紫狐病毒

Luca.l

AVIRA

1. Antivirus Pro
   
2. 扫描开始时间： 2020-02-27 15:46:07
   
3. 02/27/2020,15:46:07.755        [INFO]        D:\luca\Downloads\Compressed\372c265d58089533dae5b42c2e94078b\0E2335FDC174DB4EBECF77184CBF8706.msi
   
4. 02/27/2020,15:46:07.756        [INFO]        [DETECTION] file contains 'TR/Agent.rqidi'
   
5. 02/27/2020,15:46:07.767        [INFO]        D:\luca\Downloads\Compressed\372c265d58089533dae5b42c2e94078b\28C9462EF9857C7BBD244FED7D287E2A.msi
   
6. 02/27/2020,15:46:07.767        [INFO]        [DETECTION] file contains 'TR/Agent.rwulg'
   
7. 02/27/2020,15:46:07.779        [INFO]        D:\luca\Downloads\Compressed\372c265d58089533dae5b42c2e94078b\61BF1E594ABE3B46B111B1A3C82CAFEA.msi
   
8. 02/27/2020,15:46:07.779        [INFO]        [DETECTION] file contains 'TR/Agent.jweqg'
   
9. 02/27/2020,15:46:07.809        [INFO]        D:\luca\Downloads\Compressed\372c265d58089533dae5b42c2e94078b\C2ADDD9840398A1D8CB6CD35C0C50A4C.msi
   
10. 02/27/2020,15:46:07.809        [INFO]        [DETECTION] file contains 'TR/Agent.odchk'
    
11. 02/27/2020,15:46:24.654        [INFO]        repair.rdf loaded (version: 1.0.2002.769)
    
12. 02/27/2020,15:46:24.706        [INFO]        Repair of Generic started.
    
13. 02/27/2020,15:46:24.713        [WARN]        Can't set registry value:  RootKey: HKEY_USERS SubKey: S-1-5-21-2052196570-3415966729-2180336101-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ValueName: shell (64 bit): 系统找不到指定的文件。
    
14. 02/27/2020,15:46:24.714        [WARN]        Can't set registry value:  RootKey: HKEY_USERS SubKey: S-1-5-21-2052196570-3415966729-2180336101-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ValueName: shell (32 bit): 系统找不到指定的文件。
    
15. 02/27/2020,15:46:25.774        [INFO]        Repair of Generic finished successfully.
    
16. 02/27/2020,15:46:25.774        [INFO]        Repair of TR/Agent.rqidi started.
    
17. 02/27/2020,15:46:29.682        [INFO]        Repair of TR/Agent.rqidi finished successfully.
    
18. 02/27/2020,15:46:29.684        [INFO]        D:\luca\Downloads\Compressed\372c265d58089533dae5b42c2e94078b\0E2335FDC174DB4EBECF77184CBF8706.msi
    
19. 02/27/2020,15:46:29.685        [INFO]        [ACTION] Clean
    
20. 02/27/2020,15:46:29.733        [INFO]        Repair of TR/Agent.rwulg started.
    
21. 02/27/2020,15:46:30.363        [INFO]        Repair of TR/Agent.rwulg finished successfully.
    
22. 02/27/2020,15:46:30.364        [INFO]        D:\luca\Downloads\Compressed\372c265d58089533dae5b42c2e94078b\28C9462EF9857C7BBD244FED7D287E2A.msi
    
23. 02/27/2020,15:46:30.364        [INFO]        [ACTION] Clean
    
24. 02/27/2020,15:46:30.420        [INFO]        Repair of TR/Agent.jweqg started.
    
25. 02/27/2020,15:46:31.230        [INFO]        Repair of TR/Agent.jweqg finished successfully.
    
26. 02/27/2020,15:46:31.231        [INFO]        D:\luca\Downloads\Compressed\372c265d58089533dae5b42c2e94078b\61BF1E594ABE3B46B111B1A3C82CAFEA.msi
    
27. 02/27/2020,15:46:31.231        [INFO]        [ACTION] Clean
    
28. 02/27/2020,15:46:31.281        [INFO]        Repair of TR/Agent.odchk started.
    
29. 02/27/2020,15:46:31.894        [INFO]        Repair of TR/Agent.odchk finished successfully.
    
30. 02/27/2020,15:46:31.896        [INFO]        D:\luca\Downloads\Compressed\372c265d58089533dae5b42c2e94078b\C2ADDD9840398A1D8CB6CD35C0C50A4C.msi
    
31. 02/27/2020,15:46:31.896        [INFO]        [ACTION] Clean
    
32. 
    
33. ---------------------------------------------------------
    
34. 
    
35. End of scan : 2020-02-27 15:46:32
    
36. Duration : 00m:24s:454ms
    
37. 
    
38. The scan has been done completely.
    
39. 
    
40.       1 Scanned directories
    
41.       0 Scanned archives
    
42.       5 Scanned files
    
43.       0 Skipped files
    
44.       0 Ignored files
    
45.       4 Detected files
    
46.       4 Infected files cleaned
    
47.       2 Warnings
    
48. 
    
49. ---------------------------------------------------------

复制代码

SUARP-BIGNUM

这个不是新的

1562859748

温馨小屋 发表于 2020-2-27 14:53
卡巴2021

全灭，都是一个名，这报法加vmp都不见得能过，测不了主防了

这个代码到底表明是什么病毒呀

温馨小屋

1562859748 发表于 2020-2-28 12:42
这个代码到底表明是什么病毒呀

通用启发报法，一般老毒会被归到这里面，特征抗混淆能力极强，单看这个特征看不出是什么毒

hanyu233

智量kill all。。。

a445441

微点拦截里面生成的黑DLL

1562859748

温馨小屋 发表于 2020-2-28 13:43
通用启发报法，一般老毒会被归到这里面，特征抗混淆能力极强，单看这个特征看不出是什么毒

反正 我看不懂卡巴斯基报毒 到底是什么意思

温馨小屋

1562859748 发表于 2020-2-28 20:33
反正 我看不懂卡巴斯基报毒 到底是什么意思

看多了就懂个大概了