银狐 1x，vt0

显示全部楼层 · 发表于 2025-8-15 21:28:46

ESET:
8/15/2025 9:26:49 PM;Advanced memory scanner;file;Operating memory » regsvr32.exe(33892);a variant of Win64/Farfli.AG trojan;contained infected files (after the next restart);;;06E787D1D4FCEB6831E269CEED66D9A7B8F0C3FF;;;
8/15/2025 9:27:28 PM;Advanced memory scanner;file;Operating memory » regsvr32.exe(9940);a variant of Win64/Farfli_AGen.C trojan;contained infected files (after the next restart);NT AUTHORITY\ANONYMOUS LOGON;;DC2F3F3BF3DED28539C2C95FD21B7EC43641AC5A;;;

显示全部楼层 · 发表于 2025-8-15 23:43:34

腾讯电脑管家 1X

显示全部楼层 · 发表于 2025-8-16 16:10:42

ESET Smart Security Premium 解压、扫描不报，沙盘中双击 LiveGrid 报可疑对象，kill

扫描日志
检测引擎的版本: 31702 (20250815)
日期: 2025/8/16  时间: 16:09:19
已扫描的磁盘、文件夹和文件: W:\Sandbox\Admin\DefaultBox\drive\W\pinyin_sogou-v8.31\pinyin_sogou-v8.31.exe
用户: DESKTOP-K07940I\Admin
W:\Sandbox\Admin\DefaultBox\drive\W\pinyin_sogou-v8.31\pinyin_sogou-v8.31.exe > NSIS > updatenet.7z.001 > 7ZIP >  - 读取压缩文件时出错
已扫描的对象数: 20
检测数: 0
完成时间: 16:09:21  总扫描时间: 2 秒 (00:00:02)

2025/8/16 16:09:52;文件系统实时防护;文件;\Device\TweakCubeRamDisk0\Sandbox\Admin\DefaultBox\drive\W\pinyin_sogou-v8.31\pinyin_sogou-v8.31.exe;Suspicious Object;已通过删除清除;DESKTOP-K07940I\Admin;尝试通过应用程序访问文件时发生事件: C:\Windows\explorer.exe (F9C05A8F0444EBA66D1B7792FDBAA287BDB12B30).;1E6C575DB434BB8AB92FF2E77C512390C2E32350;2025/8/16 16:08:50;;

[病毒样本] 银狐 1x，vt0