ztool2 [md5:faca3c5]

mofunzone

实际我不想发一包是杀不出来那群用kb的等等都不发报告了
单独慢慢发我还可以自己扫扫，看看结果如何，知道一下这个世界是怎么变化的。。

File:	ztool2
Status:	INFECTED/MALWARE
MD5:	faca3c56b96637c42fa5a4979a1f2727
Packers detected:	-
Scanner results
Scan taken on 27 May 2008 23:03:01 (GMT)
A-Squared	Found  nothing
AntiVir	Found TR/Crypt.XPACK.Gen
ArcaVir	Found Heur.W32
Avast	Found  nothing
AVG Antivirus	Found Downloader.Tibs.9.N
BitDefender	Found Trojan.Peed.JJF
ClamAV	Found  nothing
CPsecure	Found  nothing
Dr.Web	Found  nothing
F-Prot Antivirus	Found  nothing
F-Secure Anti-Virus	Found  nothing
Fortinet	Found  nothing
Ikarus	Found  nothing
Kaspersky Anti-Virus	Found  nothing
NOD32	Found  nothing
Norman Virus Control	Found  nothing
Panda Antivirus	Found  nothing
Sophos Antivirus	Found  nothing
VirusBuster	Found  nothing
VBA32	Found  nothing

woai_jolin

Time        Module        Object        Name        Threat        Action        User        Information
2008/5/28 7:06:39        AMON        file        G:\v\ztool2        probably a variant of Win32/Nuwar worm        quarantined - deleted        Jason-PC\Jason        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe. The file was moved to quarantine. You may close this window.

palfan

反病毒引擎	版本	最后更新	扫描结果
AhnLab-V3	2008.5.28.0	2008.05.27	-
AntiVir	7.8.0.19	2008.05.27	TR/Crypt.XPACK.Gen
Authentium	5.1.0.4	2008.05.27	-
Avast	4.8.1195.0	2008.05.27	-
AVG	7.5.0.516	2008.05.27	Downloader.Tibs.9.N
BitDefender	7.2	2008.05.28	Trojan.Peed.JJF
CAT-QuickHeal	9.50	2008.05.26	(Suspicious) - DNAScan
ClamAV	None	2008.05.27	-
DrWeb	4.44.0.09170	2008.05.27	-
eSafe	7.0.15.0	2008.05.27	Suspicious File
eTrust-Vet	31.4.5828	2008.05.28	-
Ewido	4.0	2008.05.27	-
F-Prot	4.4.4.56	2008.05.27	-
F-Secure	6.70.13260.0	2008.05.27	-
Fortinet	3.14.0.0	2008.05.27	-
GData	2.0.7306.1023	2008.05.27	-
Ikarus	T3.1.1.26.0	2008.05.27	-
Kaspersky	7.0.0.125	2008.05.28	-
McAfee	5304	2008.05.27	-
Microsoft	1.3520	2008.05.28	Trojan:Win32/Tibs.GG
NOD32v2	3137	2008.05.28	-
Norman	5.80.02	2008.05.27	-
Panda	9.0.0.4	2008.05.27	Suspicious file
Prevx1	V2	2008.05.28	Cloaked Malware
Rising	20.46.12.00	2008.05.27	-
Sophos	4.29.0	2008.05.27	-
Sunbelt	3.0.1123.1	2008.05.17	-
Symantec	10	2008.05.28	-
TheHacker	6.2.92.321	2008.05.27	-
VBA32	3.12.6.6	2008.05.28	-
VirusBuster	4.3.26:9	2008.05.27	-
Webwasher-Gateway	6.6.2	2008.05.28	Trojan.Crypt.XPACK.Gen

红伞的基因太强大了

http://www.threatexpert.com/repo ... 7c42fa5a4979a1f2727

gaojun7206

ztool2.rar
    [0] Archive type: RAR
    --> ztool2
        [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was moved to '48abd05d.qua'!

Hello. This file is already detected ().
Please update your bases.

Please quote all when answering.

-----------------
Regards, Kirill Erakhtin
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: ztool2.rar

sqsszzq

反病毒引擎滞后

电影结束了

傻猪猪米走鸡

2008-5-28 15:47:05        文件系统实时防护        文件        D:\firefox download\ztool2\ztool2        可能是 Win32/Nuwar 蠕虫 的变种        通过删除清除 - 已隔离        NT AUTHORITY\SYSTEM        在应用程序新建的文件上发生事件: C:\Program Files\WinRAR\WinRAR.exe.

挪威的冬天

金山毒霸 0