本帖最后由 小飞侠.net 于 2018-7-26 21:00 编辑
瑞星---（Windows 10 Creators Update（Redstone 4）....1803）：云引擎（开）RDM+引擎（开）
瑞星反恶软引擎命令行扫描器（社区交流版）
编译于：Sep 22 2017 15:07:50
提示：
- 本工具供社区交流使用，请勿用于其他用途
- 本工具没有恶意软件删除、清除、隔离功能
- 本工具包含开发中的新特性，结果仅供参考
* 命令行中的选项开关：-output-json -log=C:\瑞星RDM+引擎\ScanLog_180726205155.log
* 获取恶软签名库最新版本 ...
* 下载恶软签名库配置文件 ...
* 创建恶软签名库升级组件 ...
* 计算并下载增量文件 ...
* 升级恶软签名库 ...
* 恶软签名库升级成功
* 扫描目标 : (1) C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010
* 加载恶软签名库： C:\瑞星RDM+引擎/malware.rmd
* 恶软签名库加载成功，发布序号为 4652
* 读取恶软签名库配置 ...
* 云辅助扫描组件初始化失败.
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
扫描开始: Thu Jul 26 20:52:28 2018
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(12).exe","infect":{"engine":"rdmk","signature":"cmRtazqXCH6blZaj/n8XOUHmR1hQ","threat":"Malware.Heuristic!ET#97%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(15).exe","infect":{"engine":"rdmk","signature":"cmRtazoMMuU6dAVFKE09WS3h7kMd","threat":"Malware.Heuristic!ET#83%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(1).exe","infect":{"engine":"rdmk","signature":"cmRtazouWe0ZPAn9pvI7D7BG3pfI","threat":"Exploit.BypassUAC!8.87F5"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(14).exe","infect":{"engine":"rdmk","signature":"cmRtazqniMLUKD+i/bcDqAQcla7a","threat":"Malware.Heuristic!ET#96%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(10).exe","infect":{"engine":"rdmk","signature":"cmRtazpx/hfo/5qKCBwTnzKgCeIQ","threat":"Malware.Heuristic!ET#82%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(16).exe","infect":{"engine":"rdmk","signature":"cmRtazox+0Nu3r8Tm5LUs1bcwMq9","threat":"Trojan.Injector!8.C4"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(13).exe","infect":{"engine":"rdmk","signature":"cmRtazqGv21Y2ZW7ihDulNjD/lZ3","threat":"Trojan.Injector!1.AFE3"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(18).exe","infect":{"engine":"rdmk","signature":"cmRtazqYiQg0GOacvNXbN9he//fM","threat":"Trojan.Cloxer!8.F54F"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(2).exe","infect":{"engine":"rdmk","signature":"cmRtazoOsgVqte0LnQFOIGaxQ/n6","threat":"Trojan.Injector!8.C4"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(22).exe","infect":{"engine":"rdmk","signature":"cmRtazppbH86A5LS6gQz6MvXDuSM","threat":"Trojan.Azden!8.F0E3"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(19).exe","infect":{"engine":"rdmk","signature":"cmRtazp5OIHI54aFFWy4Q2Gg8sNn","threat":"Trojan.Injector!8.C4"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(24).exe","infect":{"engine":"rdmk","signature":"cmRtazpn7NpAY5FKmU1WyF3q1Ck3","threat":"Malware.Heuristic!ET#82%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(23).exe","infect":{"engine":"rdmk","signature":"cmRtazoOIYOMURfIZ/YX6GENN6Ww","threat":"Malware.Undefined!8.C"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(25).exe","infect":{"engine":"tfe","signature":"dGZlOg1LiTpDj4Yx8g","threat":"Dropper.Agent!8.2F"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(11).exe","type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(26).exe","infect":{"engine":"rdmk","signature":"cmRtazoBqBXG9e+GycaymxRkmdtw","threat":"Malware.Heuristic!ET#97%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(21).exe","type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(3).exe","infect":{"engine":"rdmk","signature":"cmRtazp/Z59emc86q7sxIF638WVP","threat":"Dropper.Generic!8.35E"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(20).exe","type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(5).exe","infect":{"engine":"rdmk","signature":"cmRtazo5vDS/0fF/84gZB+MmLs7e","threat":"Malware.Heuristic!ET#96%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(7).exe","infect":{"engine":"rdmk","signature":"cmRtazpNOcniuZY8D7voCtkTYA2X","threat":"Downloader.Zurgop!8.4BB"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(4).exe","type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(8).exe","infect":{"engine":"rdmk","signature":"cmRtazpXwXP9MLTcsFj2NLE3G2+w","threat":"Spyware.Weecnaw!8.14E"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(6).exe","infect":{"engine":"rdmk","signature":"cmRtazpPqx265wnpwZ+t/4h9Vphc","threat":"Malware.Heuristic!ET#94%"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(17).exe","infect":{"engine":"md5","signature":"bWQ1Osy9qjIeXxifcD87ETvBMGY","threat":"Trojan.Injector!8.C4"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE 0726HEUR2010\\PACKAGE 0726\\0726(9).exe","type":"scan"}
扫描结束: Thu Jul 26 20:52:30 2018
总扫描耗时: 0:1:700(m:s:ms)
总扫描对象: 41
总扫描文件: 26
总恶意文件: 21
有效检出率: 80.77%--有人上传VirusTotal ？？？？
Emsisoft Emergency Kit - 版本 2018.6
上次更新： 2018-07-26 18:58:21
用户帐号： TECLAST\Admin
电脑名称： TECLAST
操作系统版本： Windows 10x64
Emsisoft Emergency Kit 绿色免费版
(已开启)加入 Emsisoft 云、更新源：测试版
Bitdefender（B）+Emsisoft（A） 双引擎
扫描设置：
扫描方式： 自定义扫描
对象： Rootkits, C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\
检测流氓软件(PUPs)： On
扫描压缩包： On
扫描邮件存档： Off
ADS数据流： On
文件扩展名过滤： Off
直接磁盘访问： Off
扫描开始于： 2018-07-26 20:48:51
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(17).exe -> (NSIS o) -> zlib_nsis0014 发现风险： Trojan.GenericKD.40333688 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(13).exe 发现风险： Trojan.Agent.DCFF (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(1).exe 发现风险： Trojan.GenericKD.40336021 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(15).exe 发现风险： Trojan.Injector (A) [294816]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(12).exe 发现风险： Gen:Variant.Barys.53187 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(14).exe 发现风险： Trojan.GenericKD.40335403 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(11).exe 发现风险： Gen:Variant.Strictor.168910 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(16).exe 发现风险： Gen:Variant.Strictor.168910 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(2).exe 发现风险： Trojan.Injector (A) [294816]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(19).exe 发现风险： Gen:Variant.Strictor.168910 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(20).exe 发现风险： Gen:Variant.Strictor.168910 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(24).exe 发现风险： Trojan.Injector (A) [294816]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(25).exe 发现风险： Trojan-Downloader.Agent (A) [294761]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(4).exe 发现风险： Trojan.Injector (A) [294816]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(5).exe 发现风险： Trojan.Crypt (A) [293802]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(6).exe 发现风险： Gen:Variant.Ursu.254090 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(7).exe 发现风险： Trojan.GenericKD.31125874 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(8).exe 发现风险： Gen:Variant.Razy.260360 (B) [krnl.xmd]
已扫描 620
发现 18
扫描完成后： 2018-07-26 20:49:03
扫描时间： 0:00:12
ESET Smart Security Premium 64位（高级启发式（Y）+压缩文件（Y）+自解压加壳（Y）+DNA智能签名（Y）++（Windows 10 Creators Update（Redstone 4）....1803）：
日志
正在扫描日志
检测引擎的版本: 17779P (20180726)
日期: 2018-07-26 时间: 20:40:16
已扫描的磁盘、文件夹和文件: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(1).exe - Win32/Kryptik.FZSL 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(10).exe > INNO > {tmp}\iloveyou.dll - Win32/Tinukebot.K 特洛伊木马 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(11).exe - Win32/Injector.DZLG 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(12).exe - MSIL/Kryptik.OWF 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(13).exe - Win32/Injector.DZLE 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(14).exe - MSIL/Packed.Confuser.V 可疑应用程序 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(15).exe - Win32/Injector.DZLH 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(16).exe - Win32/Injector.DZLG 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(17).exe > NSIS > formicarium.dll - Win32/Injector.DZKU 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(18).exe - Win32/Kryptik.GJGH 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(19).exe - Win32/Injector.DZLG 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(2).exe - Win32/Injector.DZLA 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(20).exe - Win32/Injector.DZLG 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(21).exe - Win32/Injector.DZLS 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(22).exe - Win32/Kryptik.GJGI 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(23).exe - Win32/GenKryptik.CGIE 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(24).exe - Win32/Injector.DZLH 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(25).exe - MSIL/TrojanDownloader.Agent.EUT 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(26).exe - MSIL/Packed.Confuser.V 可疑应用程序 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(3).exe > EZIRIZ > protected.exe - MSIL/Kryptik.JJC 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(4).exe - Win32/Injector.DZLH 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(5).exe - MSIL/Packed.Confuser.V 可疑应用程序 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(6).exe - MSIL/Kryptik.PAP 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(7).exe - Win32/TrojanDownloader.Zurgop.DA 特洛伊木马 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(8).exe - Win32/Spy.Weecnaw.O 特洛伊木马 的变种 - 通过删除清除 [1]
已扫描的对象数: 107
发现的威胁数: 25
已清除对象数: 25--有人上传VirusTotal？？？？
完成时间: 20:40:53 总扫描时间: 37 秒 (00:00:37)
备注:
[1] 由于对象中仅包含病毒主体，因此已被删除。
Dr.Web CureIt! 简体中文绿色免费版---（ Windows 7 Ultimate with SP1 简体中文旗舰版....）：
Anti-rootkit module version ( ver: 11.5.201806181, api: 8.07 )
Using 137803332 as Dr.Web (R) Key file
-----------------------------------------------------------------------------
Start scanning
-----------------------------------------------------------------------------
Command line used:-rpcep:\pipe\4069930CB -rpcpr:np
Limit the use of the computer resources to 100%
Instances used for this session: 10
Object(s) to scan:
- C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(1).exe - infected with BackDoor.Remcos.1
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(1).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(16).exe - infected with Trojan.PWS.Stealer.23680
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(16).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(18).exe - Ok
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(17).exe is NSIS container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(15).exe - Ok
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(17).exe\f(2).txt is JS-HTML container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(17).exe - container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(12).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(11).exe - infected with Trojan.PWS.Stealer.23680
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(11).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(13).exe - infected with Trojan.DownLoader26.39159
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(13).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(2).exe - infected with BackDoor.Remcos.1
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(2).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(19).exe - infected with Trojan.PWS.Stealer.23680
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(19).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(21).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(23).exe - infected with Trojan.PWS.Stealer.24300
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(23).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(24).exe - infected with Trojan.VbCrypt.150
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(24).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(20).exe - infected with Trojan.PWS.Stealer.23680
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(20).exe - infected
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(22).exe - packed by FLY-CODE
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(26).exe is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(26).exe\data001 is NET container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(26).exe\data002 is NET container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(26).exe\data002\tst_dll - infected with Trojan.Packed2.41223
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(26).exe\data003 - infected with Trojan.Packed2.41223
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(26).exe\data004 is NET container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(26).exe - infected container
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe is NET container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(4).exe - infected with Trojan.Inject1.54688
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(4).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(8).exe - infected with BackDoor.Siggen2.2488
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(8).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(14).exe - infected with Trojan.Packed2.41222
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(14).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(5).exe - infected with Trojan.PWS.Multi.1690
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(5).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(7).exe - Ok
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(9).exe - packed by UPX
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(9).exe is BINARYRES container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(9).exe\data001 - infected with BAT.Generic.122
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(9).exe - infected container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(25).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(3).exe - Ok
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\q53eRwbZQTwyEJaFAEsW1pBBZ is GZIP archive
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\q53eRwbZQTwyEJaFAEsW1pBBZ - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\qDHEd9yePxaI9WW9hhKvBucERgGy4KFA - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\qmbsD8P5azeVQADQbViZpMroPM96FmYFI - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\rgOs8npGD2BaHdOoJgd0JXqmxUuz8yLRo5Po4 - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\rhKYhDXQnNVyR4OTN6SaIQqNJwtO - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\s5wiIh5kjiA5hEUESKNIItMO2GxsVS - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\sJvA3Bo3lw7uRPoX3XxQsX - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\sU1CNQ9oLhnDYmzan7SKfeskbrnb7O0HRfgapj - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\slG1CMDTVAxxP4uFE72mDbq2hHGsLF - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\tMpoicJEziYn6gnEqkf53oQ7MDMVKVLXkWk - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\u8qSRP3qKmlGSOpF40YfK8lzkl5fdHfZbxxBi - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\uH4opXJ5fbwKpXdRCCw8PEcPdOFswP1gOZULSF - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\uHDGkD7xTCEMfMJ4xbsT54qg7qrviu1 - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\uqbWagPSfLQw2OfmynJi2alm - Ok
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\urIKqBdLblAQOLswYfxu4f9tXy - packed by XOREXE
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\urIKqBdLblAQOLswYfxu4f9tXy - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\vV6CtJEN60Z6o15JpcAbCwSaamLp - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\voufrqKPM1LHSgbVgz25nslTZ4X - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\wJBxo2Fzhum214hcLSeM9X7V9vrKgBCDQ9nduL - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\wRsAVaI8sNUkVfgJovHQ4Spegm8Sn03kL7 - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\xMwRyo1thK9wKGQmslgo0ElrHy - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\xOFcdbsMTSBeiqWNB6SvlPIGO - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\xx8KyCELGEKDZnDtuh1eWbF - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\y0kXaDgl7rvGmut5P2b8Ix - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\yDklRvvxgCIrbP0Z59bAjvDf6vjZwL - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\yEKsEI5CfDj46Z1NrVylkVGEBLpwSnzYO2 - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\yEpX9bwlrip0LONtdEfpVjLMHqJ6kFQGJNh - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\ybZWHDwvkUxod0ytzjQT - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\yr4jYfzScBhDSjgOHL3ozuOTO2mre - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\ywXFmfv3bNdW1Ojjnz6SrrY - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\z3TbyEPYmLg3HPWAXd8vW - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\zZC5pHiDLm0DS8Rhv1sKHFG - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\zaq42YCkHu7tKeF4bRhPLh0A - Ok
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(10).exe is INNO SETUP container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\ziGrQEViyVDnUlpTdbu4GZHfpOq9iwUwo - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\zjYVnaVdlfcsZjgPYEBJPhG49JnrWq - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe\zuOicXzvk6HRBbVeiRuv4oBPakhQojKxcrpUno - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(6).exe - container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(10).exe\Script2.bin is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(10).exe\{tmp}\libeay32.dll - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(10).exe\{tmp}\libevent-2-0-5.dll is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(10).exe\{tmp}\libevent_extra-2-0-5.dll - packed by FLY-CODE
>>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(10).exe\{tmp}\libevent_extra-2-0-5.dll is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(10).exe\{tmp}\libgcc_s_sjlj-1.dll - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(10).exe\{tmp}\libgmp-10.dll - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(10).exe\{tmp}\libssp-0.dll - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(10).exe\{tmp}\ssleay32.dll - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(10).exe\{tmp}\tor.exe is BINARYRES container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(10).exe - container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(22).exe - packed by BINARYRES
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(22).exe - Ok
Total 20238845 bytes in 26 files scanned (318 objects)
Total 11 files (299 objects) are clean
Total 15 files (16 objects) are infected---有人上传VirusTotal？？？？
Scan time is 00:00:21.310
火绒安全---（ Windows 7 Ultimate with SP1 简体中文旗舰版....）：部分未知文件已发送到seclab@huorong.cn，等处理中。。。
病毒库：2018-07-26 15:58
开始时间：2018-07-26 20:09
总计用时：00:00:22
扫描对象：1361个
扫描文件：26个
发现 风险：2个
已处理风险：0个
发现系统修复项：0个
处理系统修复项：0个
病毒详情
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(9).exe, 病毒名：Trojan/Generic!9B82E58230877969, 病毒ID：[9b82e58230877969], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726\0726(22).exe, 病毒名：HEUR:VirTool/Obfuscator.gen!B, 病毒ID：[2d18551aef762f90], 处理结果：已忽略
文件名称: C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0726.zip
文件大小: 12.5 MB (13,126,200 字节)
修改时间: 2018年07月26日，20:08:18
MD5: D992BFE5E5DF8F0D6433FBCCD8FA50C8
SHA1: 96ED9F6D14F3D0A19645984C5BD2308613A8A12A
SHA256: 5896C680C50AC191D54A011BF1069E316ADDE9F530A8CE9AC42BFB3A92512A69
SHA512: BEFC11B85C0140C025C41059F5C39EDBC0F057E949C2654E5885B638EC981678CE49CE0F0FF2B640028F6FEECFCED42422574CBEB48380F94BA8457C3E6F60D6
CRC32: A1026E4C
计算时间: 0.69s
X-Sec Antivirus ---（Windows 10 Creators Update（Redstone 4）....1803）：
Basic Info:
---------------------
Database Version: 2018.07.24.01
Program Version: 2.1.1.0
Heuristic Engine: Enabled
Cloud Engine: Enabled
Enhanced Mode: Disabled
Backup Before Resolve: Yes
Resolve Threats: Scan only
Scan Priority: Normal
---------------------
Targets:
---------------------
C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010
---------------------
2018-07-26 20:56:52 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(12).exe -- [Classic] Hacktool.Win32.Confuser.Aa
2018-07-26 20:57:39 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE 0726HEUR2010\PACKAGE 0726\0726(8).exe -- [Classic] Backdoor.Win32.Agent.BN
|
[复制链接]
发表于 2018-7-26 20:00:50
发表于 2018-7-26 20:06:59
楼主
发表于 2018-7-26 22:46:59
