#PACKAGE 0628

显示全部楼层 · 发表于 2018-6-28 22:16:34

sololpchina 发表于 2018-6-28 22:13
难不成后来一个报cl的云就是之前鉴定的结果？

cl == cloud
————————
如你所言。
云响应因为个人设置的时间以及网络情况不同可能滞后情况也不一样。

双击任何文件都需慎重考虑。

显示全部楼层 · 发表于 2018-6-28 22:18:00

ELOHIM 发表于 2018-6-28 22:16
cl == cloud
————————
如你所言。

没有双击，完全解压加扫描

显示全部楼层 · 发表于 2018-6-28 22:18:45

sololpchina 发表于 2018-6-28 22:18
没有双击，完全解压加扫描

OK .这样，只有零日漏洞利用的可能了。。

显示全部楼层 · 发表于 2018-6-28 22:19:36

kkla163 发表于 2018-6-28 22:14
卡巴好惨，一个都没报~~~~

看11楼

显示全部楼层 · 发表于 2018-6-28 22:25:31

kkla163 发表于 2018-6-28 22:14
卡巴好惨，一个都没报~~~~

你确定。。。扫描好歹报了6个

显示全部楼层 · 发表于 2018-6-28 22:29:50

本帖最后由 Karna 于 2018-6-28 22:34 编辑

22:28 卡巴扫描+双击 14/23 其中自删除的样本 2 3 4 5 6 9 12应该是同一个程序，应该是僵尸网络或者远控，只外联，跑不出什么行为。剩下部分程序运行出错。下面为双击结果：
1 pdm badur.a
2 自删除,且建立常驻程序,miss.
3 自删除退出
4 自删除退出
5 自删除退出
6 自删除退出
7 触发漏洞防护
9 自删除退出
10 杀掉回滚
12 自删除退出
13 杀掉回滚
14 杀掉回滚
16 杀掉回滚
19 杀掉回滚
20 停止工作21 触发漏洞防护
22 运行退出

卡巴这启发在新毒面前，算是彻底边缘化了，全靠主防撑着，怪不得2019免费版会加入主防。

显示全部楼层 · 发表于 2018-6-28 22:29:57

瑞星ML社区版
10/23

瑞星RDM+社区版
3/23

显示全部楼层 · 发表于 2018-6-28 22:44:21

江民移动版 22:39
Samples（6/23） 26%

江民杀毒软件报告文件

北京江民新科技术有限公司

扫描引擎 16.00.100
病毒库日期 2018-06-28
更新日期 2018-06-28

扫描目标 E:\病毒样本\卡饭\davkzf\r\

扫描目标 E:\病毒样本\卡饭\PACKAGE 0627\

扫描目标 E:\病毒样本\卡饭\PACKAGE 0628\

开始时间 2018-06-28 22:36:26

在 E:\病毒样本\卡饭\PACKAGE 0627\0627(19).exe 中发现 Trojan.Banker.IcedID.ch 病毒, 已删除
在 E:\病毒样本\卡饭\PACKAGE 0627\0627(3).exe 中发现 Trojan.Mansabo.yd 病毒, 已删除
在 E:\病毒样本\卡饭\PACKAGE 0627\0627(4).exe 中发现 Trojan.MSIL.jnjx 病毒, 已删除
在 E:\病毒样本\卡饭\PACKAGE 0627\0627(5).exe 中发现 Trojan.Banker.Emotet.bef 病毒, 已删除
在 E:\病毒样本\卡饭\PACKAGE 0627\0627(6).exe 中发现 Backdoor.MSIL.alqy 病毒, 已删除
在 E:\病毒样本\卡饭\PACKAGE 0627\0627(9).exe 中发现 Trojan.Banker.Emotet.bel 病毒, 已删除
正常结束。

扫描结果:
               文件数 :643                               病毒体 :6
               删除 :6                                  解毒 :0
扫描速度(千字节/秒) :11251                            扫描时间 :00:00:43
扫描文件速度(个/秒) :14

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -    - - - - - -

安天 Miss all

显示全部楼层 · 发表于 2018-6-28 22:51:26

本帖最后由小飞侠.net 于 2018-6-29 00:38 编辑

X-Sec Antivirus ---（Windows 10 Creators Update（Redstone 4）....1803）：

Basic Info:
---------------------
Database Version: 2018.06.24.01
Program Version: 2.1.1.0
Heuristic Engine: Enabled
Cloud Engine: Enabled
Enhanced Mode: Disabled
Backup Before Resolve: Yes
Resolve Threats: Scan only
Scan Priority: Normal
---------------------
Targets:
---------------------
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301
---------------------
2018-06-29 00:36:14 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(1).exe -- [Cloud] Cloud:Trojan.Win32.Generic
2018-06-29 00:36:16 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(10).exe -- [Cloud] Cloud:Trojan.Win32.Infostealer
2018-06-29 00:36:17 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(12).exe -- [Cloud] Cloud:Trojan.Win32.Emotet
2018-06-29 00:36:19 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(11).exe -- [Cloud] Cloud:Trojan.Win32.LokiBot
2018-06-29 00:36:26 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(14).exe -- [Classic] Hacktool.Win32.Confuser.Aa
2018-06-29 00:36:26 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(13).exe -- [Cloud] Cloud:Trojan.Win32.Injector
2018-06-29 00:36:30 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(15).exe -- [Cloud] Cloud:Trojan.Win32.LokiBot
2018-06-29 00:36:33 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(16).exe -- [Cloud] Cloud:Trojan.Win32.Generic
2018-06-29 00:36:38 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(18).exe -- [Cloud] Cloud:Trojan.Win32.LokiBot
2018-06-29 00:36:43 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(19).exe -- [Cloud] Cloud:Trojan.Win32.Infostealer
2018-06-29 00:36:44 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(2).exe -- [Cloud] Cloud:Trojan.Win32.Emotet
2018-06-29 00:36:49 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(20).exe -- [Cloud] Cloud:Trojan.Win32.Infostealer
2018-06-29 00:36:53 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(21).exe -- [Cloud] Cloud:Backdoor.Win32.Generic
2018-06-29 00:37:03 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(22).exe -- [Cloud] Cloud:Trojan.Win32.LokiBot
2018-06-29 00:37:15 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(23).exe -- [Cloud] Cloud:Trojan.Win32.Infostealer
2018-06-29 00:37:15 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(3).exe -- [Cloud] Cloud:Trojan.Win32.Emotet
2018-06-29 00:37:16 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(17).exe -- [Cloud] Cloud:Trojan.Win32.Generic
2018-06-29 00:37:16 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(4).exe -- [Cloud] Cloud:Trojan.Win32.Emotet
2018-06-29 00:37:16 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(5).exe -- [Cloud] Cloud:Trojan.Win32.Emotet
2018-06-29 00:37:17 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(6).exe -- [Cloud] Cloud:Trojan.Win32.Emotet
2018-06-29 00:37:22 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(8).exe -- [Classic] Trojan.Win32.Autoit.Gc
2018-06-29 00:37:23 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(9).exe -- [Cloud] Cloud:Trojan.Win32.Emotet
2018-06-29 00:37:26 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(7).exe -- [Cloud] Cloud:Trojan.Win32.Injector

瑞星---（Windows 10 Creators Update（Redstone 4）....1803）：云引擎（开）RDM+引擎（开）

            瑞星反恶软引擎命令行扫描器（社区交流版）

编译于：Sep 22 2017 15:07:50

提示：
  - 本工具供社区交流使用，请勿用于其他用途
  - 本工具没有恶意软件删除、清除、隔离功能
  - 本工具包含开发中的新特性，结果仅供参考

* 命令行中的选项开关：-output-json -log=C:\瑞星RDM+引擎\ScanLog_180629003122.log
* 获取恶软签名库最新版本 ...
* 下载恶软签名库配置文件 ...
* 创建恶软签名库升级组件 ...
* 计算并下载增量文件 ...
* 升级恶软签名库 ...
* 恶软签名库升级成功
* 扫描目标 : (1) C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301

* 加载恶软签名库： C:\瑞星RDM+引擎/malware.rmd
* 恶软签名库加载成功，发布序号为 4492
* 读取恶软签名库配置 ...
* 云辅助扫描组件初始化失败.
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
扫描开始: Fri Jun 29 00:32:26 2018

{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(11).exe","infect":{"engine":"rdmk","signature":"cmRtazpBzjXobNQdzrHuKlLgipD4","threat":"Malware.Heuristic!ET#85%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(14).exe","infect":{"engine":"rdmk","signature":"cmRtazoCxKI5y7Gx+ABXcATl1lbx","threat":"Malware.Heuristic!ET#90%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(12).exe","infect":{"engine":"tfe","signature":"dGZlOgIZp+gbA8+aIQ","threat":"Trojan.GenKryptik!8.AA55"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(13).exe","infect":{"engine":"rdmk","signature":"cmRtazpNJKXSZH8dqSq7JKQPtqhk","threat":"Malware.Heuristic!ET#93%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(15).exe","infect":{"engine":"rdmk","signature":"cmRtazq5qMw9g42cTUhINxy9tVFh","threat":"Malware.Heuristic!ET#97%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(2).exe","infect":{"engine":"rdmk","signature":"cmRtazo3VUWZ8A2awJwe3UziUAmA","threat":"Malware.Heuristic!ET#96%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(19).exe","infect":{"engine":"rdmk","signature":"cmRtazrzE1JT30w3EhPBpeLxv6Vq","threat":"Malware.Heuristic!ET#81%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(18).exe","infect":{"engine":"rdmk","signature":"cmRtazphLwVQzxOt+UVhRmapawwX","threat":"Malware.Heuristic!ET#97%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(1).exe","type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(3).exe","infect":{"engine":"rdmk","signature":"cmRtazq3CjvEuWL8pEBGrw7Rv2T9","threat":"Malware.Heuristic!ET#93%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(20).exe","type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(4).exe","infect":{"engine":"rdmk","signature":"cmRtazrpjaBLFBv96/3McA0Zp4Tn","threat":"Malware.Heuristic!ET#92%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(5).exe","infect":{"engine":"rdmk","signature":"cmRtazpl+hMRN3YLupS0fNezY1IL","threat":"Malware.Heuristic!ET#91%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(6).exe","infect":{"engine":"rdmk","signature":"cmRtazqhrPz+M+FQLx+RLlXhe7yG","threat":"Malware.Heuristic!ET#94%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(23).exe","type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(21).exe","type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(7).exe","infect":{"engine":"rdmk","signature":"cmRtazpLqCFoBaGBKaOp9S9TbEd8","threat":"Malware.Heuristic!ET#91%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(22).exe","type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(9).exe","infect":{"engine":"tfe","signature":"dGZlOgIZp+gbA8+aIQ","threat":"Trojan.GenKryptik!8.AA55"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(8).exe","type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(10).exe","type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(16).exe","type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0628Zdowbot2301\\PACKAGE 0628\\0628(17).exe","infect":{"engine":"md5","signature":"bWQ1Oqu91pq9utHJT/yyMFS8sAE","threat":"Trojan.Tinukebot!8.E873"},"type":"scan"}

扫描结束: Fri Jun 29 00:32:56 2018

总扫描耗时: 0:29:225(m:s:ms)
总扫描对象: 90
总扫描文件: 23
总恶意文件: 15
有效检

出率: 65.22%

Emsisoft Emergency Kit - 版本 2018.6
上次更新： 2018-06-28 22:12:35
用户帐号： TECLAST\Admin
电脑名称： TECLAST
操作系统版本： Windows 10 x64

Emsisoft Emergency Kit 绿色免费版
(已开启)加入 Emsisoft 云、更新源：测试版
Bitdefender（B）+Emsisoft（A）双引擎

扫描设置：

扫描方式：自定义扫描
对象： Rootkits, C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\

检测流氓软件(PUPs)： On
扫描压缩包： On
扫描邮件存档： Off
ADS数据流： On
文件扩展名过滤： Off
直接磁盘访问： Off

扫描开始于：       2018-06-29 0:28:33
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(8).exe -> (AutoIT r) -> (AutoIT Script) -> (unicode)       发现风险： AIT:Trojan.Agent.CXHP (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(8).exe -> (AutoIT Script) -> (unicode)       发现风险： AIT:Trojan.Agent.CXHP (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(12).exe       发现风险： Trojan.Emotet (A) [294457]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(11).exe       发现风险： Trojan.GenericKD.31018497 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(15).exe       发现风险： Trojan.Injector (A) [294463]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(13).exe       发现风险： Trojan.GenericKD.31023042 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(18).exe       发现风险： Trojan.Injector (A) [294463]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(2).exe       发现风险： Trojan.Emotet (A) [294462]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(19).exe       发现风险： Trojan.GenericKD.31022477 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(20).exe       发现风险： Gen:Variant.Jaik.27111 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(3).exe       发现风险： Trojan.Emotet (A) [294462]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(4).exe       发现风险： Trojan.Emotet (A) [294462]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(23).exe       发现风险： Trojan.GenericKD.31019512 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(5).exe       发现风险： Trojan.Emotet (A) [294462]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(6).exe       发现风险： Trojan.Emotet (A) [294462]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(9).exe       发现风险： Trojan.Emotet (A) [294457]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(7).exe       发现风险： Trojan.GenericKD.31021061 (B) [krnl.xmd]

已扫描       617
发现

17

扫描完成后：       2018-06-29 0:28:54
扫描时间：       0:00:21

ESET Smart Security Premium 64位（高级启发式（Y）+压缩文件（Y）+自解压加壳（Y）+DNA智能签名（Y）++（Windows 10 Creators Update（Redstone 4）....1803）：

日志
正在扫描日志
检测引擎的版本: 17628P (20180628)
日期: 2018-06-29  时间: 0:23:45
已扫描的磁盘、文件夹和文件: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(1).exe - Win32/GenKryptik.CDSZ 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(10).exe - Win32/PSW.Fareit.A 特洛伊木马 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(11).exe - Win32/Injector.DYYI 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(12).exe - Win32/Kryptik.GIHC 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(13).exe - Win32/GenKryptik.CDUE 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(14).exe - MSIL/Packed.Confuser.J 可疑应用程序的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(15).exe - Win32/Injector.DYYK 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(16).exe - Generik.NIFMTTC 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(17).exe > INNO > {tmp}\letsgetiton.dll - Win32/Tinukebot.K 特洛伊木马 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(18).exe - Win32/Injector.DYYK 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(19).exe - Win32/Injector.DYYI 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(2).exe - Win32/Kryptik.GIFR 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(20).exe - Win32/Injector.DYYI 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(21).exe - Win32/GenKryptik.CDUV 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(22).exe - Win32/Injector.DYYQ 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(23).exe - Win32/Injector.DYYI 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(3).exe - Win32/Kryptik.GIFR 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(4).exe - Win32/Kryptik.GIFR 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(5).exe - Win32/Kryptik.GHZP 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(6).exe - Win32/Kryptik.GHZP 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(7).exe - Win32/GenKryptik.CDTO 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(8).exe > AUTOIT > script.bin - Win32/TrojanDownloader.Autoit.OLR 特洛伊木马的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0628Zdowbot2301\PACKAGE 0628\0628(9).exe - Win32/Kryptik.GIHC 特洛伊木马的变种 - 通过删除清除 [1]
已扫描的对象数: 91
发现的威胁数: 23
已清除

对象数: 23
完成时间: 0:25:16 总扫描时间: 91 秒 (00:01:31)

备注:
[1] 由于对象中仅包含病毒主体，因此已被删除。

火绒安全---（ Windows 7 Ultimate with SP1 简体中文旗舰版....）：部分未知文件已发送到seclab@huorong.cn，等处理中。。。

病毒库：2018-06-28 15:45
开始时间：2018-06-28 22:57
总计用时：00:00:21
扫描对象：343个
扫描文件：23个
发现风险：1

个
已处理风险：0个
发现系统修复项：0个
处理系统修复项：0个

病毒详情

风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(1).exe, 病毒名：TrojanDownloader/Zdowbot.a, 病毒ID：[b135bf0ca7c4b51e], 处理结果：已忽略

文件名称: C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628.rar
文件大小: 10.0 MB (10,502,626 字节)
修改时间: 2018年06月28日，22:56:57
MD5: AED5666FB56D0981112E45012A1763FB
SHA1: 90CD7CE1CF3DEB90FF0D1EE94FF76EF7767553B3
SHA256: 3EDEFEA08F691CD576CF976ECF939D5DB7D6E647AE66A03CD2E4C0B253802C6B
SHA512: D24655C73D35808E78F3C53C9EA6904B33D97C52E5B115DE8291C41BE339678F1A02F57B0B6A31AB05B2E5AAA6FAC92168B0035BFD095A4D33DC90063A30A27D
CRC32: 220C4226
计算时间: 0.28s
Dr.Web CureIt! 简体中文绿色免费版---（ Windows 7 Ultimate with SP1 简体中文旗舰版....）：

-----------------------------------------------------------------------------
Start scanning
-----------------------------------------------------------------------------
Command line used:-rpcep:\pipe\3FA69FB65 -rpcpr:np

Limit the use of the computer resources to 100%
Instances used for this session: 10
Object(s) to scan:
- C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628

C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(15).exe - infected with Trojan.PWS.Stealer.24134
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(15).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(12).exe - Ok
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(11).exe - packed by FLY-CODE
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(11).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(13).exe - Ok
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(10).exe - packed by UPX
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(2).exe - packed by FLY-CODE
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(18).exe - infected with Trojan.PWS.Stealer.24134
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(18).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(19).exe - Ok
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(20).exe - packed by FLY-CODE
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(16).exe - packed by UPX
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(2).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(14).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(22).exe - infected with Trojan.PWS.Stealer.24149
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(22).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(20).exe - Ok
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(3).exe - packed by FLY-CODE
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(4).exe - packed by FLY-CODE
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(16).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(21).exe - Ok
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(6).exe - packed by FLY-CODE
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(5).exe - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(10).exe is BINARYRES container
>>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(10).exe\data001 is OPEN XML container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(23).exe - Ok
>>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(10).exe\data002 is OPEN XML container
>>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(10).exe\data003 is OPEN XML container
>>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(10).exe\data004 is OPEN XML container
>>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(10).exe\data005 is OPEN XML container
>>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(10).exe\data006 is OPEN XML container
>>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(10).exe\data007 is OPEN XML container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(10).exe - container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(3).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(7).exe - infected with Trojan.Inject3.9532
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(7).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(9).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(5).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(4).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(6).exe - Ok
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(8).exe is AUTOIT container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(8).exe\Users\Codificador\AppData\Local\AutoIt v3\Aut2Exe\aut131F.tmp.tok - packed by ASCRIPT
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(8).exe - container
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(17).exe is INNO SETUP container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(17).exe\Script2.bin is BINARYRES container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(1).exe - infected with Trojan.Siggen7.55313
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(1).exe - infected
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(17).exe\{tmp}\libeay32.dll - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(17).exe\{tmp}\libevent-2-0-5.dll is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(17).exe\{tmp}\libevent_extra-2-0-5.dll - packed by FLY-CODE
>>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(17).exe\{tmp}\libevent_extra-2-0-5.dll is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(17).exe\{tmp}\libgcc_s_sjlj-1.dll - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(17).exe\{tmp}\libgmp-10.dll - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(17).exe\{tmp}\libssp-0.dll - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(17).exe\{tmp}\ssleay32.dll - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(17).exe\{tmp}\tor.exe is BINARYRES container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0628\0628(17).exe - container

Total 16890405 bytes in 23 files scanned (131 objects)
Total 18 files (126 objects) are clean
Total 5 files are infected---很好没人上传VirusTotal
Scan time is 00:00:09.892

显示全部楼层 · 发表于 2018-6-28 23:12:11

petr0vic 发表于 2018-6-28 22:29
瑞星ML社区版
10/23

你的0.2.3.1是不是有引擎没开啊？我这儿检测16个

[病毒样本] #PACKAGE 0628

本帖子中包含更多资源

本帖子中包含更多资源

评分

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块