clz.exe

留侯

大蜘蛛：
clz.exe infected with BackDoor.Qbot.75

hddu

2011-06-09 22:07:26    创建文件      操作:允许
进程路径:F:\virus\clz\clz.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Abevo
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-06-09 22:07:26    创建文件      操作:允许
进程路径:F:\virus\clz\clz.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Abevo\imgy.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*.exe


2011-06-09 22:07:28    创建文件      操作:允许
进程路径:F:\virus\clz\clz.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Ytriin
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-06-09 22:07:30    运行应用程序      操作:允许
进程路径:F:\virus\clz\clz.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpe104b820.bat"
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe


2011-06-09 22:07:31    删除文件      操作:允许
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:F:\virus\clz\clz.exe
触发规则:应用程序规则->CMD设置->%windir%\system32\cmd.exe->?:\*

JusT.Like

G Data 2012 BB Blocked


*** Process ***
Process: 3568
File name: ovvue.exe
Path: d:\applic\sandbox\vinsk_lee\test\user\current\appdata\roaming\caabof\ovvue.exe
Publisher: Unknown publisher
Creation date: 05/19/11 03:36:18
Modification date: 05/19/11 03:36:18
Started by: clz.exe
Publisher: Unknown publisher

*** Actions ***
The program has executed actions in the name of another program.
The program is trying to create a startup item to launch a program automatically at system startup.

*** Quarantine ***
The following files were moved into quarantine:
C:\Users\Vinsk_Lee\Desktop\clz.exe
D:\Applic\Sandbox\Vinsk_Lee\TEST\user\current\AppData\Roaming\Caabof\ovvue.exe
D:\Applic\Sandbox\Vinsk_Lee\TEST\user\current\AppData\Roaming\Moesxi\ephu.abz

The following registry entries were deleted:
\REGISTRY\\REGISTRY\USER\Sandbox_Vinsk_Lee_TEST\user\current\Software\Microsoft\Internet Explorer
\REGISTRY\\REGISTRY\USER\Sandbox_Vinsk_Lee_TEST\user\current\Software\Microsoft\Internet Explorer\PhishingFilter
\REGISTRY\\REGISTRY\USER\Sandbox_Vinsk_Lee_TEST\user\current\Software\Microsoft\Internet Explorer\Privacy
\REGISTRY\\REGISTRY\USER\Sandbox_Vinsk_Lee_TEST\user\current\Software\Microsoft\Windows\CurrentVersion\Internet Settings
\REGISTRY\\REGISTRY\USER\Sandbox_Vinsk_Lee_TEST\user\current\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
\REGISTRY\\REGISTRY\USER\Sandbox_Vinsk_Lee_TEST\user\current\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
\REGISTRY\\REGISTRY\USER\Sandbox_Vinsk_Lee_TEST\user\current\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
\REGISTRY\USER\SANDBOX_VINSK_LEE_TEST\user\current\software\Microsoft\Internet Explorer\PhishingFilter || EnabledV8
\REGISTRY\USER\SANDBOX_VINSK_LEE_TEST\user\current\software\Microsoft\Internet Explorer\Privacy || CleanCookies
\REGISTRY\USER\SANDBOX_VINSK_LEE_TEST\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 || 1406
\REGISTRY\USER\SANDBOX_VINSK_LEE_TEST\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 || 1609
\REGISTRY\USER\SANDBOX_VINSK_LEE_TEST\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 || 1406
\REGISTRY\USER\SANDBOX_VINSK_LEE_TEST\user\current\software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 || 1609

XMonster

hj5abc 发表于 2011-6-9 21:20
mse kill
VirTool:Win32/Obfuscator.PN

报的不一样

hj5abc

dm34343667 发表于 2011-6-10 15:28
报的不一样

恩 我报的那个是启发 现在入库了~

saga3721

红伞杀“TR/PSW.Zbot.2803 [trojan]”。

Love=卡巴+费尔

恋亿晓

hx1997

Oxalis
G:\Documents and Settings\Administrator.HX-C0987054243B\桌面\clz.rar > clz.exe - Heur.Suspicious@E87A87E35697

dannes456

卡巴阻止下载