#PACKAGE 0717

显示全部楼层 · 发表于 2018-7-18 06:16:54

Log
Scan Log
Version of detection engine: 17730P (20180717)
Date: 2018/7/18 Time: 6:13:35
Scanned disks, folders and files: C:\Users\Virus\Downloads\PACKAGE 0717
C:\Users\Virus\Downloads\PACKAGE 0717\0717(17).exe - a variant of Win32/Kryptik.GIWU trojan - cleaned by deleting [1]
C:\Users\Virus\Downloads\PACKAGE 0717\0717(19).exe - a variant of Win32/Injector.DZGV trojan - cleaned by deleting [1]
C:\Users\Virus\Downloads\PACKAGE 0717\0717(22).exe - a variant of Win32/Kryptik.GIWL trojan - cleaned by deleting [1]
C:\Users\Virus\Downloads\PACKAGE 0717\0717(25).exe - a variant of Win32/Injector.DZHC trojan - cleaned by deleting [1]
C:\Users\Virus\Downloads\PACKAGE 0717\0717(27).exe » NSIS » Script.nsi - NSIS/Injector.ACM trojan - cleaned by deleting [1]
C:\Users\Virus\Downloads\PACKAGE 0717\0717(27).exe » NSIS » Category.dat - archive damaged - the file could not be extracted.
C:\Users\Virus\Downloads\PACKAGE 0717\0717(29).exe » NSIS » Script.nsi - NSIS/Injector.ACM trojan - cleaned by deleting [1]
C:\Users\Virus\Downloads\PACKAGE 0717\0717(29).exe » NSIS » Category.dat - archive damaged - the file could not be extracted.
C:\Users\Virus\Downloads\PACKAGE 0717\0717(33).exe - a variant of Win32/Injector.DZGV trojan - cleaned by deleting [1]
C:\Users\Virus\Downloads\PACKAGE 0717\0717(34).exe - a variant of Win32/Kryptik.GIWU trojan - cleaned by deleting [1]
C:\Users\Virus\Downloads\PACKAGE 0717\0717(38).exe - a variant of Win32/Injector.DZHG trojan - cleaned by deleting [1]
C:\Users\Virus\Downloads\PACKAGE 0717\0717(6).exe » NSIS » Script.nsi - NSIS/Injector.ACM trojan - cleaned by deleting [1]
C:\Users\Virus\Downloads\PACKAGE 0717\0717(6).exe » NSIS » Category.dat - archive damaged - the file could not be extracted.
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(12).exe - a variant of Win32/Kryptik.GIWY trojan - deleted
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(13).exe - a variant of Win32/Injector.DZGX trojan - deleted
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(17).exe - a variant of Win32/Kryptik.GIWU trojan - deleted
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(19).exe - a variant of Win32/Injector.DZGV trojan - deleted
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(22).exe - a variant of Win32/Kryptik.GIWL trojan - deleted
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(24).exe - Win32/Spy.Ursnif.BO trojan - deleted
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(25).exe - a variant of Win32/Injector.DZHC trojan - deleted
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(26).exe - a variant of Win32/Kryptik.GIXF trojan - deleted
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(27).exe » NSIS » Script.nsi - NSIS/Injector.ACM trojan - deleted
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(27).exe » NSIS » Category.dat - archive damaged - the file could not be extracted.
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(29).exe » NSIS » Script.nsi - NSIS/Injector.ACM trojan - deleted
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(29).exe » NSIS » Category.dat - archive damaged - the file could not be extracted.
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(32).exe - Win32/Spy.Ursnif.BO trojan - deleted
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(33).exe - a variant of Win32/Injector.DZGV trojan - deleted
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(34).exe - a variant of Win32/Kryptik.GIWU trojan - deleted
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(38).exe - a variant of Win32/Injector.DZHG trojan - deleted
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(4).exe - MSIL/TrojanDownloader.Agent.EVL trojan - deleted
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(6).exe » NSIS » Script.nsi - NSIS/Injector.ACM trojan - deleted
C:\Users\Virus\Downloads\PACKAGE 0717\virus.zip » ZIP » 0717(6).exe » NSIS » Category.dat - archive damaged - the file could not be extracted.
Number of scanned objects: 50
Number of threats found: 26
Number of cleaned objects: 26
Time of completion: 6:15:21 Total scanning time: 106 sec (00:01:46)

Notes:
[1] Object has been deleted as it only contained the virus body.

压缩包里的，无视即可

显示全部楼层 · 发表于 2018-7-18 08:42:38

小坏爷发表于 2018-7-18 00:30
依据网络状况而定默认10秒组策略配置扩展云检查需依赖其他三个功能（有说明）

想不到口碑这么不好的WD居然有人在卡饭玩的这么好。。

你是二班的！~
这个值我设置的是50秒，给他充分的时间去检测分析，毕竟是家用的电脑。
这个值让WD的检测更慢更慢更卡了。

显示全部楼层 · 发表于 2018-7-18 10:50:21

B100D1E55 发表于 2018-7-17 23:18
猫熊这个太搞笑了……都是常见毒的马甲居然还这么萎。不过弃疗搞拉黑的估计都这尿性了，猫熊拉黑又没有跟 ...

不过按照趋势信誉毁天灭地的封锁方式，即使趋势没有跟进拉黑也不能双击执行吧？

显示全部楼层 · 发表于 2018-7-18 10:54:29

桑德尔发表于 2018-7-18 10:50
不过按照趋势信誉毁天灭地的封锁方式，即使趋势没有跟进拉黑也不能双击执行吧？

有可能，不过就要付出巨大的易用性方面的代价

显示全部楼层 · 发表于 2018-7-18 13:12:19

360tse with avira engine kill 37x，剩余双击，OP拦截。
13:04:23 拦截 0717(1).EXE 驱动程序加载 RASMAN
13:04:29 0717(1).EXE 拦截对系统对象的修改 System Objects C:\Windows\System32\powrnic.exe
13:05:12 拦截 0717(34).EXE 驱动程序加载 VaultSvc
13:05:18 拦截 0717(34).EXE DNS API 请求

显示全部楼层 · 发表于 2018-7-18 16:32:42

本帖最后由 Agu 于 2018-7-18 16:42 编辑

Malwarebytes - 34/39

二掃再3X

360國際版 - 39/39

显示全部楼层 · 发表于 2018-7-18 19:25:30

CIS 11右键扫描杀了6个，在comodo container里运行又杀了10个。16/39

显示全部楼层 · 发表于 2018-7-18 22:00:08

日常过来看看我的小伞和小E是不是还是那么风骚，然后就放心了

[病毒样本] #PACKAGE 0717

本帖子中包含更多资源

本帖子中包含更多资源