641000.exe [md5:bc428b]

mofunzone

nod32 ORZ，我随便抓一个都过你扫描，你活在这个世界上还有什么意思

File:	641000.exe
Status:	INFECTED/MALWARE
MD5:	bc428b5b166205452b6b4aa2f7fc61c1
Packers detected:	-
Scanner results
Scan taken on 23 May 2008 04:03:56 (GMT)
A-Squared	Found  nothing
AntiVir	Found TR/Dldr.Zlob.NMO
ArcaVir	Found  nothing
Avast	Found  nothing
AVG Antivirus	Found Downloader.Zlob.ZV
BitDefender	Found  nothing
ClamAV	Found Trojan.Zlob-4837
CPsecure	Found  nothing
Dr.Web	Found  nothing
F-Prot Antivirus	Found  nothing
F-Secure Anti-Virus	Found Trojan-Downloader.Win32.Zlob.eie
Fortinet	Found  nothing
Ikarus	Found Trojan-Downloader.Win32.Zlob.eie
Kaspersky Anti-Virus	Found Trojan-Downloader.Win32.Zlob.eie
NOD32	Found  nothing
Norman Virus Control	Found  nothing
Panda Antivirus	Found  nothing
Sophos Antivirus	Found Mal/Generic-A
VirusBuster	Found  nothing
VBA32	Found  nothing

Palkia

在 C:\Documents and Settings\Administrator\桌面\641000.rar->641000.exe 中发现 TrojanDownloader.Zlob.epx 病毒, 已删除

woai_jolin

时间        模件        事件        用户名称
2008-5-23 13:38:22        核心        文件 'G:\v\641000.exe' 已被传送到Eset作分析之用。

挪威的冬天

金山毒霸 0

电影结束了

• The following files were created in the system:

#	Filename(s)	File Size	File MD5	Alias
1	%Programs%\LookForPorn\Uninstall.lnk	720 bytes	0x4A8C435218FD6E7E1F1C7A8A90C8DF87	(not available)
2	%ProgramFiles%\LookForPorn\Uninstall.exe	52,787 bytes	0x768FB4BC0BBF1FF18072FCC649F14664	(not available)
3	[file and pathname of the sample #1]	74,856 bytes	0xBC428B5B166205452B6B4AA2F7FC61C1	Trojan-Downloader.Win32.Zlob.eie [Kaspersky Lab]

• Notes:
  • %Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
  • %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

• The following directories were created:
  • %Programs%\LookForPorn
  • %ProgramFiles%\LookForPorn

Memory Modifications

• There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	3,874,816 bytes

Registry Modifications

• The following Registry Keys were created:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LookForPorn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LookForPorn\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LookForPorn
  • HKEY_CURRENT_USER\Software\LookForPorn

• The newly created Registry Values are:
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LookForPorn\CLSID]
    • (Default) = "{6BF52A52-394A-11D3-B153-00C04F79FAA6}"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LookForPorn]
    • UninstallString = ""%ProgramFiles%\LookForPorn\Uninstall.exe""
    • InstallLocation = "%ProgramFiles%\LookForPorn"
    • DisplayName = "LookForPorn"
    • DisplayIcon = "%ProgramFiles%\LookForPorn\Uninstall.exe,0"
    • NoModify = 0x00000001
    • NoRepair = 0x00000001
  • [HKEY_CURRENT_USER\Software\LookForPorn]
    • (Default) = "%ProgramFiles%\LookForPorn"
    • Start Menu Folder = "LookForPorn"

http://www.threatexpert.com/report.aspx?md5=bc428b5b166205452b6b4aa2f7fc61c1

TF对ZLOB很不敏感....

[ 本帖最后由 电影结束了 于 2008-5-23 16:23 编辑 ]

allinwonderi

AB, FP pass all

BING126

McAfee  MISS

残缺的唯美

2008-5-24 0:58:05        Disinfected        Trojan program Trojan-Downloader.Win32.Zlob.eie        C:\Documents and Settings\Administrator\桌面\641000.rar/641000.exe

我是小行

卡巴报
微点好像未反应

qigang

RS20.45.50未杀！