中文旗舰版....):

-----------------------------------------------------------------------------
Start scanning
-----------------------------------------------------------------------------
Command line used:-rpcep:\pipe\14C341B60 -rpcpr:np

Limit the use of the computer resources to 100%
Instances used for this session: 10
Object(s) to scan:
- C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524


C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-1-CVE-2017-1188.rtf.infected - infected with Trojan.PWS.Stealer.1932
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-1-CVE-2017-1188.rtf.infected - infected
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-4-Java.Downloader.jar.infected is JAR container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-2-RAT.131186113135.exe.infected - infected with Trojan.PWS.Stealer.19347
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-2-RAT.131186113135.exe.infected - infected
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-3-Java.Adwind.jar.infected is JAR container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-6-PUP.ConvertAD.exe.infected - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-6-PUP.ConvertAD.exe.infected - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-2-RAT.131186113135.exe.infected - infected with Trojan.PWS.Stealer.19347
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-2-RAT.131186113135.exe.infected - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-5-PWS.Myexternalip.exe.infected - infected with Trojan.Siggen7.43669
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-5-PWS.Myexternalip.exe.infected - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-5-PWS.Myexternalip.exe.infected - infected with Trojan.Siggen7.43669
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-5-PWS.Myexternalip.exe.infected - infected
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-7-RAT.Aataki.exe.infected is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-7-RAT.Aataki.exe.infected\data001 is NET container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-7-RAT.Aataki.exe.infected\data002 is NET container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-7-RAT.Aataki.exe.infected\data003 is NET container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-7-RAT.Aataki.exe.infected\data004 is NET container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-7-RAT.Aataki.exe.infected\data005 is NET container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-7-RAT.Aataki.exe.infected\data006 is NET container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-7-RAT.Aataki.exe.infected\data007 is NET container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-7-RAT.Aataki.exe.infected\data008 is NET container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-7-RAT.Aataki.exe.infected - container
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-8-PUP.Oleacc.exe.infected is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-8-PUP.Oleacc.exe.infected\data001 is INNO SETUP container
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-8-PUP.Oleacc.exe.infected is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-8-PUP.Oleacc.exe.infected\data001 is INNO SETUP container
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-7-RAT.Aataki.exe.infected is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-7-RAT.Aataki.exe.infected\data001 is NET container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-7-RAT.Aataki.exe.infected\data002 is NET container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-7-RAT.Aataki.exe.infected\data003 is NET container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-7-RAT.Aataki.exe.infected\data004 is NET container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-7-RAT.Aataki.exe.infected\data005 is NET container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-7-RAT.Aataki.exe.infected\data006 is NET container
>>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-8-PUP.Oleacc.exe.infected\data001\Script2.bin is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-7-RAT.Aataki.exe.infected\data007 is NET container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-7-RAT.Aataki.exe.infected\data008 is NET container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-7-RAT.Aataki.exe.infected - container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-3-Java.Adwind.jar.infected - container
>>>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-8-PUP.Oleacc.exe.infected\data001\Script2.bin\data003 is ZLIB container
>>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-8-PUP.Oleacc.exe.infected\data001\Script2.bin is BINARYRES container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-4-Java.Downloader.jar.infected - container
>>>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-8-PUP.Oleacc.exe.infected\data001\Script2.bin\data003 is ZLIB container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-8-PUP.Oleacc.exe.infected\data001\{tmp}\IMPORTANT.dll - infected with Trojan.TinyNuke.23
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-8-PUP.Oleacc.exe.infected\data001\{tmp}\IMPORTANT.dll - infected with Trojan.TinyNuke.23
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-8-PUP.Oleacc.exe.infected\data002 is ZLIB container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-8-PUP.Oleacc.exe.infected\data002 is ZLIB container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\modifed\180524-8-PUP.Oleacc.exe.infected - infected container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\jdwd180524\180524-8-PUP.Oleacc.exe.infected - infected container

Total 14150460 bytes in 13 files scanned (1068 objects)
Total 6 files (1057 objects) are clean
Total 7 files are infected
Scan time is 00:00:04.887

Emsisoft Emergency Kit - 版本 2018.4
上次更新: 2018/5/27 17:47:00
用户帐号: TECLAST\Admin
电脑名称: TECLAST
操作系统版本: Windows 10x64

Emsisoft Emergency Kit 绿色免费版
(已开启)加入 Emsisoft 云、更新源:测试版
    Bitdefender(B)+Emsisoft(A) 双引擎

扫描设置:

扫描方式: 自定义扫描
对象: Rootkits, 内存, C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\

检测流氓软件(PUPs): On
扫描压缩包: On
扫描邮件存档: Off
ADS数据流: On
文件扩展名过滤: Off
直接磁盘访问: Off

扫描开始于:        2018/5/27 20:08:02
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-3-Java.Adwind.jar.infected -> com/mailwoman/UnreaveRealizability.class         发现风险: Java.Trojan.GenericGB.24573 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-1-CVE-2017-1188.rtf.infected         发现风险: Trojan.GenericKD.30851713 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-2-RAT.131186113135.exe.infected         发现风险: Gen:Variant.Ser.Ursu.361 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-6-PUP.ConvertAD.exe.infected         发现风险: Gen:Variant.Adware.ConvertAD.1396 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-8-PUP.Oleacc.exe.infected         发现风险: Trojan.Crypt (A) [294015]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-7-RAT.Aataki.exe.infected         发现风险: Gen:Variant.Kazy.693105 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\180524-5-PWS.Myexternalip.exe.infected         发现风险: Trojan.GenericKD.30861099 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\modifed\180524-2-RAT.131186113135.exe.infected         发现风险: Gen:Variant.Ser.Ursu.361 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\modifed\180524-6-PUP.ConvertAD.exe.infected         发现风险: Gen:Variant.Adware.ConvertAD.1396 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\modifed\180524-8-PUP.Oleacc.exe.infected         发现风险: Trojan.Crypt (A) [294025]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\modifed\180524-7-RAT.Aataki.exe.infected         发现风险: Gen:Variant.Kazy.693105 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\jdwd180524Agent053F0D86\jdwd180524\modifed\180524-5-PWS.Myexternalip.exe.infected         发现风险: Trojan.GenericKD.30867829 (B) [krnl.xmd]

已扫描        1888
现        12

扫描完成后:        2018/5/27 20:08:28
扫描时间:        0:00:26




病毒探索者
发表于 2018-6-7 13:54:06 | 显示全部楼层
金山毒霸 kill 4

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-3-29 13:04 , Processed in 0.110690 second(s), 14 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表