五一献礼最后一波来也：Panda Banker——Zeus的又一分身

nick20010117

230f4 发表于 2016-5-2 23:07
@nick20010117 @aboringman

又有两个，有空试试看

好失望，又入库了，无法测试双击

aboringman

230f4 发表于 2016-5-2 23:07
@nick20010117 @aboringman

又有两个，有空试试看

明天再吃，今天给吃撑了。。。。。。

230f4

nick20010117 发表于 2016-5-2 23:42
好失望，又入库了，无法测试双击

SEP即使入库也能测

nick20010117

230f4 发表于 2016-5-2 23:43
SEP即使入库也能测

NIS不行啊，除非我作死，关闭监控和主防，只保留IPS，双击测试清毒
能否告知病毒危险性，看我能不能双击

230f4

nick20010117 发表于 2016-5-2 23:45
NIS不行啊，除非我作死，关闭监控和主防，只保留IPS，双击测试清毒
能否告知病毒危险性，看我能不能双击

Banking Trojan搞不坏系统的

nick20010117

230f4 发表于 2016-5-2 23:48
Banking Trojan搞不坏系统的

好的，我试试（可能过几天才可以）

蓝天二号

大蜘蛛

轩夏

微软

C:\Users\XuanXia\Desktop\Panda Banker\Panda Banker.exe   Infected: Trojan:Win32/Dynamer!ac
C:\Users\XuanXia\Desktop\Panda Banker\A Panda Banker.exe  Infected: Trojan:Win32/Dynamer!ac
C:\Users\XuanXia\Desktop\Panda Banker\B Panda Banker.exe  Infected: Trojan:Win32/Dynamer!ac

aboringman

AVG：

扫描：kill all files；

"";"Trojan horse Zbot.ANCF, C:\Users\killer\Desktop\A Panda Banker.exe";"Unresolved"

"";"Trojan horse Pakes2_c.CBUA, C:\Users\killer\Desktop\B Panda Banker.exe";"Unresolved"

双击：关闭监控，实机双击，IDP双杀之。

"";"IDP.Trojan.41CEBC50, C:\Users\killer\Desktop\A Panda Banker.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/5/7, 10:04:13"

"";", C:\Users\killer\Desktop\A Panda Banker.exe";"Object was blocked";"Process";"2016/5/7, 10:04:13"

"";", C:\Users\killer\AppData\Roaming\360Game\session\6\AppData\Adobe\Flash Player\NativeCache\globel.sl.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/5/7, 10:04:13"

"";", C:\Users\killer\Desktop\A Panda Banker.exe";"Object was blocked";"Process";"2016/5/7, 10:04:13"





"";"IDP.Trojan.A795607F, C:\Users\killer\AppData\Roaming\360Game\session\6\AppData\Adobe\Flash Player\NativeCache\XMusicServer.log.1.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/5/7, 10:05:03"

"";", C:\Users\killer\Desktop\B Panda Banker.exe";"Object was blocked";"Process";"2016/5/7, 10:05:03"

"";", C:\Windows\System32\svchost.exe";"Object was blocked";"Process";"2016/5/7, 10:05:03"

"";", C:\Users\killer\Desktop\B Panda Banker.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/5/7, 10:05:03"

"";", C:\Users\killer\AppData\Roaming\360Game\session\6\AppData\Adobe\Flash Player\NativeCache\XMusicServer.log.1.exe";"Object was blocked";"Process";"2016/5/7, 10:05:03"

aboringman

受命测试ESET的AMS【Advanced Memory Scanner】，结果当然是大获全胜。

ESET：

扫描：kill all files；

C:\Users\killer\Desktop\新建文件夹\A Panda Banker.exe - Win32/Spy.Zbot.ACM trojan - cleaned by deleting [1]

C:\Users\killer\Desktop\新建文件夹\B Panda Banker.exe - a variant of Win32/Kryptik.ETRQ trojan - cleaned by deleting [1]

双击：关闭监控，实机双击，AMS双杀之。

2016/5/7 10:11:21;Advanced memory scanner;file;Operating memory » C:\Users\killer\Desktop\新建文件夹\A Panda Banker.exe;a variant of Win32/Spy.Zbot.ACM trojan;cleaned;;;E6220904B219F379792907E207AD2B2837C3D79D

2016/5/7 10:11:39;Advanced memory scanner;file;Operating memory » C:\Users\killer\Desktop\新建文件夹\B Panda Banker.exe;a variant of Win32/Spy.Zbot.ACM trojan;cleaned;;;66A8BFB22AF62A37D1F544BD3B53419D3C423759