setup.exe

显示全部楼层 · 发表于 2008-6-27 16:30:32

Starting the file scan:

Begin scan in 'D:\VIRUS\setup.zip'
D:\VIRUS\setup.zip
  [0] Archive type: ZIP
  --> setup.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Zlob.pqd
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-6-27 16:32:52

rs 0

显示全部楼层 · 发表于 2008-6-27 16:37:23

卡巴报了

检测到：木马程序 Trojan-Downloader.Win32.Zlob.pqd

显示全部楼层 · 发表于 2008-6-27 16:41:47

费尔挂了

显示全部楼层 · 发表于 2008-6-27 16:45:01

avast!扫描不报,运行后报2个

008-6-27 16:41:20 SYSTEM 1356 Sign of "Win32:KdCrypt [Cryp]" has been found in "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\FUK88RPV\1014[1].exe" file.
2008-6-27 16:41:22 SYSTEM 1356 Sign of "Win32:KdCrypt [Cryp]" has been found in "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\asd0.exe" file.

显示全部楼层 · 发表于 2008-6-27 16:50:10

avast!拦截器

temp\asd0.exe          writing

程序目录\web technologies\wcs.exe             writing

调用cmd.exe    setup.exe          delete

               1014.exe writing          Win32:KdCrypt [Cryp]
               temp\asd0.exe             Win32:KdCrypt [Cryp]
               zfe2.exe       程序目录\web technologies\wcu.exe
               zfe1.exe       temp\ads0.exe
               zfe2.exe       temp\awer1.bat

瑞星卡卡

this
C:\PROGRAM FILES\WEB TECHNOLOGIES\WCS.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Protocols\Handler

[ 本帖最后由 aaad2008 于 2008-6-27 16:55 编辑 ]

显示全部楼层 · 发表于 2008-6-27 17:18:55

C:\test\setup.zip ?ZIP ?setup.exe - Win32/TrojanDownloader.Zlob.CBY 木马

[ 本帖最后由 aerbeisi 于 2008-6-27 17:20 编辑 ]

显示全部楼层 · 发表于 2008-6-27 17:23:31

Update 3223 (20080627)
2008-06-27 11:08（17:08 Beijing Time）
BAT/Agent.G,BAT/Agent.NAH, BAT/WormGen.A, HTML/TrojanDownloader.IFrame, IRC/SdBot,Java/TrojanDownloader.OpenStream.C, JS/TrojanDownloader.Agent.JN,PDF/Exploit.Pidief.CM, Win32/Adware.IeDefender.NFU (3),Win32/Adware.IeDefender.NFV, Win32/Adware.Virtumonde,Win32/Adware.XPAntivirus (2), Win32/Adware.ZenoSearch,Win32/IRC.Satbot.A, Win32/PSW.Agent.NHS, Win32/PSW.OnLineGames.NFF,Win32/PSW.OnLineGames.NHY, Win32/PSW.OnLineGames.NMP,Win32/PSW.OnLineGames.NMY, Win32/PSW.OnLineGames.NNU (5),Win32/PSW.OnLineGames.NOP (5), Win32/PSW.OnLineGames.NVA (2),Win32/PSW.OnLineGames.ODJ (5), Win32/Rootkit.TniDrive.B (4),Win32/Shuq.NAA, Win32/Spy.ProAgent.H, Win32/Spy.WebPageRecorder.A (2),Win32/TrojanDownloader.Zlob, Win32/TrojanDownloader.Zlob.BXN,Win32/TrojanDownloader.Zlob.CBY (17), Win32/TrojanDropper.Agent.NJV(3), Win32/Zalup.AA

显示全部楼层 · 发表于 2008-6-27 17:24:38

杀一下

[病毒样本] setup.exe

本帖子中包含更多资源

刚升级一次，就灭了，发出来的时候还灭不了