银狐2x

ulyanov2233

superLYT 发表于 2025-8-22 10:22
BD右键剩余InstallerTD.msi，双击后重复拦截一个dll和exe，C:\Program Files (x86)\Windows NT\curl.dll和C ...

bd这算是没完全防下来

superLYT

ulyanov2233 发表于 2025-8-22 11:02
bd这算是没完全防下来

确实

ongarabazanade

Curve25519

ESET Smart Security Premium 解压不报，扫描杀 InstallerTD.msi，sluvou_pinyin5.02.msi 扫描、沙盘中安装都不报，miss

扫描日志
检测引擎的版本: 31735 (20250822)
日期: 2025/8/22  时间: 15:29:40
已扫描的磁盘、文件夹和文件: W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\InstallerTD.msi;W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi
用户: DESKTOP-K07940I\Admin
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\InstallerTD.msi > MSI > Binary.Setup - Win64/Agent.FCM 特洛伊木马 的变量 - 已保留
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > aegis.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/304_a592486.chunk.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/474_0e262ed.chunk.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/6_12770df.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/7_3f88f33.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/8_5866cc4.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/9_f86c4dc.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/aidraw_9807e73.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/airead_215f357.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/bg_68d2e93.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/exit-imgs_0bd4532.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/logo-big_3db1ae7.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/new-sogou-logo-sider_974aed6.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/setting-select_6423fe6.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/pages/main_31dbb79.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > index.html - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > polyfill.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > react-dom.production.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > react-router-dom.production.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sluvou_pinyin5.02\sluvou_pinyin5.02\sluvou_pinyin5.02.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > react.production.min.js - 错误 - 文件受密码保护
已扫描的对象数: 2517
检测数: 1
已清除的对象数: 0
完成时间: 15:30:11  总扫描时间: 31 秒 (00:00:31)

ewader

ongarabazanade 发表于 2025-8-21 20:54

奇怪，ioa不报

ongarabazanade

ewader 发表于 2025-8-22 19:50
奇怪，ioa不报

把ioa重装一遍，重启一下电脑，再杀杀看行不

ewader

ongarabazanade 发表于 2025-8-22 21:09
把ioa重装一遍，重启一下电脑，再杀杀看行不

还是不报，今天的样本都杀了，昨天的不杀