x2 (2023-01-26)

显示全部楼层 · 发表于 2023-1-26 20:37:14

扫描开始： 2023/1/26 20:36:08
D:\Download\vir\2\1.iso -> Invoice_97157.vbs 发现风险： VB:Trojan.Valyria.7861 (B) [krnl.xmd]
D:\Download\vir\2\2.iso -> Invoice_20928.vbs 发现风险： VB:Trojan.Valyria.7861 (B) [krnl.xmd]

复制代码

显示全部楼层 · 发表于 2023-1-26 23:01:09

VBS/TrojanDropper.Agent.PCS trojan

expected version: 26650.

显示全部楼层 · 发表于 2023-1-27 00:30:11

金山毒霸MISS

显示全部楼层 · 发表于 2023-1-27 03:06:23

Avast：2（但应该是因为恶意文件在压缩包里，所以没有办法处理了？？？？？？后来尝试打开那些iso文件，触发IDP全部处理了）

D:\测试专用\2\1.iso|>Invoice_97157.vbs [L] Script:SNH-gen [Trj] (0)
While moving file to chest, error occurred: Error 0x0000A47F
D:\测试专用\2\2.iso|>Invoice_20928.vbs [L] Script:SNH-gen [Trj] (0)
While moving file to chest, error occurred: Error 0x0000A47F

复制代码

<ChestId>00000114</ChestId>
<FileTime>1674759778</FileTime>
<OrigFileName>1.iso</OrigFileName>
<OrigFolder>D:\测试专用\2</OrigFolder>
<Comment/>
<Virus>IDP.Generic.fa3a9b975c2a.3.2</Virus>
<Category>Vir</Category>
<Restore>yes</Restore>
<TransferTime>1674759778</TransferTime>
<FileSize>290816</FileSize>
<Viruses>IDP.Generic.fa3a9b975c2a.3.2</Viruses>
<SupportExceptions>yes</SupportExceptions>
<SendToAnalysis>yes</SendToAnalysis>
</ChestEntry>
-<ChestEntry>
<ChestId>00000115</ChestId>
<FileTime>1674759801</FileTime>
<OrigFileName>2.iso</OrigFileName>
<OrigFolder>D:\测试专用\2</OrigFolder>
<Comment/>
<Virus>IDP.Generic.1649b879a199.3.2</Virus>
<Category>Vir</Category>
<Restore>yes</Restore>
<TransferTime>1674759801</TransferTime>
<FileSize>290816</FileSize>
<Viruses>IDP.Generic.1649b879a199.3.2</Viruses>
<SupportExceptions>yes</SupportExceptions>
<SendToAnalysis>yes</SendToAnalysis>

复制代码

显示全部楼层 · 发表于 2023-1-27 09:00:47

MD一扫miss，过了一会儿二扫kill

显示全部楼层 · 发表于 2023-1-27 13:11:09

drweb scan miss

显示全部楼层 · 发表于 2023-1-27 18:35:12

您好，火绒暂不支持iso格式文件的识别，感谢您的反馈。

显示全部楼层 · 发表于 2023-1-27 19:13:19

petr0vic 发表于 2023-1-27 18:35

It means unpacking and scanning of iso files is not supported (Не поддерживается распаковка и сканирование файлов ISO)

iso file is usually used to store the system image, so they are often huge. For such extreme compression formats, there are usually many antivirus software that do not support unpacking and scanning, because it wastes resources and time. And even all compressed package files will not be scanned by WiseVector at present. However, all types of compressed package files, including iso files, must be decompressed to run the files in them, and anti-virus software can monitor them for processing at this time, so as long as the files in them can be detected, there will be no risk. You can manually decompress them to test the anti-virus software.

显示全部楼层 · 发表于 2023-1-27 19:25:41

GDHJDSYDH 发表于 2023-1-27 09:00
MD一扫miss，过了一会儿二扫kill

其实直接把vbs从iso里拖出来就能直接杀了

显示全部楼层 · 发表于 2023-1-28 01:40:17

火绒MISS

[病毒样本] x2 (2023-01-26)

本帖子中包含更多资源

本帖子中包含更多资源