新威胁一只，赶快上报吧

VISN

AhnLab-V3	2008.5.10.0	2008.05.13	-
AntiVir	7.8.0.17	2008.05.13	TR/Crypt.XPACK.Gen
Authentium	5.1.0.4	2008.05.14	-
Avast	4.8.1169.0	2008.05.12	Win32:Zlob-CBY
AVG	7.5.0.516	2008.05.13	-
BitDefender	7.2	2008.05.08	Trojan.Peed.Gen
CAT-QuickHeal	9.50	2008.05.12	(Suspicious) - DNAScan
ClamAV	0.92.1	2008.05.13	-
DrWeb	4.44.0.09170	2008.05.13	-
eSafe	7.0.15.0	2008.05.12	-
eTrust-Vet	31.4.5784	2008.05.13	-
Ewido	4.0	2008.05.13	-
F-Prot	4.4.2.54	2008.05.13	-
F-Secure	6.70.13260.0	2008.05.13	Suspicious:W32/Malware!Gemini
Fortinet	3.14.0.0	2008.05.13	-
GData	2.0.7306.1023	2008.05.14	Win32:Zlob-CBY
Ikarus	T3.1.1.26.0	2008.05.13	-
Kaspersky	7.0.0.125	2008.05.13	-
McAfee	5293	2008.05.12	Puper
Microsoft	1.3408	2008.05.13	TrojanDownloader:Win32/Zlob.gen!AW
NOD32v2	3095	2008.05.13	-
Norman	5.80.02	2008.05.09	-
Panda	9.0.0.4	2008.05.12	-
Prevx1	V2	2008.05.16	-
Rising	20.44.12.00	2008.05.13	-
Sophos	4.29.0	2008.05.13	-
Sunbelt	3.0.1114.0	2008.05.12	-
Symantec	10	2008.05.13	Trojan.Zlob
TheHacker	6.2.92.309	2008.05.13	-
VBA32	3.12.6.6	2008.05.13	suspected of Downloader.Zlob.3
VirusBuster	4.3.26:9	2008.05.12	Trojan.DL.Zlob.Gen.47
Webwasher-Gateway	6.6.2	2008.05.13	Trojan.Crypt.XPACK.Gen

[ 本帖最后由 qianwenxiang 于 2008-5-17 12:25 编辑 ]

VISN

http://research.sunbelt-software.com/ViewMalware.aspx?id=4430318

附上沙盘运行结果，生成一大堆垃圾，看样子是下载者

秋叶濛濛

Avk

Win32:Zlob-CBY [Trj] (Avast/BD引擎)

Avira

Trojan horse TR/Crypt.CFI.Gen

qianwenxiang

请勿使用可能引起他人不适的文字作为文件名，这次先修改了；

Palkia

C:\Documents and Settings\Administrator\桌面\A.rar>>A.exe        Puper.eykg        病毒        还未处理

su-tt

已扫描的磁盘、文件夹和文件: C:\Documents and Settings\Administrator\桌面\A.rar
C:\Documents and Settings\Administrator\桌面\A.rar > RAR > A.exe - Win32/TrojanDownloader.Zlob.BXS 特洛伊木马
已扫描的对象数: 1
发现的威胁数: 1
已清除对象数:0
完成时间: 13:29:15  总扫描时间: 0 秒 (00:00:00)

lintianyuan

avast报毒Win32:Zlob-CBY [Trj]

allinwonderi

[Scanning : C:\Documents and Settings\All Users\Documents\Test]


C:\Documents and Settings\All Users\Documents\Test\A.rar<RAR>:A.exe <- Heur.W32 : No action



Scanned objects : 2

Infected objects : 1

allinwonderi

MISS

cxcsky

微点报是木马，可NOD32 2.7 却没见有动静，手动扫描也找不到有病毒。