祝大家五一劳动节愉~~~~快地玩Atmos——名气很大的ZeuS的变种

cfhdrty

essx2
[mw_shl_code=css,true]D:\desktop\Atmos Banking Trojan\#Citadel #Atmos.exe - Win32/Kryptik.ASJU 特洛伊木马 的变种 - 通过删除清除
D:\desktop\Atmos Banking Trojan\Atmos.exe - Win32/Spy.Zbot.ABS 特洛伊木马 的变种 - 通过删除清除[/mw_shl_code]

connelly

sep x2

nick20010117

230f4

nick20010117 发表于 2016-5-1 13:39
关闭监控双击kill第一个，第二个报错

FS是等样本运行到了一定程度，比如释放文件、添加启动项等之后才拦截，还是提前拦截的？当时有检查过吗？

欧阳宣

趋势

TROJ_GEN.R00WC0PCA16
TROJ_FORUCON.BME

aboringman

抱歉来迟了，AVG准备开餐。

aboringman

AVG：

扫描：kill all files.

"";"Trojan horse PSW.Generic12.CIIH, C:\Users\killer\Desktop\Atmos";"Unresolved"

"";"Trojan horse Crypt5.AVEJ, C:\Users\killer\Desktop\Citadel变种Atmos.exe";"Unresolved"

双击：关闭监控，实机双击，IDP杀第一个，第二个我这边也同样是报错退出。。。。。。【又现SMP】

"";"IDP.SMP.15, C:\Users\killer\Desktop\Citadel变种Atmos.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/5/1, 17:21:46"

"";", C:\Users\killer\Desktop\Citadel变种Atmos.exe";"Object was blocked";"Process";"2016/5/1, 17:21:46"

"";", C:\Users\killer\AppData\Roaming\Elcoifda\epcuruuq.exe";"Object was blocked";"Process";"2016/5/1, 17:21:46"

"";", C:\USERS\KILLER\APPDATA\LOCAL\TEMP\TMP9615.TMP";"Deleted";"File or Directory";"2016/5/1, 17:21:46"

"";", C:\USERS\KILLER\APPDATA\LOCAL\TEMP\TMP9645.TMP";"Deleted";"File or Directory";"2016/5/1, 17:21:46"

"";", C:\Users\killer\AppData\Roaming\Elcoifda\epcuruuq.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/5/1, 17:21:46"

"";", C:\Users\killer\Desktop\Citadel变种Atmos.exe";"Object was blocked";"Process";"2016/5/1, 17:21:46"

nick20010117

230f4 发表于 2016-5-1 14:52
FS是等样本运行到了一定程度，比如释放文件、添加启动项等之后才拦截，还是提前拦截的？当时有检查 ...

如果是提前拦截，是不会有报毒名的，只会显示malware online

zq19861019

gdata和bd一样

gloland

解压卡巴kill