银狐1X

aikafans

eset

hansyu

ESSP
时间;扫描程序;对象类型;对象;检测;操作;用户;信息;哈希;此处首次所见
2024/9/12 23:43:42;ESET LiveGuard;文件;R:\TestBox\Installer_6.8.msi;ESET LiveGuard 特洛伊木马;已删除;;;197A562DB626C42FC4AE3A28EF9CB4B3C601188C;2024/9/12 23:42:59

断簪

BD也重启清除失败

awsl10000次

hansyu 发表于 2024-9-12 23:44
ESSP
时间;扫描程序;对象类型;对象;检测;操作;用户;信息;哈希;此处首次所见
2024/9/12 23:43:42; ...

EIS报A Variant Of Win64/Agent_AGen.CDQ
入库了也会触发liveguard嘛

驭龙

断簪 发表于 2024-9-12 23:39
虚拟机而已，随便换
确实是伞的启发

这是啥套路？我这边Avira正主不杀，然后FS这个oem的却杀了，太无解了

驭龙

awsl10000次 发表于 2024-9-12 23:55
EIS报A Variant Of Win64/Agent_AGen.CDQ
入库了也会触发liveguard嘛

有可能是ELG优先级比高启发优先，或者是13楼的特征库没有及时更新

Fadouse

Deep Instinct 双击Kill

YU2711

驭龙 发表于 2024-9-12 23:59
这是啥套路？我这边Avira正主不杀，然后FS这个oem的却杀了，太无解了

龙大有双击吗
他那个好像是报衍生物

驭龙

YU2711 发表于 2024-9-13 00:13
龙大有双击吗
他那个好像是报衍生物

你不是双击了吗，我看你回复好像是双击miss了，我这边开了智能应用控制，没法测双击

YU2711

驭龙 发表于 2024-9-13 00:17
你不是双击了吗，我看你回复好像是双击miss了，我这边开了智能应用控制，没法测双击

那我更正一下.....
我这边双击Avira托盘直接被干掉,不过衍生物应该是有杀掉

1. [2024-09-12 23:55:56.037] [info] [Remediation] [thread id: 1248] Remediation of HEUR/AGEN.1374936 started.
   
2. [2024-09-12 23:55:56.037] [warning] [Remediation] [thread id: 1248] Can't get creation date of HEUR/AGEN.1374936 Error: 5 Message: 拒绝访问。 Path: \\?\C:\Program Files (x86)\Wegame\wegame_daemon.exe
   
3. [2024-09-12 23:55:56.037] [warning] [Remediation] [thread id: 1248] Can't get SHA256 of HEUR/AGEN.1374936 Error: 1004 Message: 无效标志。 Path: \\?\C:\Program Files (x86)\Wegame\wegame_daemon.exe
   
4. [2024-09-12 23:55:56.854] [info] [RealTimeProtection] [thread id: 1248] [Configuration] Add path to non persistent Acl: c:\program files (x86)\wegame\wegame_daemon.exe
   
5. [2024-09-12 23:55:56.854] [error] [RealTimeProtection] [thread id: 1248] [Configuration] Failed to add ACL (Error: 0xb7)
   
6. [2024-09-12 23:55:56.854] [error] [RealTimeProtection] [thread id: 1248] [Configuration] Failed to add entry to ACL table.
   
7. [2024-09-12 23:55:56.872] [info] [RealTimeProtection] [thread id: 1248] [Configuration] Add path to non persistent Acl: c:\PROGRA~2\wegame\WEGAME~1.EXE
   
8. [2024-09-12 23:55:57.030] [info] [Remediation] [thread id: 1248] Original file won't be deleted, skipping quarantine, result=1
   
9. [2024-09-12 23:55:57.157] [info] [Core] [thread id: 1248] [CoreSdk] Retrieving engine version
   
10. [2024-09-12 23:55:57.157] [info] [Core] [thread id: 1248] [CoreSdk] Retrieving engine creation date
    
11. [2024-09-12 23:55:57.157] [info] [Core] [thread id: 1248] [CoreSdk] Retrieving vdf version
    
12. [2024-09-12 23:55:57.157] [info] [Core] [thread id: 1248] [CoreSdk] Retrieving vdf creation date
    
13. [2024-09-12 23:55:58.784] [info] [Remediation] [thread id: 1248] Remediation of HEUR/AGEN.1374936 finished successfully.
    
14. [2024-09-12 23:55:58.793] [info] [Core] [thread id: 1248] [CoreSdk] Retrieving engine version
    
15. [2024-09-12 23:55:58.793] [info] [Core] [thread id: 1248] [CoreSdk] Retrieving engine creation date
    
16. [2024-09-12 23:55:58.793] [info] [Core] [thread id: 1248] [CoreSdk] Retrieving vdf version
    
17. [2024-09-12 23:55:58.793] [info] [Core] [thread id: 1248] [CoreSdk] Retrieving vdf creation date
    
18. [2024-09-12 23:55:58.793] [info] [RealTimeProtection] [thread id: 1248] [Mitigation] Remediate file \\?\C:\Program Files (x86)\Wegame\wegame_daemon.exe was successful
    
19. [2024-09-12 23:55:58.976] [info] [Remediation] [thread id: 1248] Remediation of HEUR/AGEN.1374936 started.
    
20. [2024-09-12 23:55:58.976] [warning] [Remediation] [thread id: 1248] Can't get creation date of HEUR/AGEN.1374936 Error: 5 Message: 拒绝访问。 Path: \\?\C:\Program Files (x86)\Wegame\runtime.exe
    
21. [2024-09-12 23:55:58.976] [warning] [Remediation] [thread id: 1248] Can't get SHA256 of HEUR/AGEN.1374936 Error: 1004 Message: 无效标志。 Path: \\?\C:\Program Files (x86)\Wegame\runtime.exe
    
22. [2024-09-12 23:55:58.976] [info] [RealTimeProtection] [thread id: 1248] [Configuration] Add path to non persistent Acl: c:\program files (x86)\wegame\runtime.exe
    
23. [2024-09-12 23:55:58.976] [error] [RealTimeProtection] [thread id: 1248] [Configuration] Failed to add ACL (Error: 0xb7)
    
24. [2024-09-12 23:55:58.976] [error] [RealTimeProtection] [thread id: 1248] [Configuration] Failed to add entry to ACL table.
    
25. [2024-09-12 23:55:59.193] [info] [RealTimeProtection] [thread id: 1248] [Configuration] Add path to non persistent Acl: c:\PROGRA~2\wegame\runtime.exe
    
26. [2024-09-12 23:55:59.241] [info] [Remediation] [thread id: 1248] Original file won't be deleted, skipping quarantine, result=1
    
27. [2024-09-12 23:55:59.274] [info] [Core] [thread id: 1248] [CoreSdk] Retrieving engine version
    
28. [2024-09-12 23:55:59.274] [info] [Core] [thread id: 1248] [CoreSdk] Retrieving engine creation date
    
29. [2024-09-12 23:55:59.274] [info] [Core] [thread id: 1248] [CoreSdk] Retrieving vdf version
    
30. [2024-09-12 23:55:59.274] [info] [Core] [thread id: 1248] [CoreSdk] Retrieving vdf creation date
    
31. [2024-09-12 23:56:00.142] [info] [Remediation] [thread id: 1248] Remediation of HEUR/AGEN.1374936 finished successfully.
    
32. [2024-09-12 23:56:00.163] [info] [Core] [thread id: 1248] [CoreSdk] Retrieving engine version
    
33. [2024-09-12 23:56:00.163] [info] [Core] [thread id: 1248] [CoreSdk] Retrieving engine creation date
    
34. [2024-09-12 23:56:00.163] [info] [Core] [thread id: 1248] [CoreSdk] Retrieving vdf version
    
35. [2024-09-12 23:56:00.163] [info] [Core] [thread id: 1248] [CoreSdk] Retrieving vdf creation date
    
36. [2024-09-12 23:56:00.163] [info] [RealTimeProtection] [thread id: 1248] [Mitigation] Remediate file \\?\C:\Program Files (x86)\Wegame\runtime.exe was successful
    
37. [2024-09-12 23:56:02.026] [info] [Core] [thread id: 4812] [CoreSdk] Creating URL checker instance

复制代码

安装目录下也被删掉一些文件
重启之后