adware 7x

落华无痕

样本（infected）：https://free.lanzoui.com/ikKk9t7py9e

正在缓冲

Avast 5x

a233

Huorong

Nocria

IKARUS - 5/7

1. [26.08.2021 21:38:38] On-demand scan started: "user_defined"
   
2. [26.08.2021 21:38:40] Found, 1.891s, SigName: "Trojan.Crypt", SigId: 332029974, Type: "VIRUS", File: "C:\Users\promi\Desktop\adware7x\adware7x\aaaabb.exe"
   
3. [26.08.2021 21:38:41] Found, 2.219s, SigName: "PUA.Autoit", SigId: 3346002, Type: "VIRUS", File: "C:\Users\promi\Desktop\adware7x\adware7x\hfNotepadService.exe"
   
4. [26.08.2021 21:38:42] Found, 1.703s, SigName: "Trojan.Win32.VMProtBad", SigId: 4189393, Type: "VIRUS", File: "C:\Users\promi\Desktop\adware7x\adware7x\PrisonHotel.exe"
   
5. [26.08.2021 21:38:43] Found, 1.109s, SigName: "Trojan.Win32", SigId: 332539950, Type: "VIRUS", File: "C:\Users\promi\Desktop\adware7x\adware7x\Setup_Tools_notebook_xxNotepad1006.exe"
   
6. [26.08.2021 21:38:43] Found, 1.31s, SigName: "Trojan.SuspectCRC", SigId: 331644900, Type: "VIRUS", File: "C:\Users\promi\Desktop\adware7x\adware7x\SparkDint.exe"
   
7. [26.08.2021 21:38:44] On-demand scan FINISHED: "user_defined"
   
8. [26.08.2021 21:38:44] ----------------------------------------------------
   
9. [26.08.2021 21:38:44] Directories scanned: 2
   
10. [26.08.2021 21:38:44] Files scanned: 14
    
11. [26.08.2021 21:38:44] Virus found: 5
    
12. [26.08.2021 21:38:44] ----------------------------------------------------

复制代码

秋日之殇

卡巴斯基剩余一个

救命稻草

ESET 6x

日志
C:\Users\Jkc\Desktop\virus\adware7x\adware7x\LabdaShut-774.exe - Win32/Softcnapp.BK.gen 潜在的不受欢迎应用程序 的变量 - 已保留
C:\Users\Jkc\Desktop\virus\adware7x\adware7x\PrisonHotel.exe - Win32/Packed.VMProtect.AGR 可疑应用程序 的变量 - 已保留
C:\Users\Jkc\Desktop\virus\adware7x\adware7x\Setup_Tools_notebook_xxNotepad1006.exe > AUTOIT > hfNotepad_service.exe > AUTOIT > script.bin - Win32/Autoit.OKY 特洛伊木马 的变量 - 已保留
C:\Users\Jkc\Desktop\virus\adware7x\adware7x\SparkDint.exe - Generik.CXGZHUZ 特洛伊木马 的变量 - 已保留
C:\Users\Jkc\Desktop\virus\adware7x\adware7x\aaaabb.exe > NSIS > sdm.exe - Win32/Packed.VMProtect.AGR 可疑应用程序 的变量 - 已保留
C:\Users\Jkc\Desktop\virus\adware7x\adware7x\aaaabb.exe > NSIS > del.exe - Win32/Packed.VMProtect.AGR 可疑应用程序 的变量 - 已保留
C:\Users\Jkc\Desktop\virus\adware7x\adware7x\hfNotepadService.exe > AUTOIT > script.bin - Win32/Autoit.OKY 特洛伊木马 的变量 - 已保留

11111111111445

安天5x,360 6x

ICzcz

BD：6X

aboringman

Norton：3

1. 2021/8/26 22:24:30,高,检测到 Setup_Tools_notebook_xxNotepad1006.exe (Heur.AdvML.B) (检测方: 下载智能分析),已隔离,已解决 - 不需要操作,已执行 威胁 操作: 1
   
2. 2021/8/26 22:24:29,高,检测到 SparkDint.exe (Heur.AdvML.A) (检测方: 下载智能分析),已隔离,已解决 - 不需要操作,已执行 威胁 操作: 1
   
3. 2021/8/26 22:24:29,高,检测到 SparkDint.exe (Trojan.Gen.MBT) (检测方: 下载智能分析),已隔离,已解决 - 不需要操作,已执行 威胁 操作: 1
   
4. 2021/8/26 22:24:27,高,检测到 PrisonHotel.exe (Heur.AdvML.B) (检测方: 下载智能分析),已隔离,已解决 - 不需要操作,已执行 威胁 操作: 1

复制代码

761773275

AhnLab 3个