可疑驱动 火绒报Rootkit/Loader.e

rfuujk8i

360 kill

384也7492374

cs all

user114514

蜘蛛

Checking: hwperf.sys
Engine version: 7.0.62.1180
Total virus-finding records: 12517279
File size: 174.34 KB
File MD5: 71950fa39a3d2fdace643f1671413ac4

hwperf.sys infected with Trojan.NtRootKit.20509

wwwab

ANY.LNK 发表于 2024-3-17 11:58
微软目前静态不报告，看起来需要更加决定性的证据我才能上报，目前也没有找到哪家的AV被Kill掉了

https://bbs.kafan.cn/thread-2267270-1-1.html我猜得一点儿都没错，就是用来KillAV的驱动

wwwab

成了

Analyst comments:
We have reviewed the files and added malware detections for them to the next definition update. The latest definition information is available here: https://docs.microsoft.com/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus  Thank you for contacting Microsoft.

ANY.LNK

wwwab 发表于 2024-3-20 21:13
https://bbs.kafan.cn/thread-2267270-1-1.html我猜得一点儿都没错，就是用来KillAV的驱动

不过也果然需要特定的配置才能生效