#PACKAGE 0824

显示全部楼层 · 发表于 2018-8-24 18:22:45

Emsisoft Anti-Malware - 版本 2018.7

最后更新： 2018/8/24 18:07:40

发起者： WIN-7L012NVDSMK\Administrator

电脑名称： WIN-7L012NVDSMK

操作系统版本： Windows 7x86 Service Pack 1

---------------------扫描部分---------------------

扫描设置：
扫描方式：
对象： C:\Users\Administrator\Desktop\PACKAGE 0824\
检测流氓软件(PUPs)：开
扫描存档：开
扫描邮件档案：关
ADS数据流扫描：开
文件扩展名过滤：关
直接磁盘访问：关
扫描开始： 2018/8/24 18:08:28
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(1).exe -> (AutoIT r) -> (AutoIT Script) -> (unicode) AIT:Trojan.Nymeria.949 (B) [krnl.xmd]
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(2).exe Trojan.Injector (A) [295142]
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(10).exe Trojan.Injector (A) [295142]
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(11).exe Trojan.GenericKD.40422178 (B) [krnl.xmd]
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(3).exe Trojan.GenericKD.40422914 (B) [krnl.xmd]
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(12).exe Trojan.Agent.DDMP (B) [krnl.xmd]
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(9).exe Trojan.Generic.8628969 (B) [krnl.xmd]
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(13).exe Gen:Variant.Razy.314080 (B) [krnl.xmd]
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(8).exe Gen:Variant.Kovter.1 (B) [krnl.xmd]
扫描 14
发现 9
扫描结束： 2018/8/24 18:08:33
扫描时间： 0:00:05
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(8).exe 已删除： Gen:Variant.Kovter.1 (B)
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(13).exe 已删除： Gen:Variant.Razy.314080 (B)
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(9).exe 已删除： Trojan.Generic.8628969 (B)
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(12).exe 已删除： Trojan.Agent.DDMP (B)
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(3).exe 已删除： Trojan.GenericKD.40422914 (B)
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(11).exe 已删除： Trojan.GenericKD.40422178 (B)
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(10).exe 已删除： Trojan.Injector (A)
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(2).exe 已删除： Trojan.Injector (A)
C:\Users\Administrator\Desktop\PACKAGE 0824\0824(1).exe 已删除： AIT:Trojan.Nymeria.949 (B)
已删除： 9

复制代码

--------------------双击部分-------------------

2018/8/24 18:16:41 用户 WIN-7L012NVDSMK\ADMINISTRATOR 隔离威胁中危恶意软件 "Behavior.HiddenInstallation" 来自于 "0824(6).exe".
2018/8/24 18:19:16
中危恶意软件 "Behavior.CodeInjector" 来自于 "C:\Users\Administrator\Desktop\PACKAGE 0824\0824(14).exe" 已隔离。用户 WIN-7L012NVDSMK\ADMINISTRATOR
2018/8/24 18:18:12
中危恶意软件 "Behavior.Spyware" 来自于 "C:\Users\Administrator\Desktop\PACKAGE 0824\0824(7).exe" 已隔离。用户 WIN-7L012NVDSMK\ADMINISTRATOR

复制代码

剩余样本双击结果：

4号样本运行后自退

5号样本无法运行，这两个样本似乎反虚拟机

Total：12/14 85.7%

显示全部楼层 · 发表于 2018-8-24 18:22:47

火绒

【1】2018-08-24 18:17:24,系统防御,注册表保护,RegAsm.exe触犯注册表防护规则, 已阻止

操作者：C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
命令行："C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
风险动作：修改启动项
目标注册表：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WPA Manager
操作类型：写入
数据内容：C:\Users\555\AppData\Roaming\AE26E99B-688B-40DF-B67A-E7E11CAE2119\WPA Manager\wpamgr.exe
用户操作：已阻止

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【2】2018-08-24 18:16:49,系统防御,注册表保护,lunamute.exe触犯注册表防护规则, 已阻止

操作者：C:\Users\555\AppData\Local\Microsoft\Windows\lunamute.exe
命令行："C:\Users\555\AppData\Local\Microsoft\Windows\lunamute.exe"
风险动作：修改启动项
目标注册表：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\lunamute
操作类型：写入
数据内容："C:\Users\555\AppData\Local\Microsoft\Windows\lunamute.exe"
用户操作：已阻止

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【3】2018-08-24 18:16:35,系统防御,文件保护,svchost.exe触犯文件防护规则, 已阻止

操作者：C:\Windows\system32\svchost.exe
命令行：C:\Windows\system32\svchost.exe -k netsvcs -p
风险动作：修改启动目录(扩展保护)
目标文件：C:\Users\555\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Legit Program.exe
用户操作：已阻止

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【4】2018-08-24 18:16:01,病毒防御,病毒查杀,自定义扫描，发现0个风险项目

病毒库：2018-08-24 16:28
开始时间：2018-08-24 18:15
总计用时：00:00:07
扫描对象：65个
扫描文件：8个
发现风险：0个
已处理风险：0个
发现系统修复项：0个
处理系统修复项：0个

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【5】2018-08-24 18:15:25,病毒防御,文件实时监控,发现病毒HEUR:Trojan/VBCode.be, 已清除

操作者：C:\Program Files (x86)\360\360zip\360zip.exe
病毒路径：C:\Users\555\Desktop\PACKAGE 0824\0824(10).exe
病毒名称：HEUR:Trojan/VBCode.be
病毒ID：D38A4A7DE3D69B77
用户操作：已清除

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【6】2018-08-24 18:15:25,病毒防御,文件实时监控,发现病毒Trojan/MSIL.Obfuscated.aw, 已清除

操作者：C:\Program Files (x86)\360\360zip\360zip.exe
病毒路径：C:\Users\555\Desktop\PACKAGE 0824\0824(13).exe
病毒名称：Trojan/MSIL.Obfuscated.aw
病毒ID：A66B30BF251D9F00
用户操作：已清除

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【7】2018-08-24 18:15:25,病毒防御,文件实时监控,发现病毒HEUR:Trojan/VBCode.be, 已清除

操作者：C:\Windows\Explorer.EXE
病毒路径：C:\Users\555\Desktop\PACKAGE 0824\0824(2).exe
病毒名称：HEUR:Trojan/VBCode.be
病毒ID：D38A4A7DE3D69B77
用户操作：已清除

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【8】2018-08-24 18:15:25,病毒防御,文件实时监控,发现病毒HVM:TrojanDownloader/Small.gen!A, 已清除

操作者：C:\Program Files (x86)\360\360zip\360zip.exe
病毒路径：C:\Users\555\Desktop\PACKAGE 0824\0824(7).exe
病毒名称：HVM:TrojanDownloader/Small.gen!A
病毒ID：3771D7B34EE4BE40
用户操作：已清除

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【9】2018-08-24 18:15:25,病毒防御,文件实时监控,发现病毒Trojan/VBInject.b, 已清除

操作者：C:\Program Files (x86)\360\360zip\360zip.exe
病毒路径：C:\Users\555\Desktop\PACKAGE 0824\0824(8).exe
病毒名称：Trojan/VBInject.b
病毒ID：E4BEEE39EA2E9885
用户操作：已清除

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【10】2018-08-24 18:15:25,病毒防御,文件实时监控,发现病毒Worm/Gamarue, 已清除

操作者：C:\Windows\Explorer.EXE
病毒路径：C:\Users\555\Desktop\PACKAGE 0824\0824(9).exe
病毒名称：Worm/Gamarue
病毒ID：9E44ED12248E3A0D
用户操作：已清除

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【11】2018-08-24 18:13:48,其他,升级日志,手动升级成功，版本号：4.0.69.10

升级方式：手动升级
升级结果：成功
版本号：4.0.69.10
下载文件：
2018-08-24 18:13:48 C:\ProgramData\Huorong\Sysdiag\db\behav.db
2018-08-24 18:13:48 C:\ProgramData\Huorong\Sysdiag\db\malurl.db
2018-08-24 18:13:48 C:\ProgramData\Huorong\Sysdiag\virdb\prop.db
2018-08-24 18:13:48 C:\ProgramData\Huorong\Sysdiag\virdb\pset.db
2018-08-24 18:13:48 C:\ProgramData\Huorong\Sysdiag\virdb\troj.db
修改文件：
2018-08-24 18:13:48 C:\ProgramData\Huorong\Sysdiag\db\behav.db
2018-08-24 18:13:48 C:\ProgramData\Huorong\Sysdiag\db\malurl.db
2018-08-24 18:13:48 C:\ProgramData\Huorong\Sysdiag\virdb\prop.db
2018-08-24 18:13:48 C:\ProgramData\Huorong\Sysdiag\virdb\pset.db
2018-08-24 18:13:48 C:\ProgramData\Huorong\Sysdiag\virdb\troj.db

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

最后剩5个

显示全部楼层 · 发表于 2018-8-24 18:40:18

本帖最后由静影沉璧于 2018-8-24 19:09 编辑

avast高级版：扫描：8/14

双击：4/14

Total:12/14 85.7%

显示全部楼层 · 发表于 2018-8-24 18:49:52

Tencent PCManager
9/14 相比于 BD 5号未检测出

显示全部楼层 · 发表于 2018-8-24 20:04:48

本帖最后由 www-tekeze 于 2018-8-24 20:05 编辑

智量，初扫12/14，均为Heur本地报出，剩余#7、#8，上报5分钟后二扫清空。。

显示全部楼层 · 发表于 2018-8-24 20:16:52

Symantec Endpoint Protection 14.2.770
时间：20:01-20:16
扫描：11/14

双击：
SONAR杀4号样本

剩余样本双击结果：
1号样本等了半天没跑出行为，像是反虚拟机
7后样本miss
Total:12/14 85.7%

显示全部楼层 · 发表于 2018-8-24 20:28:06

本帖最后由 YU2711 于 2018-8-24 20:29 编辑

趋势科技  扫描  19:50
3/14
0824(12).exe TrojanSpy.Win32.LOKI.SMBD1.hp
0824(13).exe BKDR_ASDROP.SMZVP
0824(9).exe    TSPY_DOWNLOADER_BK08494B.TOMC
               双击
0824(1)MISS
0824(2)MISS
0824(3)HTTP_HANCITOR_REQUEST  移除
0824(4)MISS运行自删
0824(5)MISS
0824(6)阻止行为本体未删
0824(7)HEU_AEGISCS968
C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\revvy.exe  HEU_CDPLCEXT
0824(8)阻止行为本体未删
0824(10)HEU_AEGISCS985
0824(11)HTTP_LOKI_REQUEST 移除
0824(14)阻止行为本体未删

显示全部楼层 · 发表于 2018-8-24 20:35:08

Comodo Internet Security 扫描杀了1个文件，在Comodo container中运行杀了4个文件
反病毒事件
2018-08-24 20:17:22 C:\download\PACKAGE 0824\0824(8).exe ApplicUnwnt.Win32.PSWTool.MailPassView.~A@30754085 隔离成功
2018-08-24 20:12:59 C:\download\PACKAGE 0824\0824(9).exe TrojWare.Win32.TrojanDownloader.Andromeda.CD@293175901 隔离成功
VirusScope事件
2018-08-24 20:20:12 C:\download\PACKAGE 0824\0824(13).exe Generic.Trojan@132 隔离成功
2018-08-24 20:20:06 C:\download\PACKAGE 0824\0824(12).exe Generic.Trojan@131@2 隔离成功
2018-08-24 20:17:18 C:\download\PACKAGE 0824\0824(7).exe Generic.Trojan@131@2 隔离成功

显示全部楼层 · 发表于 2018-8-24 21:12:54

囧，管家最新纯净版，4个……

显示全部楼层 · 发表于 2018-8-24 21:35:50

AVIRA

时间：2018-08-24 21:23:36

扫描：14/14

08/24/2018,21-23-38 [INFO] FP 报告文件 'd:\downloads\package%200824\0824(1).exe' 的“无误报”状态
08/24/2018,21-23-38 [INFO] d:\downloads\package%200824\0824(1).exe
08/24/2018,21-23-38 [INFO] [DETECTION] file contains 'TR/Autoit.hjqer'
08/24/2018,21-23-44 [INFO] FP 报告文件 'd:\downloads\package%200824\0824(10).exe' 的“无误报”状态
08/24/2018,21-23-44 [INFO] 文件已通过 Protection Cloud扫描。 SHA256 = d:\downloads\package%200824\0824(10).exe
08/24/2018,21-23-44 [INFO] d:\downloads\package%200824\0824(10).exe
08/24/2018,21-23-44 [INFO] [DETECTION] file contains 'TR/Dropper.VB.78ec54'
08/24/2018,21-23-44 [INFO] FP 报告文件 'd:\downloads\package%200824\0824(11).exe' 的“无误报”状态
08/24/2018,21-23-44 [INFO] d:\downloads\package%200824\0824(11).exe
08/24/2018,21-23-44 [INFO] [DETECTION] file contains 'TR/Injector.fbefo'
08/24/2018,21-23-44 [INFO] FP 报告文件 'd:\downloads\package%200824\0824(12).exe' 的“无误报”状态
08/24/2018,21-23-44 [INFO] d:\downloads\package%200824\0824(12).exe
08/24/2018,21-23-44 [INFO] [DETECTION] file contains 'TR/Kryptik.nhpoq'
08/24/2018,21-23-45 [INFO] FP 报告文件 'd:\downloads\package%200824\0824(13).exe' 的“无误报”状态
08/24/2018,21-23-45 [INFO] d:\downloads\package%200824\0824(13).exe
08/24/2018,21-23-45 [INFO] [DETECTION] file contains 'TR/Dropper.Gen'
08/24/2018,21-23-45 [INFO] FP 报告文件 'd:\downloads\package%200824\0824(14).exe' 的“无误报”状态
08/24/2018,21-23-45 [INFO] 文件已通过 Protection Cloud扫描。 SHA256 = d:\downloads\package%200824\0824(14).exe
08/24/2018,21-23-45 [INFO] d:\downloads\package%200824\0824(14).exe
08/24/2018,21-23-45 [INFO] [DETECTION] file contains 'TR/AD.Nanocore.Y'
08/24/2018,21-23-46 [INFO] FP 报告文件 'd:\downloads\package%200824\0824(2).exe' 的“无误报”状态
08/24/2018,21-23-46 [INFO] d:\downloads\package%200824\0824(2).exe
08/24/2018,21-23-46 [INFO] [DETECTION] file contains 'TR/Dropper.VB.Gen7'
08/24/2018,21-23-46 [INFO] FP 报告文件 'd:\downloads\package%200824\0824(3).exe' 的“无误报”状态
08/24/2018,21-23-46 [INFO] d:\downloads\package%200824\0824(3).exe
08/24/2018,21-23-46 [INFO] [DETECTION] file contains 'TR/Crypt.XPACK.Gen3'
08/24/2018,21-23-46 [INFO] FP 报告文件 'd:\downloads\package%200824\0824(4).exe' 的“无误报”状态
08/24/2018,21-23-46 [INFO] 文件已通过 Protection Cloud扫描。 SHA256 = d:\downloads\package%200824\0824(4).exe
08/24/2018,21-23-46 [INFO] d:\downloads\package%200824\0824(4).exe
08/24/2018,21-23-46 [INFO] [DETECTION] file contains 'TR/AD.Swotter.B'
08/24/2018,21-23-47 [INFO] FP 报告文件 'd:\downloads\package%200824\0824(5).exe' 的“无误报”状态
08/24/2018,21-23-47 [INFO] 文件已通过 Protection Cloud扫描。 SHA256 = d:\downloads\package%200824\0824(5).exe
08/24/2018,21-23-47 [INFO] d:\downloads\package%200824\0824(5).exe
08/24/2018,21-23-47 [INFO] [DETECTION] file contains 'TR/AD.SmokeLoader.Y'
08/24/2018,21-23-48 [INFO] FP 报告文件 'd:\downloads\package%200824\0824(6).exe' 的“无误报”状态
08/24/2018,21-23-48 [INFO] 文件已通过 Protection Cloud扫描。 SHA256 = d:\downloads\package%200824\0824(6).exe
08/24/2018,21-23-48 [INFO] d:\downloads\package%200824\0824(6).exe
08/24/2018,21-23-48 [INFO] [DETECTION] file contains 'TR/AD.Emotet.B'
08/24/2018,21-23-48 [INFO] FP 报告文件 'd:\downloads\package%200824\0824(7).exe' 的“无误报”状态
08/24/2018,21-23-48 [INFO] d:\downloads\package%200824\0824(7).exe
08/24/2018,21-23-48 [INFO] [DETECTION] file contains 'TR/Agent.whoyh'
08/24/2018,21-23-49 [INFO] FP 报告文件 'd:\downloads\package%200824\0824(8).exe' 的“无误报”状态
08/24/2018,21-23-49 [INFO] 文件已通过 Protection Cloud扫描。 SHA256 = d:\downloads\package%200824\0824(8).exe
08/24/2018,21-23-49 [INFO] d:\downloads\package%200824\0824(8).exe
08/24/2018,21-23-49 [INFO] [DETECTION] file contains 'TR/AD.BrowserPassView.B'
08/24/2018,21-23-49 [INFO] FP 报告文件 'd:\downloads\package%200824\0824(9).exe' 的“无误报”状态
08/24/2018,21-23-49 [INFO] d:\downloads\package%200824\0824(9).exe
08/24/2018,21-23-49 [INFO] [DETECTION] file contains 'TR/Dropper.Gen'
08/24/2018,21-24-24 [INFO] repair.rdf loaded (version: 1.0.44.0)
08/24/2018,21-24-27 [INFO] Repair of Generic started.
08/24/2018,21-24-34 [INFO] Repair of Generic finished successfully.
08/24/2018,21-24-34 [INFO] Repair of TR/Autoit.hjqer started.
08/24/2018,21-25-09 [ERROR] Error in calling script function Repair: Runtime error. Script file is invalid!
08/24/2018,21-25-09 [ERROR] Repair of TR/Autoit.hjqer failed.
08/24/2018,21-25-09 [INFO] d:\downloads\package%200824\0824(1).exe
08/24/2018,21-25-09 [INFO] [ACTION] Clean
08/24/2018,21-25-09 [INFO] Repair of TR/Dropper.VB.78ec54 started.
08/24/2018,21-25-44 [ERROR] Error in calling script function Repair: Runtime error. Script file is invalid!
08/24/2018,21-25-44 [ERROR] Repair of TR/Dropper.VB.78ec54 failed.
08/24/2018,21-25-44 [INFO] d:\downloads\package%200824\0824(10).exe
08/24/2018,21-25-44 [INFO] [ACTION] Clean
08/24/2018,21-25-44 [INFO] Repair of TR/Injector.fbefo started.
08/24/2018,21-26-19 [ERROR] Error in calling script function Repair: Runtime error. Script file is invalid!
08/24/2018,21-26-19 [ERROR] Repair of TR/Injector.fbefo failed.
08/24/2018,21-26-19 [INFO] d:\downloads\package%200824\0824(11).exe
08/24/2018,21-26-19 [INFO] [ACTION] Clean
08/24/2018,21-26-19 [INFO] Repair of TR/Kryptik.nhpoq started.
08/24/2018,21-26-54 [ERROR] Error in calling script function Repair: Runtime error. Script file is invalid!
08/24/2018,21-26-54 [ERROR] Repair of TR/Kryptik.nhpoq failed.
08/24/2018,21-26-54 [INFO] d:\downloads\package%200824\0824(12).exe
08/24/2018,21-26-54 [INFO] [ACTION] Clean
08/24/2018,21-26-54 [INFO] Repair of TR/Dropper.Gen started.
08/24/2018,21-27-28 [ERROR] Error in calling script function Repair: Runtime error. Script file is invalid!
08/24/2018,21-27-28 [ERROR] Repair of TR/Dropper.Gen failed.
08/24/2018,21-27-28 [INFO] d:\downloads\package%200824\0824(13).exe
08/24/2018,21-27-28 [INFO] [ACTION] Clean
08/24/2018,21-27-28 [INFO] Repair of TR/AD.Nanocore.Y started.
08/24/2018,21-28-02 [ERROR] Error in calling script function Repair: Runtime error. Script file is invalid!
08/24/2018,21-28-02 [ERROR] Repair of TR/AD.Nanocore.Y failed.
08/24/2018,21-28-02 [INFO] d:\downloads\package%200824\0824(14).exe
08/24/2018,21-28-02 [INFO] [ACTION] Clean
08/24/2018,21-28-02 [INFO] Repair of TR/Dropper.VB.Gen7 started.
08/24/2018,21-28-37 [ERROR] Error in calling script function Repair: Runtime error. Script file is invalid!
08/24/2018,21-28-37 [ERROR] Repair of TR/Dropper.VB.Gen7 failed.
08/24/2018,21-28-37 [INFO] d:\downloads\package%200824\0824(2).exe
08/24/2018,21-28-37 [INFO] [ACTION] Clean
08/24/2018,21-28-37 [INFO] Repair of TR/Crypt.XPACK.Gen3 started.
08/24/2018,21-29-11 [ERROR] Error in calling script function Repair: Runtime error. Script file is invalid!
08/24/2018,21-29-11 [ERROR] Repair of TR/Crypt.XPACK.Gen3 failed.
08/24/2018,21-29-11 [INFO] d:\downloads\package%200824\0824(3).exe
08/24/2018,21-29-11 [INFO] [ACTION] Clean
08/24/2018,21-29-11 [INFO] Repair of TR/AD.Swotter.B started.
08/24/2018,21-29-44 [ERROR] Error in calling script function Repair: Runtime error. Script file is invalid!
08/24/2018,21-29-44 [ERROR] Repair of TR/AD.Swotter.B failed.
08/24/2018,21-29-44 [INFO] d:\downloads\package%200824\0824(4).exe
08/24/2018,21-29-44 [INFO] [ACTION] Clean
08/24/2018,21-29-44 [INFO] Repair of TR/AD.SmokeLoader.Y started.
08/24/2018,21-30-18 [ERROR] Error in calling script function Repair: Runtime error. Script file is invalid!
08/24/2018,21-30-18 [ERROR] Repair of TR/AD.SmokeLoader.Y failed.
08/24/2018,21-30-18 [INFO] d:\downloads\package%200824\0824(5).exe
08/24/2018,21-30-18 [INFO] [ACTION] Clean
08/24/2018,21-30-18 [INFO] Repair of TR/AD.Emotet.B started.
08/24/2018,21-30-52 [ERROR] Error in calling script function Repair: Runtime error. Script file is invalid!
08/24/2018,21-30-52 [ERROR] Repair of TR/AD.Emotet.B failed.
08/24/2018,21-30-52 [INFO] d:\downloads\package%200824\0824(6).exe
08/24/2018,21-30-52 [INFO] [ACTION] Clean
08/24/2018,21-30-52 [INFO] Repair of TR/Agent.whoyh started.
08/24/2018,21-31-25 [ERROR] Error in calling script function Repair: Runtime error. Script file is invalid!
08/24/2018,21-31-25 [ERROR] Repair of TR/Agent.whoyh failed.
08/24/2018,21-31-25 [INFO] d:\downloads\package%200824\0824(7).exe
08/24/2018,21-31-25 [INFO] [ACTION] Clean
08/24/2018,21-31-25 [INFO] Repair of TR/AD.BrowserPassView.B started.
08/24/2018,21-31-59 [ERROR] Error in calling script function Repair: Runtime error. Script file is invalid!
08/24/2018,21-31-59 [ERROR] Repair of TR/AD.BrowserPassView.B failed.
08/24/2018,21-31-59 [INFO] d:\downloads\package%200824\0824(8).exe
08/24/2018,21-31-59 [INFO] [ACTION] Clean
08/24/2018,21-31-59 [INFO] Repair of TR/Dropper.Gen started.
08/24/2018,21-32-33 [ERROR] Error in calling script function Repair: Runtime error. Script file is invalid!
08/24/2018,21-32-33 [ERROR] Repair of TR/Dropper.Gen failed.
08/24/2018,21-32-33 [INFO] d:\downloads\package%200824\0824(9).exe
08/24/2018,21-32-33 [INFO] [ACTION] Clean
---------------------------------------------------------
End of scan : 2018-08-24 21:32:33
Duration : 08m:56s:677ms
The scan has been done completely.
1 Scanned directories
1 Scanned archives
14 Scanned files
0 Skipped files
0 Ignored files
14 Detected files
0 Infected files cleaned
0 Warnings
---------------------------------------------------------

复制代码

[病毒样本] #PACKAGE 0824

评分

本帖子中包含更多资源

评分

本帖子中包含更多资源

本帖子中包含更多资源

评分

本帖子中包含更多资源