很恐怖的感染型病毒！

显示全部楼层 · 发表于 2018-11-16 15:04:21

BD 扫描清空 Win32.Virtob.Gen.12

显示全部楼层 · 发表于 2018-11-16 15:15:49

本帖最后由 con16 于 2018-11-16 15:21 编辑

comodo 解壓監控全數清空

显示全部楼层 · 发表于 2018-11-16 15:18:00

发现一个现象：

红伞对这堆样本在第一次右键扫描时一概以Virut家族实行清除操作实时监控好像把修复后的产物又检测了一遍，还动用了APC和AGEN定义。

这也是第一见到APC在读写监控时就触发。

右键扫描的日志：

11/16/2018,01-56-19 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\proquota.exe'
11/16/2018,01-56-19 [INFO] e:\samples\被感染文件\proquota.exe
11/16/2018,01-56-19 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-19 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\rrinstaller.exe'
11/16/2018,01-56-19 [INFO] e:\samples\被感染文件\rrinstaller.exe
11/16/2018,01-56-19 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-19 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\rstrui.exe'
11/16/2018,01-56-19 [INFO] e:\samples\被感染文件\rstrui.exe
11/16/2018,01-56-19 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-19 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\runlegacycplelevated.exe'
11/16/2018,01-56-19 [INFO] e:\samples\被感染文件\runlegacycplelevated.exe
11/16/2018,01-56-19 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\runonce.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\runonce.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\rwinsta.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\rwinsta.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\subst.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\subst.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\sxstrace.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\sxstrace.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\synchost.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\synchost.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\unlodctr.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\unlodctr.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\upnpcont.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\upnpcont.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\utilman.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\utilman.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\vaultcmd.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\vaultcmd.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\vds.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\vds.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\vdsldr.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\vdsldr.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\vssadmin.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\vssadmin.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\vssvc.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\vssvc.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\w32tm.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\w32tm.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\waitfor.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\waitfor.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\wallpaperhost.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\wallpaperhost.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-20 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\wbadmin.exe'
11/16/2018,01-56-20 [INFO] e:\samples\被感染文件\wbadmin.exe
11/16/2018,01-56-20 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-21 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\wevtutil.exe'
11/16/2018,01-56-21 [INFO] e:\samples\被感染文件\wevtutil.exe
11/16/2018,01-56-21 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-21 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\wextract.exe'
11/16/2018,01-56-21 [INFO] e:\samples\被感染文件\wextract.exe
11/16/2018,01-56-21 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-21 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\wfs.exe'
11/16/2018,01-56-21 [INFO] e:\samples\被感染文件\wfs.exe
11/16/2018,01-56-21 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-21 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\where.exe'
11/16/2018,01-56-21 [INFO] e:\samples\被感染文件\where.exe
11/16/2018,01-56-21 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-21 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\whoami.exe'
11/16/2018,01-56-21 [INFO] e:\samples\被感染文件\whoami.exe
11/16/2018,01-56-21 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-21 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\wiaacmgr.exe'
11/16/2018,01-56-21 [INFO] e:\samples\被感染文件\wiaacmgr.exe
11/16/2018,01-56-21 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-21 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\wimserv.exe'
11/16/2018,01-56-21 [INFO] e:\samples\被感染文件\wimserv.exe
11/16/2018,01-56-21 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-21 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\windowsanytimeupgraderesults.exe'
11/16/2018,01-56-21 [INFO] e:\samples\被感染文件\windowsanytimeupgraderesults.exe
11/16/2018,01-56-21 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-21 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\bfsvc.exe'
11/16/2018,01-56-21 [INFO] e:\samples\被感染文件\bfsvc.exe
11/16/2018,01-56-21 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-21 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\helppane.exe'
11/16/2018,01-56-21 [INFO] e:\samples\被感染文件\helppane.exe
11/16/2018,01-56-21 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-21 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\hh.exe'
11/16/2018,01-56-21 [INFO] e:\samples\被感染文件\hh.exe
11/16/2018,01-56-21 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-21 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\msra.exe'
11/16/2018,01-56-21 [INFO] e:\samples\被感染文件\msra.exe
11/16/2018,01-56-21 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-21 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\notepad.exe'
11/16/2018,01-56-21 [INFO] e:\samples\被感染文件\notepad.exe
11/16/2018,01-56-21 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-21 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\nslookup.exe'
11/16/2018,01-56-21 [INFO] e:\samples\被感染文件\nslookup.exe
11/16/2018,01-56-21 [INFO] [DETECTION] file contains 'W32/Virut.Gen'
11/16/2018,01-56-24 [INFO] FP reports status 'NO False Positive' for file 'e:\samples\被感染文件\proquota.exe'

复制代码

隔离区里有APC的字样

显示全部楼层 · 发表于 2018-11-16 15:19:35

本帖最后由 191196846 于 2018-11-16 15:20 编辑

https://www.virusradar.com/en/Win32_Virut.NBP/description

9年前的老毒

无法完全清除/清除不了的/无检出的真的只能说是垃圾

显示全部楼层 · 发表于 2018-11-16 15:25:12

13个CureIt

显示全部楼层 · 发表于 2018-11-16 15:27:21

卡巴清除35X

16.11.2018 15.25.03;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\wimserv.exe;C:\Users\Administrator\Desktop\123\wimserv.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:03
16.11.2018 15.25.19;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\bfsvc.exe;C:\Users\Administrator\Desktop\123\bfsvc.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:19
16.11.2018 15.25.18;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\WindowsAnytimeUpgradeResults.exe;C:\Users\Administrator\Desktop\123\WindowsAnytimeUpgradeResults.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:18
16.11.2018 15.25.17;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\wevtutil.exe;C:\Users\Administrator\Desktop\123\wevtutil.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:17
16.11.2018 15.25.17;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\wbadmin.exe;C:\Users\Administrator\Desktop\123\wbadmin.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:17
16.11.2018 15.25.16;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\wextract.exe;C:\Users\Administrator\Desktop\123\wextract.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:16
16.11.2018 15.25.16;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\WallpaperHost.exe;C:\Users\Administrator\Desktop\123\WallpaperHost.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:16
16.11.2018 15.25.15;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\waitfor.exe;C:\Users\Administrator\Desktop\123\waitfor.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:15
16.11.2018 15.25.15;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\w32tm.exe;C:\Users\Administrator\Desktop\123\w32tm.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:15
16.11.2018 15.25.14;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\vssvc.exe;C:\Users\Administrator\Desktop\123\vssvc.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:14
16.11.2018 15.25.14;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\vssadmin.exe;C:\Users\Administrator\Desktop\123\vssadmin.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:14
16.11.2018 15.25.14;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\wfs.exe;C:\Users\Administrator\Desktop\123\wfs.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:14
16.11.2018 15.25.13;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\vdsldr.exe;C:\Users\Administrator\Desktop\123\vdsldr.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:13
16.11.2018 15.25.13;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\vds.exe;C:\Users\Administrator\Desktop\123\vds.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:13
16.11.2018 15.25.12;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\VaultCmd.exe;C:\Users\Administrator\Desktop\123\VaultCmd.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:12
16.11.2018 15.25.12;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\Utilman.exe;C:\Users\Administrator\Desktop\123\Utilman.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:12
16.11.2018 15.25.11;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\upnpcont.exe;C:\Users\Administrator\Desktop\123\upnpcont.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:11
16.11.2018 15.25.11;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\where.exe;C:\Users\Administrator\Desktop\123\where.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:11
16.11.2018 15.25.10;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\unlodctr.exe;C:\Users\Administrator\Desktop\123\unlodctr.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:10
16.11.2018 15.25.10;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\SyncHost.exe;C:\Users\Administrator\Desktop\123\SyncHost.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:10
16.11.2018 15.25.10;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\sxstrace.exe;C:\Users\Administrator\Desktop\123\sxstrace.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:10
16.11.2018 15.25.09;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\subst.exe;C:\Users\Administrator\Desktop\123\subst.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:09
16.11.2018 15.25.09;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\rwinsta.exe;C:\Users\Administrator\Desktop\123\rwinsta.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:09
16.11.2018 15.25.08;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\whoami.exe;C:\Users\Administrator\Desktop\123\whoami.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:08
16.11.2018 15.25.08;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\runonce.exe;C:\Users\Administrator\Desktop\123\runonce.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:08
16.11.2018 15.25.07;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\RunLegacyCPLElevated.exe;C:\Users\Administrator\Desktop\123\RunLegacyCPLElevated.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:07
16.11.2018 15.25.07;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\rstrui.exe;C:\Users\Administrator\Desktop\123\rstrui.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:07
16.11.2018 15.25.06;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\rrinstaller.exe;C:\Users\Administrator\Desktop\123\rrinstaller.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:06
16.11.2018 15.25.06;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\proquota.exe;C:\Users\Administrator\Desktop\123\proquota.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:06
16.11.2018 15.25.06;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\wiaacmgr.exe;C:\Users\Administrator\Desktop\123\wiaacmgr.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:06
16.11.2018 15.25.05;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\nslookup.exe;C:\Users\Administrator\Desktop\123\nslookup.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:05
16.11.2018 15.25.05;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\notepad.exe;C:\Users\Administrator\Desktop\123\notepad.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:05
16.11.2018 15.25.04;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\msra.exe;C:\Users\Administrator\Desktop\123\msra.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:04
16.11.2018 15.25.04;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\hh.exe;C:\Users\Administrator\Desktop\123\hh.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:04
16.11.2018 15.25.03;检测到的对象 ( 文件 ) 已被清除;C:\Users\Administrator\Desktop\123\HelpPane.exe;C:\Users\Administrator\Desktop\123\HelpPane.exe;Virus.Win32.Virut.ce;病毒;11/16/2018 15:25:03

复制代码

显示全部楼层 · 发表于 2018-11-16 15:29:45

360 查35修复27个

显示全部楼层 · 发表于 2018-11-16 15:44:37

happycat 发表于 2018-11-16 14:53
你不是有虚拟机和影子吗?为什么还要重装系统?为什么文件还是被感染了?

那是针对普通用户说的，我怎么可能重装系统？就算真中招，还有Ghost映像备份，分分钟还原。。

显示全部楼层 · 发表于 2018-11-16 15:48:01

taroyoo 发表于 2018-11-16 15:04
BD 扫描清空 Win32.Virtob.Gen.12

连样本也清空了?

显示全部楼层 · 发表于 2018-11-16 15:48:37

happycat 发表于 2018-11-16 14:54
相比智量我更看好火绒，因为火绒报毒很准，误报也低，期待火绒5.0有什么新技术能提高检出率

我觉得两者关系是：优势不重复、劣势互补，1+1=2 。。

对5.0火绒查杀率也别抱太大希望，不信到时看。。。

[病毒样本] 很恐怖的感染型病毒！

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源