白加黑

hipoxiaxxx

https://pan.huang1111.cn/s/mqWlf1

Shake2333

eset
svchost.txt;Win32/Agent.QYC 特洛伊木马;已通过删除清除
Excep.tct;Win32/Agent.AEBB 特洛伊木马 的变量;已通过删除清除

rogersg

Kaspersky

1. 事件: 检测到恶意对象
   
2. 用户: DESKTOP-XXX\Admin
   
3. 用户类型: 活动用户
   
4. 应用程序名称: SearchProtocolHost.exe
   
5. 应用程序路径: C:\Windows\System32
   
6. 组件: 文件反病毒
   
7. 结果说明: 检测到
   
8. 类型: 木马
   
9. 名称: Trojan-Spy.Win32.TravNet.de
   
10. 精确度: 确切
    
11. 威胁级别: 高
    
12. 对象类型: 文件
    
13. 对象名称: svchost.txt
    
14. 对象路径: D:\Users\Admin\Desktop\s_2\s
    
15. MD5: 5E88FDD85C68453F1F75060C084A31A2
    
16. 原因: 数据库
    
17. 数据库发布日期: 今天，2022/6/29 14:37:00

复制代码

123456aaaafsdeg

电脑管家

1. 2022-6-29 18:34:19 MD5:74d730381954080f567d912010147b1f C:\Users\FengMu\Desktop\s\Excep.tct [Trojan.GenericKD.50527076]  [删除成功]
   
2. 2022-6-29 18:34:20 MD5:5e88fdd85c68453f1f75060c084a31a2 C:\Users\FengMu\Desktop\s\svchost.txt [Generic.Andromeda.0E0A801B]  [删除成功]

复制代码

anthonyqian

大蜘蛛

aboringman

仅下载防护

开开心心卖手机

Avast kill 2x

UNknownOoo

智量
扫描：iusb4mon.exe➡Heur.ML.PE.A（算误报嘛？
双击：miss

biue

腾讯电脑管家 v16

wowocock

UNknownOoo 发表于 2022-6-29 21:12
智量
扫描：iusb4mon.exe➡Heur.ML.PE.A（算误报嘛？
双击：miss

不算误报吧。int __thiscall sub_4010A0(CWinApp *this)
{
  HMODULE v2; // ebx
  void (*tionCatcher)(void); // eax
  CMultiDocTemplate *v4; // eax
  struct CDocTemplate *v5; // eax
  int v6; // eax
  int v7; // esi
  int v8; // eax
  int result; // eax
  char v10[36]; // [esp+10h] [ebp-30h] BYREF
  int v11; // [esp+3Ch] [ebp-4h]

  AfxEnableControlContainer(0);
  CWinApp::Enable3dControlsStatic(this);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  Sleep(0);
  v2 = LoadLibraryA(aCeppDll);
  if ( v2 )
  {
    Sleep(0);
    Sleep(0);
    Sleep(0);
    Sleep(0);
    Sleep(0);
    Sleep(0);
    Sleep(0);
    Sleep(0);
    Sleep(0);
    Sleep(0);
    Sleep(0);
    Sleep(0);
    Sleep(0);
    Sleep(0);
    tionCatcher = (void (*)(void))GetProcAddress(v2, aTioncatcher);
    if ( tionCatcher )
      tionCatcher();
  }
  sub_42FAB0(aLocalAppwizard);
  CWinApp::LoadStdProfileSettings(this, 4u);
  v4 = (CMultiDocTemplate *)sub_41A4C0(0x8Cu);
  v11 = 0;
  if ( v4 )
    v5 = CMultiDocTemplate::CMultiDocTemplate(
           v4,
           0x81u,
           (struct CRuntimeClass *)&off_43A8F8,
           (struct CRuntimeClass *)&off_43AB68,
           (struct CRuntimeClass *)&off_43A9E0);
  else
    v5 = 0;
  CWinApp::AddDocTemplate(this, v5);
  v6 = sub_41A4C0(0x1D8u);
  v11 = 1;
  if ( v6 )
    v7 = sub_4016F0(v6);
  else
    v7 = 0;
  v8 = *(_DWORD *)v7;
  v11 = -1;
  result = (*(int (__thiscall **)(int, int, int, _DWORD, _DWORD))(v8 + 184))(v7, 128, 13598720, 0, 0);
  if ( result )
  {
    *((_DWORD *)this + 7) = v7;
    sub_42F136(v10);
    v11 = 2;
    sub_42F0E3(v10);
    if ( sub_42F74D(v10) )
    {
      sub_41A757(*((_DWORD *)this + 29));
      UpdateWindow(*(HWND *)(v7 + 28));
      v11 = -1;
      CCommandLineInfo::~CCommandLineInfo((CCommandLineInfo *)v10);
      result = 1;
    }
    else
    {
      v11 = -1;
      CCommandLineInfo::~CCommandLineInfo((CCommandLineInfo *)v10);
      result = 0;
    }
  }
  return result;
}