sbmntr.exe [md5:be7b0a]

显示全部楼层 · 发表于 2008-4-29 08:31:09

File:	sbmntr.exe
Status:	INFECTED/MALWARE
MD5:	be7b0a4d588a36dead7df27ccd045156
Packers detected:	PE_PATCH.UPX, UPX
Bit9 reports:

Scanner results
Scan taken on 29 Apr 2008 00:29:43 (GMT)
A-Squared	Found nothing
AntiVir	Found TR/Dldr.Zlob.ABKM.6
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found nothing
ClamAV	Found Trojan.Downloader-6758
CPsecure	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Ikarus	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found Win32/TrojanDownloader.Zlob.BVU
Norman Virus Control	Found Sandbox: W32/Malware; [ General information ] * Accesses executable file from resource section. * File length: 16896 bytes. [ Changes to filesystem ] * Creates file C:\sbmdl.dll. [ Changes to registry ] * Accesses Registry key "HKCU\Software\NetProject". * Creates key "HKLM\Software\CLASSES\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}". * Sets value "xxx"="xxx" in key "HKLM\Software\CLASSES\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}". * Creates key "HKLM\Software\CLASSES\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32". * Sets value ""="c:\sbmdl.dll" in key "HKLM\Software\CLASSES\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32". * Sets value "ThreadingModel"="Apartment" in key"HKLM\Software\CLASSES\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32". * Creates key"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser HelperObjects\{7C109800-A5D5-438F-9640-18D17E168B88}". * Sets value ""="" in key"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser HelperObjects\{7C109800-A5D5-438F-9640-18D17E168B88}". * Modifies value "ThreadingModel"="c:\sbmdl.dll" in key"HKLM\Software\CLASSES\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32". * Modifies value "ThreadingModel"="Apartment" in key"HKLM\Software\CLASSES\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32". * Accesses Registry key"HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7C109800-A5D5-438F-9640-18D17E168B88}". [ Process/window information ] * Creates an event called __ISA_INSURANCE__. * Will automatically restart after boot (I'll be back...).
Panda Antivirus	Found nothing
Sophos Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

显示全部楼层 · 发表于 2008-4-29 08:43:28

sbmntr.rar
[0] Archive type: RAR
   --> sbmntr.exe
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/Dldr.Zlob.ABKM.6
            [WARNING] Infected files in archives cannot be repaired!
      --> Object
         [3] Archive type: Runtime Packed
         --> Object
   [NOTE]    The file was moved to '48836f90.qua'!

显示全部楼层 · 发表于 2008-4-29 12:13:16

Hello.
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.
-----------------
Regards, Namestnikov Yury
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

> Attachment: sbsm.zip

显示全部楼层 · 发表于 2008-4-29 12:19:10

卡巴满郁闷的，我这里的病毒真正做到每日全被灭

看来只能靠着hips过日子了

显示全部楼层 · 发表于 2008-4-29 13:09:28

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： AdWare.Win32.Agent.zxz

MAC 地址：00:17:31:40:A3:57

用户来源：局域网

软件版本：20.42.10

显示全部楼层 · 发表于 2008-4-29 14:01:02

金山 0

显示全部楼层 · 发表于 2008-4-29 14:04:15

微点砍掉

显示全部楼层 · 发表于 2008-4-29 20:57:15

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： AdWare.Win32.Agent.zxz

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.42.12

显示全部楼层 · 发表于 2008-4-29 20:59:33

McAfee MISS

显示全部楼层 · 发表于 2008-4-29 21:24:09

Virus or unwanted program 'TR/Dldr.Zlob.ABKM.6 [trojan]'
detected in file 'C:\Documents and Settings\Administrator\桌面\sbmntr.exe.
Action performed: Delete file

[病毒样本] sbmntr.exe [md5:be7b0a]

本帖子中包含更多资源

回复 3楼 wangjay1980 的帖子

本帖子中包含更多资源

7/1