ztool

显示全部楼层 · 发表于 2008-7-2 19:39:09

更新的有点....~

显示全部楼层 · 发表于 2008-7-2 19:41:49

依然miss

显示全部楼层 · 发表于 2008-7-2 19:56:27

2008-7-2 JAY19:52:22 ztool1.exe  Modification HKEY_USERS\S-1-5-21-1292428093-706699826-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections/SavedLegacySettings
2008-7-2 JAY19:52:21 ztool1.exe : KLSystemData/FD-C/ Create C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat
2008-7-2 JAY19:52:21 ztool1.exe : KLSystemData/FD-C/ Create C:\Documents and Settings\Owner\Cookies\index.dat
2008-7-2 JAY19:52:21 ztool1.exe : KLSystemData/FD-C/ Create C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat
2008-7-2 JAY19:52:21 ztool1.exe Denied: KLSystemData/KLStartupRegKeys/Main_Run Modification hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
2008-7-2 JAY19:52:21 ztool1.exe  Create C:\WINDOWS\system32\maxpaynow1.exe
2008-7-2 JAY19:52:21 ztool1.exe : KLSystemData/FD-C/ Create C:\WINDOWS\system32\maxpaynow1.exe
2008-7-2 JAY19:52:21 ztool1.exe : KLSystemData/KLSystemFiles/SystemExe Create C:\WINDOWS\system32\maxpaynow1.exe
2008-7-2 JAY19:52:21 ztool1.exe  Process start C:\Documents and Settings\Owner\桌面\ztool1.exe
2008-7-2 JAY19:52:21 ztool1.exe  Placed in group Low Restricted
2008-7-2 JAY19:52:17 WinRAR.exe  Create C:\Documents and Settings\Owner\桌面\ztool1.exe

显示全部楼层 · 发表于 2008-7-2 19:58:31

毒霸杀了个生成物

显示全部楼层 · 发表于 2008-7-2 20:12:04

C:\Documents and Settings\kato9096\桌面\ztool\ztool1\ztool1.exe2
[DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen

显示全部楼层 · 发表于 2008-7-2 20:24:45

SOPHOS MISS

显示全部楼层 · 发表于 2008-7-2 20:27:10

显示全部楼层 · 发表于 2008-7-2 23:39:56

RS20.51.22未杀！

显示全部楼层 · 发表于 2008-7-2 23:42:05

2008-7-2 23:41:42 Real-time file system protection file C:\Documents and Settings\Administrator\Local Settings\Application Data\DriveSentry\Unzip\ztool1.exe probably a variant of Win32/Nuwar worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Program Files\DriveSentry\DriveSentry.exe.

显示全部楼层 · 发表于 2008-7-3 00:00:06

Hello. This file is already detected. Please update your bases.

Sincerely yours,
Andrey Bezborodov,
Virus Analyst.
_____________________
Kaspersky Lab Ltd
Moscow, Russia
Tel/Fax : +7 (095) 797-8700
E-mail : newvirus@kaspersky.com
Internet: http://www.kaspersky.com, http://www.viruslist.com

[病毒样本] ztool

本帖子中包含更多资源

本帖子中包含更多资源

Virus Chaser 5.0a

本帖子中包含更多资源

2/0