疑似伪装eyy的银狐

xu126yx

HMPA kill pythonw.exe - heapheapprotect
ewaiwai2025.exe -> pythonw.exe -> libffi-7.dll, callee allocatevirtualmemory

xjwtzq

奇安信拦截，安天miss

Rukia

BEST
防篡改检测到了一个存在漏洞的驱动程序。 驱动程序已被阻止。驱动程序路径: C:\Users\......\Downloads\infected202512270101\vally3dka.sys

Yjln

啊松 发表于 2025-12-27 14:57
pdm加回滚

我第一次测卡巴重启之后无法启动，后面复现不了，可能是我直接把CodeIntegrity文件夹里面文件删了的原因吧

LingGao

Microsoft Defender MISS

已提交分析，微软研究员分析结果：
“Ewaiwai2025.exe”
Trojan:Win32/Malgent!MSR

下次更新时加入病毒库。

biue

腾讯电脑管家 1X

wowocock

wwwab 发表于 2025-12-27 15:28
火绒: 扫描 miss
双击 漏洞驱动致盲 @wowocock

漏洞驱动让他们入库了，不过无所谓，中毒后，用火绒恶意木马专杀查杀即可

wowocock

Yjln 发表于 2025-12-28 00:42
我第一次测卡巴重启之后无法启动，后面复现不了，可能是我直接把CodeIntegrity文件夹里面文件删了的原因 ...

360的根据产品信息禁止，其他的根据签名禁止。
<SiPolicy xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="urn:schemas-microsoft-com:sipolicy" PolicyType="Base Policy">
<VersionEx>1.0.3.9</VersionEx>
<PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
<PolicyID>{31351756-3F24-4963-8380-4E7602335AAE}</PolicyID>
<BasePolicyID>{31351756-3F24-4963-8380-4E7602335AAE}</BasePolicyID>
<Rules>
<Rule>
<Option>Enabled:UMCI</Option>
</Rule>
<Rule>
<Option>Disabled:Runtime FilePath Rule Protection</Option>
</Rule>
<Rule>
<Option>Enabled:Revoked Expired As Unsigned</Option>
</Rule>
<Rule>
<Option>Enabled:Inherit Default Policy</Option>
</Rule>
<Rule>
<Option>Enabled:Unsigned System Integrity Policy</Option>
</Rule>
<Rule>
<Option>Enabled:Advanced Boot Options Menu</Option>
</Rule>
<Rule>
<Option>Enabled:Update Policy No Reboot</Option>
</Rule>
</Rules>
<FileRules>
<Deny ID="ID_DENY_D_0001" FilePath="%OSDRIVE%\Program Files\360\360sd"/>
<Deny ID="ID_DENY_D_0002" ProductName="360壁纸"/>
<Deny ID="ID_DENY_D_0003" ProductName="360安全卫士"/>
<Deny ID="ID_DENY_D_0004" ProductName="360安全卫士 主程序模块"/>
<Deny ID="ID_DENY_D_0005" ProductName="Kingsoft Internet Security"/>
<Deny ID="ID_DENY_D_0006" ProductName="腾讯电脑管家"/>
<Deny ID="ID_DENY_D_0007" FileDescription="360杀毒 主程序"/>
<Deny ID="ID_DENY_D_0008" FileName="360sdrun.exe" FileDescription="360杀毒 启动程序"/>
<Deny ID="ID_DENY_D_0009" FileName="sesvc.exe"/>
<Allow ID="ID_ALLOW_A_000A" FileName="*"/>
<Allow ID="ID_ALLOW_A_000B" FileName="*"/>
</FileRules>
<Signers>
<Signer Name="Signer 1" ID="ID_SIGNER_S_0001">
<CertRoot Type="TBS" Value="11533EFD6B326A4E065A936DE300FE0586A479F93D569D2403BD62C7AD35F1B2199DAEE3ADB510F429C4FC97B4B024E3"/>
<CertPublisher Value="ESET, spol. s r.o."/>
</Signer>
<Signer Name="Signer 2" ID="ID_SIGNER_S_0002">
<CertRoot Type="TBS" Value="A565BE97BE723FD92B3936963A90769DFFFB0504D123745C7659FD4B6CF9408F"/>
<CertPublisher Value="ESET, spol. s r.o."/>
</Signer>
<Signer Name="Signer 3" ID="ID_SIGNER_S_0003">
<CertRoot Type="TBS" Value="65B1D4076A89AE273F57E6EEEDECB3EAE129B4168F76FA7671914CDF461D542255C59D9B85B916AE0CA6FC0FCF7A8E64"/>
<CertPublisher Value="Trend Micro, Inc."/>
</Signer>
<Signer Name="Signer 4" ID="ID_SIGNER_S_0004">
<CertRoot Type="TBS" Value="9F69FF166F5DC446578A45D7D69482373755E141"/>
<CertPublisher Value="NortonLifeLock Inc."/>
</Signer>
<Signer Name="Signer 5" ID="ID_SIGNER_S_0005">
<CertRoot Type="TBS" Value="E767799478F64A34B3F53FF3BB9057FE1768F4AB178041B0DCC0FF1E210CBA65"/>
<CertPublisher Value="NortonLifeLock Inc."/>
</Signer>
<Signer Name="Signer 6" ID="ID_SIGNER_S_0006">
<CertRoot Type="TBS" Value="FEC727AF43D1569995CEA26E8EB97167165842A5B185304425A92C03B71254C5D51222837515F33E60CB8ED2E8C625BA"/>
<CertPublisher Value="AO Kaspersky Lab"/>
</Signer>
<Signer Name="Signer 7" ID="ID_SIGNER_S_0007">
<CertRoot Type="TBS" Value="D02AD42E17886FA9CB1193A57707D86F7387E8ED5B672B15034F40B40DB6DA92"/>
<CertPublisher Value="Kaspersky Lab"/>
</Signer>
<Signer Name="Signer 8" ID="ID_SIGNER_S_0008">
<CertRoot Type="TBS" Value="A229D2722BC6091D73B1D979B81088C977CB028A6F7CBF264BB81D5CC8F099F87D7C296E48BF09D7EBE275F5498661A4"/>
<CertPublisher Value="Avira Operations GmbH"/>
</Signer>
<Signer Name="Signer 9" ID="ID_SIGNER_S_0009">
<CertRoot Type="TBS" Value="A229D2722BC6091D73B1D979B81088C977CB028A6F7CBF264BB81D5CC8F099F87D7C296E48BF09D7EBE275F5498661A4"/>
<CertPublisher Value="北京火绒网络科技有限公司"/>
</Signer>
</Signers>
<SigningScenarios>
<SigningScenario ID="ID_SIGNINGSCENARIO_DRIVERS_1" Value="131">
<ProductSigners>
<FileRulesRef>
<FileRuleRef RuleID="ID_ALLOW_A_000A"/>
</FileRulesRef>
</ProductSigners>
<TestSigners/>
<TestSigningSigners/>
</SigningScenario>
<SigningScenario ID="ID_SIGNINGSCENARIO_WINDOWS" Value="12">
<ProductSigners>
<DeniedSigners>
<DeniedSigner SignerId="ID_SIGNER_S_0001"/>
<DeniedSigner SignerId="ID_SIGNER_S_0002"/>
<DeniedSigner SignerId="ID_SIGNER_S_0003"/>
<DeniedSigner SignerId="ID_SIGNER_S_0004"/>
<DeniedSigner SignerId="ID_SIGNER_S_0005"/>
<DeniedSigner SignerId="ID_SIGNER_S_0006"/>
<DeniedSigner SignerId="ID_SIGNER_S_0007"/>
<DeniedSigner SignerId="ID_SIGNER_S_0008"/>
<DeniedSigner SignerId="ID_SIGNER_S_0009"/>
</DeniedSigners>
<FileRulesRef>
<FileRuleRef RuleID="ID_DENY_D_0001"/>
<FileRuleRef RuleID="ID_DENY_D_0002"/>
<FileRuleRef RuleID="ID_DENY_D_0003"/>
<FileRuleRef RuleID="ID_DENY_D_0004"/>
<FileRuleRef RuleID="ID_DENY_D_0005"/>
<FileRuleRef RuleID="ID_DENY_D_0006"/>
<FileRuleRef RuleID="ID_DENY_D_0007"/>
<FileRuleRef RuleID="ID_DENY_D_0008"/>
<FileRuleRef RuleID="ID_DENY_D_0009"/>
<FileRuleRef RuleID="ID_ALLOW_A_000B"/>
</FileRulesRef>
</ProductSigners>
<TestSigners/>
<TestSigningSigners/>
</SigningScenario>
</SigningScenarios>
<CiSigners>
<CiSigner SignerId="ID_SIGNER_S_0001"/>
<CiSigner SignerId="ID_SIGNER_S_0002"/>
<CiSigner SignerId="ID_SIGNER_S_0003"/>
<CiSigner SignerId="ID_SIGNER_S_0004"/>
<CiSigner SignerId="ID_SIGNER_S_0005"/>
<CiSigner SignerId="ID_SIGNER_S_0006"/>
<CiSigner SignerId="ID_SIGNER_S_0007"/>
<CiSigner SignerId="ID_SIGNER_S_0008"/>
<CiSigner SignerId="ID_SIGNER_S_0009"/>
</CiSigners>
<Settings>
<Setting Provider="AllHostIds" Key="AllKeys" ValueName="EnterpriseDefinedClsId">
<Value>
<Boolean>true</Boolean>
</Value>
</Setting>
<Setting Provider="PolicyInfo" Key="Information" ValueName="Id">
<Value>
<String>022422</String>
</Value>
</Setting>
<Setting Provider="PolicyInfo" Key="Information" ValueName="Name">
<Value>
<String>Microsoft Power Manager</String>
</Value>
</Setting>
</Settings>
</SiPolicy>

wowocock

wowocock 发表于 2025-12-29 10:51
漏洞驱动让他们入库了，不过无所谓，中毒后，用火绒恶意木马专杀查杀即可

因为火绒签名被禁止，所以需要找火绒客服要没签名版本的专杀，有点坑爹。奇怪的是虚拟机没影响 ，只有真机有影响，有点奇怪，不知道是谁的BUG.