WHQL 驱动 32X

wwwab

ANY.LNK 发表于 2023-1-8 05:07
微软现在解压全部清空Trojan:Win64/RootkitDrv!MSR（入库）@wwwab 是你上报的吗？

这次的分析师真狠

ANY.LNK

wwwab 发表于 2023-1-8 09:03
这次的分析师真狠

要不趁热打铁，再把11月份的那批也一起上报了？
上周周六凌晨五点我上报的一WHQL也处理得挺快的，但是下午上报的那批至今都未处理

wwwab

ANY.LNK 发表于 2023-1-8 09:17
要不趁热打铁，再把11月份的那批也一起上报了？

这次这批的分析师太6啦

ANY.LNK

wwwab 发表于 2023-1-8 09:19
这次这批的分析师太6啦

确实，给这次的分析效率点赞，我印象中论坛里还有一些WHQL rootkits没有入库，也试着一起提交了吧

anxiety520

wwwab 发表于 2023-1-8 09:19
这次这批的分析师太6啦

编辑

maxmara2

Log
Scan Log
Version of detection engine: 26547P (20230107)
Date: 1/8/2023
Scanned disks, folders and files: Z:\JmSU1X2J_infected2023010501\Downloads
Z:\JmSU1X2J_infected2023010501\Downloads\14021b3a6eaca0718a03c39b602e12aea2e78d70e0a33dcb3fcc8c66d4f2e167.sys - a variant of Win64/Rootkit.Agent.BS.gen trojan - cleaned by deleting [1]
Z:\JmSU1X2J_infected2023010501\Downloads\62838d2ed5ea996375e0e6a29b00a6213cc25e89935ef5582cd9c0ebea527558.sys - a variant of Win64/Rootkit.Agent.BS.gen trojan - cleaned by deleting [1]
Z:\JmSU1X2J_infected2023010501\Downloads\7987432e06ede9ac618fba0091f5d632e44c48661f298f4010f00a4ca8fb1f14.sys - a variant of Win64/Rootkit.Agent.BS.gen trojan - cleaned by deleting [1]
Z:\JmSU1X2J_infected2023010501\Downloads\827ff254a8f16247e1e67e756691b4ccbacc6dabc532468e54d3f83ec1f38c26.sys - a variant of Win64/Rootkit.Agent.BQ.gen trojan - cleaned by deleting [1]
Z:\JmSU1X2J_infected2023010501\Downloads\976e74a800fb3905911d6e3701d89bb4b722b067a7f199b0020b8cfafeaa5118.sys - a variant of Win64/Rootkit.Agent.BS.gen trojan - cleaned by deleting [1]
Z:\JmSU1X2J_infected2023010501\Downloads\996434920b27f2534fd1197810f391e5d8899dfde94500517b7632f17a8d3d8b.sys - a variant of Win64/Rootkit.Agent.BS.gen trojan - cleaned by deleting [1]
Z:\JmSU1X2J_infected2023010501\Downloads\c02b7979be0d931878e35b58223d3bb05fd7913495051c6a9a56b77e96c15cd1.sys - a variant of Win64/Rootkit.Agent.BS.gen trojan - cleaned by deleting [1]
Z:\JmSU1X2J_infected2023010501\Downloads\c444e1c6238b13e4e3d6f85269ba721b00460e4252f0b3f7001e859d780248c3.sys - a variant of Win64/Rootkit.Agent.BS.gen trojan - cleaned by deleting [1]
Z:\JmSU1X2J_infected2023010501\Downloads\c823ed1e83337cddb9e43409ed92681590b6d2a251058b221734864233878c92.sys - a variant of Win64/Rootkit.Agent.BS.gen trojan - cleaned by deleting [1]
Z:\JmSU1X2J_infected2023010501\Downloads\f2401dd344ef5c65ad674c45e4a5dbc911b0cc6d0c757bd413ffbe715422e080.sys - a variant of Win64/Rootkit.Agent.BS.gen trojan - cleaned by deleting [1]
Number of scanned objects: 10
Number of detections: 10
Number of cleaned objects: 10
Time of completion: 1:03:13 PM  Total scanning time: 1 sec (00:00:01)

Notes:
[1] Object has been deleted as it only contained the virus body.

maxmara2

上面是eset 手动扫描才触发， 解压后有部分尚未kill

anxiety520

截止到23.01.13 卡巴只杀了一个 样本均以提交

1. 事件: 检测到恶意对象
   
2. 用户: DESKTOP-66QFSL8\ASUS
   
3. 用户类型: 活动用户
   
4. 组件: 病毒扫描
   
5. 结果: 检测到
   
6. 结果说明: 检测到
   
7. 类型: 木马
   
8. 名称: HEUR:Trojan.Win64.MalDrv.gen
   
9. 精确度: 确切
   
10. 威胁级别: 高
    
11. 对象类型: 文件
    
12. 对象名称: ba96f697c7da94fdc27a9c57292ed82f08f8d6e0e119794a40904cc7d10d0a71.sys
    
13. 对象路径: C:\Users\ASUS\Downloads\rootkits
    
14. MD5: 331113D1D54A3610F9C9BD72FC783721
    
15. 原因: 专家分析
    
16. 数据库发布日期: 今天，2023.01.13 下午 12:52:00

复制代码