9x(部分vt首传)

全身发抖

没时间再找了，就这些吧
VirusTotal - File - f80bc12ffee2539f5827757dc8052decbbd795e604a58d8c83ae357cf5055151 vt=6
VirusTotal - File - 909dda31d0a63a5953db5aa84299b6e0eacac826a172589958a6d73b635656bf vt=17
VirusTotal - File - c9fa015d4bc21e2cb9bcb43a6e71dbe746b107daf8a041cabf88a0efefc6549b vt=6
VirusTotal - File - ab6bd75d672429a1ecbe7010082b3455b2b0b24952554788a5d1b33af0c77531 vt=36
VirusTotal - File - 570c265082d625f99c178ac6565c18798f614e97d1edbeff6fd5acbdfcafdc9a vt=6
VirusTotal - File - 2dd9e0392bcc1576d0eca89e3a3efdd6462a322fb267b50e1c97b90975d83f58 vt=19
VirusTotal - File - 7344f19d5db9569d0130476989db4c67bb0743c7421bc71eb38452cf0e9bb418 vt=18
VirusTotal - File - 4a94cb3b8694baaa65d24769fcccf890c8dfd3a8ce2e187bed58b926563c1cdc vt=3
VirusTotal - File - 70c74acdd70929c1074a2daf5eacd81feaf4abf9e10b6d7e3eca6a1580e3d722 vt=2

https://www.123865.com/s/nUw9-5tPN3
https://pan.huang1111.cn/s/3eyDdsm
解压密码 infected

Nocria

IKARUS - 6/9

1. [19.11.2024 20:47:56] On-demand scan started: "TemporaryScan"
   
2. [19.11.2024 20:47:56] Found, 0.34s, SigName: "Trojan.WinGo.Shellcoderunner", SigId: 5571819, Type: "VIRUS", File: "C:\Users\promi\Downloads\Fakeapp-6\Fakeapp-6\70c74acdd70929c1074a2daf5eacd81feaf4abf9e10b6d7e3eca6a1580e3d722.msi"
   
3. [19.11.2024 20:47:57] Found, 0.50s, SigName: "Trojan.Win64.Injector", SigId: 5349794, Type: "VIRUS", File: "C:\Users\promi\Downloads\Fakeapp-6\Fakeapp-6\2dd9e0392bcc1576d0eca89e3a3efdd6462a322fb267b50e1c97b90975d83f58.exe"
   
4. [19.11.2024 20:47:57] Found, 0.56s, SigName: "Trojan-Downloader.Win64.Agent", SigId: 5606022, Type: "VIRUS", File: "C:\Users\promi\Downloads\Fakeapp-6\Fakeapp-6\909dda31d0a63a5953db5aa84299b6e0eacac826a172589958a6d73b635656bf.exe"
   
5. [19.11.2024 20:47:58] Found, 1.39s, SigName: "PUA.NoobyProtect", SigId: 3296670, Type: "VIRUS", File: "C:\Users\promi\Downloads\Fakeapp-6\Fakeapp-6\ab6bd75d672429a1ecbe7010082b3455b2b0b24952554788a5d1b33af0c77531.exe"
   
6. [19.11.2024 20:48:03] Found, 6.39s, SigName: "Trojan.Win32.Agent", SigId: 5531375, Type: "VIRUS", File: "C:\Users\promi\Downloads\Fakeapp-6\Fakeapp-6\c9fa015d4bc21e2cb9bcb43a6e71dbe746b107daf8a041cabf88a0efefc6549b.msi"
   
7. [19.11.2024 20:48:05] Found, 8.39s, SigName: "Trojan.SuspectCRC", SigId: 5419546, Type: "VIRUS", File: "C:\Users\promi\Downloads\Fakeapp-6\Fakeapp-6\7344f19d5db9569d0130476989db4c67bb0743c7421bc71eb38452cf0e9bb418.exe"
   
8. [19.11.2024 20:48:05] On-demand scan FINISHED: "TemporaryScan"
   
9. [19.11.2024 20:48:05] ----------------------------------------------------
   
10. [19.11.2024 20:48:05] Directories scanned: 2
    
11. [19.11.2024 20:48:05] Files scanned: 9
    
12. [19.11.2024 20:48:05] Virus found: 6
    
13. [19.11.2024 20:48:05] ----------------------------------------------------
    

复制代码

zhuzhu009

火绒7/9 剩下双击

zhuzhu009

360 扫描3/9
2dd9e...exe 没咋拦住


570.....msi 双击重启了，启动后进程存在远控的病毒，之后自退，360火绒正常启动

7344f........exe 无拦截

ab6bd......exe  后弹出正常line


c9fa.......msi  未拦截，扫出两个黑dll



后弹出


f80bc........msi  未拦截 成功释放衍生物 360被强退，后可以正常启动，但未扫出病毒

UNknownOoo

火绒
扫描：7x

1. 病毒详情：
   
2. 风险路径：C:\Users\Administrator\Desktop\Fakeapp-6\909dda31d0a63a5953db5aa84299b6e0eacac826a172589958a6d73b635656bf.exe, 病毒名：TrojanDownloader/Lotok.ch, 病毒ID：551299f84bdd6d6b, 处理结果：暂不处理
   
3. 风险路径：C:\Users\Administrator\Desktop\Fakeapp-6\7344f19d5db9569d0130476989db4c67bb0743c7421bc71eb38452cf0e9bb418.exe, 病毒名：TrojanDownloader/Agent.avd, 病毒ID：86875f6c846245f7, 处理结果：暂不处理
   
4. 风险路径：C:\Users\Administrator\Desktop\Fakeapp-6\ab6bd75d672429a1ecbe7010082b3455b2b0b24952554788a5d1b33af0c77531.exe >> yqyfghg.exe, 病毒名：HEUR:Backdoor/Lotok.bt, 病毒ID：7f6fda0c4a538c38, 处理结果：暂不处理
   
5. 风险路径：C:\Users\Administrator\Desktop\Fakeapp-6\c9fa015d4bc21e2cb9bcb43a6e71dbe746b107daf8a041cabf88a0efefc6549b.msi, 病毒名：Trojan/HTML.Agent.an, 病毒ID：902eeb2873695a08, 处理结果：暂不处理
   
6. 风险路径：C:\Users\Administrator\Desktop\Fakeapp-6\c9fa015d4bc21e2cb9bcb43a6e71dbe746b107daf8a041cabf88a0efefc6549b.msi, 病毒名：Trojan/BAT.Runner.p, 病毒ID：efba62601c3b765d, 处理结果：暂不处理
   
7. 风险路径：C:\Users\Administrator\Desktop\Fakeapp-6\2dd9e0392bcc1576d0eca89e3a3efdd6462a322fb267b50e1c97b90975d83f58.exe, 病毒名：Trojan/Injector.bhp, 病毒ID：8907d00f9644703e, 处理结果：暂不处理
   
8. 风险路径：C:\Users\Administrator\Desktop\Fakeapp-6\70c74acdd70929c1074a2daf5eacd81feaf4abf9e10b6d7e3eca6a1580e3d722.msi, 病毒名：Trojan/Generic!D9499606B4881B36, 病毒ID：d9499606b4881b36, 处理结果：暂不处理
   
9. 风险路径：C:\Users\Administrator\Desktop\Fakeapp-6\570c265082d625f99c178ac6565c18798f614e97d1edbeff6fd5acbdfcafdc9a.msi, 病毒名：Trojan/Generic!BAD1E0348EE6AE72, 病毒ID：bad1e0348ee6ae72, 处理结果：暂不处理
   

复制代码

全身发抖

UNknownOoo 发表于 2024-11-19 21:34
火绒
扫描：7x

高启发能杀多少

UNknownOoo

全身发抖 发表于 2024-11-19 21:40
高启发能杀多少

高启发误报太严重，在我的环境下没有参考意义

dght432

卡巴快速拉黑

剩余1个杀衍生物

总结：kill all

biue

腾讯电脑管家 6X

ongarabazanade

Avast解压6X剩余3X没双击