clz2.exe

a256886572008

http://camas.comodo.com/cgi-bin/submit?file=ba451f6ffa13e3b78a363eda87e6cca53b30a524ca31edfe94f8058cbeaeea01
Auto Analysis Verdict
Suspicious++

Suspicious Actions Detected
Creates autorun records
Deletes self
Injects code into other processes

-------------------------------------------

2011-06-14 23:42:16   C:\Documents and Settings\Roger\桌面\VIRUS\clz2\clz2.exe   Sandboxed As   Partially Limited   

2011-06-14 23:42:21   C:\Documents and Settings\Roger\Application Data\Emep\leer.exe   Sandboxed As   Partially Limited   

2011-06-14 23:42:27   C:\Documents and Settings\Roger\Local Settings\Temp\tmpad9b999a.bat   Sandboxed As   Partially Limited   

2011-06-14 23:42:27   C:\Documents and Settings\Roger\Application Data\Emep\leer.exe   Access Memory   C:\WINDOWS\explorer.exe   

2011-06-14 23:42:27   C:\Documents and Settings\Roger\桌面\VIRUS\clz2\clz2.exe   Modify Key   HKUS\S-1-5-21-1214440339-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1609   

2011-06-14 23:42:33   C:\Documents and Settings\Roger\Local Settings\Temp\tmpad9b999a.bat   Modify File   C:\Documents and Settings\Roger\桌面\VIRUS\clz2\clz2.exe   

2011-06-14 23:42:51   C:\Documents and Settings\Roger\桌面\VIRUS\clz2\clz2.exe   Scanned Online and Found Malicious   

--------------------------------

z2009

过kis 2012

毒霸云鉴定为病毒

hddu

2011-06-15 00:12:48    创建文件      操作:允许
进程路径:F:\virus\clz2\clz2.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Buex
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-06-15 00:12:48    创建文件      操作:允许
进程路径:F:\virus\clz2\clz2.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Buex\diuf.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*.exe


2011-06-15 00:12:50    创建文件      操作:允许
进程路径:F:\virus\clz2\clz2.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Huexc
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-06-15 00:12:51    运行应用程序      操作:允许
进程路径:F:\virus\clz2\clz2.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp61bbaa84.bat"
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe


2011-06-15 00:12:53    删除文件      操作:允许
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:F:\virus\clz2\clz2.exe
触发规则:应用程序规则->CMD设置->%windir%\system32\cmd.exe->?:\*

WeeVee

扫描


双击

Dirk

to avast!

阿童木看星星

360网盾报毒
金山下载保护报毒，打开压缩包金山报毒
小红伞右键扫描安全，红伞WG没有反应（已上报红伞）
还是云比较给力。。。。。。

蝉鸣时

ESET NOD32 detected.

clz2.exe - Win32/Spy.Zbot.YW trojan
leer.exe - Win32/Spy.Zbot.YW trojan

留侯

大蜘蛛：
母體：clz2.exe infected with BackDoor.Qbot.75
衍生物：leer.exe infected with BackDoor.Qbot.75

122693882

fs  kill

荷韵诗

linux 下无法运行