EXE样本5X_80

www-tekeze

evans168 发表于 2019-9-18 22:04
Norton + SecureAPlus

NS杀3X，翻车了？还得用两个才搞定，智量Heur清空。。

evans168

www-tekeze 发表于 2019-9-18 22:14
NS杀3X，翻车了？还得用两个才搞定，智量Heur清空。。

嘿呀!! 所以我才會一直提倡主防必須搭配輔殺, 電腦使用比較安心!!

a233

卡巴扫描Kill 4X

双击剩下的Samp(1)，进程出现一秒就退出
PS:我这里卡巴一直更新失败，上次用卡巴的时候是正常的，这次就不行了，不知道为什么

驭龙

WD杀4个，实机运行剩余的5号，ASR规则阻止
2019-09-19T01:40:06.651Z [MpRtp] Engine VFZ HIPS block: \Device\HarddiskVolume5\12345\EXE样本5X_80\Samp(5).exe. status=0x70000, statusex=0x1100, threatid=0x80000000, sigseq=0x0
2019-09-19T01:40:06.651Z [Mini-filter] Blocked file: \Device\HarddiskVolume5\12345\EXE样本5X_80\Samp(5).exe. Process: \Device\HarddiskVolume3\Windows\explorer.exe, Status: 0x0, State: 6, ScanRequest #35595, FileId: 0x200000000d11f, Reason: OnOpen, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x120089, FileAttributes:0x20, ScanAttributes:0x0, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0
Internal signature match:subtype=Lowfi, sigseq=0x0000157E0CB11830, sigsha=f0ffa80a9ea69acaa4528cce04dd3c8044621ba0, cached=true,

2019-09-19T00:22:29.209Z Version: Product 4.18.1908.7 Service 4.18.1908.7 Engine 1.1.16400.2 AS 1.301.1684.0 AV 1.301.1684.0
2019-09-19T01:31:37.171Z DETECTION Trojan:Win32/Trickbot.PC!MTB file:D:\12345\EXE样本5X_80\Samp(1).vir
2019-09-19T01:31:37.608Z DETECTION Trojan:Win32/Emotet.BS!MTB file:D:\12345\EXE样本5X_80\Samp(2).vir
2019-09-19T01:32:23.788Z DETECTION Trojan:Win32/Downloader.G!MTB file:D:\12345\EXE样本5X_80\Samp(3).vir
2019-09-19T01:32:50.017Z DETECTION Trojan:Win32/AutoitInject.BH!MTB file:D:\12345\EXE样本5X_80\Samp(4).vir

anhthjeugja

gdata internet security kill 5