ztool1 [md5:3d7e56]

mofunzone

zhelatin每日免杀2个，还有两个貌似不免杀的样子。。

File:	ztool1
Status:	INFECTED/MALWARE
MD5:	3d7e56d51795d104ecbdbae520942d43
Packers detected:	-
Scanner results
Scan taken on 27 May 2008 22:59:57 (GMT)
A-Squared	Found  nothing
AntiVir	Found WORM/Zhelatin.Gen
ArcaVir	Found Heur.W32
Avast	Found  nothing
AVG Antivirus	Found I-Worm/Nuwar.N
BitDefender	Found Trojan.Peed.JJF
ClamAV	Found  nothing
CPsecure	Found  nothing
Dr.Web	Found  nothing
F-Prot Antivirus	Found  nothing
F-Secure Anti-Virus	Found  nothing
Fortinet	Found  nothing
Ikarus	Found  nothing
Kaspersky Anti-Virus	Found  nothing
NOD32	Found  nothing
Norman Virus Control	Found  nothing
Panda Antivirus	Found  nothing
Sophos Antivirus	Found  nothing
VirusBuster	Found  nothing
VBA32	Found  nothing

woai_jolin

Time        Module        Object        Name        Threat        Action        User        Information
2008/5/28 7:05:04        AMON        file        G:\v\ztool1        probably a variant of Win32/Nuwar worm        quarantined - deleted        Jason-PC\Jason        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe. The file was moved to quarantine. You may close this window.

palfan

反病毒引擎	版本	最后更新	扫描结果
AhnLab-V3	2008.5.28.0	2008.05.27	-
AntiVir	7.8.0.19	2008.05.27	WORM/Zhelatin.Gen
Authentium	5.1.0.4	2008.05.27	-
Avast	4.8.1195.0	2008.05.27	-
AVG	7.5.0.516	2008.05.27	I-Worm/Nuwar.N
BitDefender	7.2	2008.05.28	Trojan.Peed.JJF
CAT-QuickHeal	9.50	2008.05.26	Win32.Trojan-Downloader.Tibs.zj.4
ClamAV	0.92.1	2008.05.27	-
DrWeb	4.44.0.09170	2008.05.27	-
eSafe	7.0.15.0	2008.05.27	Suspicious File
eTrust-Vet	31.4.5828	2008.05.28	-
Ewido	4.0	2008.05.27	-
F-Prot	4.4.4.56	2008.05.27	W32/Tibs.S2.gen!Eldorado
F-Secure	6.70.13260.0	2008.05.27	-
Fortinet	3.14.0.0	2008.05.27	-
GData	2.0.7306.1023	2008.05.27	-
Ikarus	T3.1.1.26.0	2008.05.27	-
Kaspersky	7.0.0.125	2008.05.28	-
McAfee	5304	2008.05.27	-
Microsoft	1.3520	2008.05.28	Trojan:Win32/Tibs.GG
NOD32v2	3137	2008.05.28	-
Norman	5.80.02	2008.05.27	-
Panda	9.0.0.4	2008.05.27	-
Prevx1	V2	2008.05.28	Cloaked Malware
Rising	20.46.12.00	2008.05.27	Worm.Mail.Win32.Zhelatin.wy
Sophos	4.29.0	2008.05.27	-
Sunbelt	3.0.1123.1	2008.05.17	-
Symantec	10	2008.05.28	-
TheHacker	6.2.92.321	2008.05.27	-
VBA32	3.12.6.6	2008.05.28	-
VirusBuster	4.3.26:9	2008.05.27	-
Webwasher-Gateway	6.6.2	2008.05.28	Worm.Zhelatin.Gen

瑞星居然都报了

http://www.threatexpert.com/repo ... 104ecbdbae520942d43

gaojun7206

ztool1.rar
    [0] Archive type: RAR
    --> ztool1
        [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
      [NOTE]      The file was moved to '48abd081.qua'!

sqsszzq

kill

电影结束了

BING126

McAfee  miss

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Worm.Mail.Win32.Zhelatin.wy

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.46.22