Gh0st1X

ulyanov2233

essp扫描kill

C:\Users\Y8219\Downloads\99999\99999\99999.msi > MSI > disk1.cab > CAB > ThereD.dll - Win64/Agent_AGen.KGE 特洛伊木马 的变量 - 已删除
C:\Users\Y8219\Downloads\99999\99999\99999.msi > MSI > disk1.cab > CAB > resource.png > ZIP > Qt6Core.dll - Win64/Agent.IGE 特洛伊木马 的变量 - 已删除

tihs

卡巴斯基断网锁库免费版主防也能杀

wowocock

病毒名称：Trojan/ShellLoader.ajb
病毒ID：BFBED77435910D41
病毒路径：C:\Program Files (x86)\Google\谷歌翻译\ThereD.dll
操作类型：修改
操作结果：已处理，删除文件

进程ID：996
操作进程：C:\Windows\System32\msiexec.exe
操作进程命令行：C:\Windows\system32\msiexec.exe /V
父进程ID：904
父进程：C:\Windows\System32\services.exe

superLYT

双击ATD，弹了一个网页，ATD把我浏览器都隔离了

1073328164

AVG扫出三个文件

c199529

腾讯电脑管家18
ver:20260212
---------------------
2026-2-12 23:26:18 MD5:6b3cee28554f2c1a68b3c0188b563931
99999\99999.msi [Win32.Trojan.Silverfox.Wimw]
---------------------

谈谈MEMZ

Cortex XDR Kill

1. Application Information:
   
2. Source process ID: 8568
   
3. Source process name: msiexec.exe
   
4. Source application location: C:\Windows\System32\msiexec.exe
   
5. Source process command line: C:\Windows\System32\MsiExec.exe -Embedding 2566BDE0A0C756F891D19215354752F1
   
6. Source application version: 5.0.20348.2849 (WinBuild.160101.0800)
   
7. Source application publisher: Microsoft Corporation
   
8. Source application signers: Microsoft Corporation,Microsoft Corporation,Microsoft Corporation,Microsoft Corporation
   
9. Source process user name: N/A\User
   
10. 
    
11. 
    
12. Prevention Information:
    
13. Prevention date: 2026年2月13日
    
14. Prevention time: 0:26:15
    
15. OS version: 10.0.20348
    
16. Component: Behavioral Threat Protection
    
17. Cortex XDR code: C0400067
    
18. Prevention description: 检测到恶意行为
    
19. Verdict: 0
    
20. Quarantined: False
    
21. Post-Detected: False
    
22. Rule name: suspicious_injection_activity.1
    
23. Remote actor causality ID: AdycPEUqDm8AACF4AAAAAA==
    

复制代码