07.28 56x

显示全部楼层 · 发表于 2008-7-28 11:03:34

金山毒霸 0

显示全部楼层 · 发表于 2008-7-28 11:07:14

eset 剩余的3只打包
2008-7-28 11:05:38 Kernel File 'G:\v\Win32Nuwar.rar' was sent to ESET for analysis.

显示全部楼层 · 发表于 2008-7-28 11:29:15

正常的 54 / 56 ..

残废的 37 / 41

严重残废的 31 / 33.

全部报的都是 WORM/Zhelatin.zk

The file '61709-Backup.EXE' has been determined to be 'UNDER ANALYSIS'.
The file '99358-Backup.EXE' has been determined to be 'UNDER ANALYSIS'.

[ 本帖最后由 hj5abc 于 2008-7-28 11:46 编辑 ]

显示全部楼层 · 发表于 2008-7-28 12:48:44

IK 8，看来zhelatin是IK的软肋

D:\病毒测试\临时解压\10395-Backup.EXE
D:\病毒测试\临时解压\1159-Backup.EXE - 特征码 'Packed.Win32.Tibs.kg' 被发现
D:\病毒测试\临时解压\123.exe
D:\病毒测试\临时解压\12684-Backup.EXE
D:\病毒测试\临时解压\16500947015.EXE
D:\病毒测试\临时解压\17064498681.EXE
D:\病毒测试\临时解压\1717487756.EXE
D:\病毒测试\临时解压\18352443149.EXE - 特征码 'Packed.Win32.Tibs.kg' 被发现
D:\病毒测试\临时解压\18514687316.EXE
D:\病毒测试\临时解压\18540021917.EXE
D:\病毒测试\临时解压\18554-Backup.EXE
D:\病毒测试\临时解压\18575235143.EXE
D:\病毒测试\临时解压\18709-Backup.EXE
D:\病毒测试\临时解压\19080999024.EXE
D:\病毒测试\临时解压\19284680413.EXE
D:\病毒测试\临时解压\2008-7-27__4A23C.exe
D:\病毒测试\临时解压\20584757159.EXE
D:\病毒测试\临时解压\20679-Backup.EXE
D:\病毒测试\临时解压\20683-Backup.EXE
D:\病毒测试\临时解压\21151856014.EXE - 特征码 'Packed.Win32.Tibs.kg' 被发现
D:\病毒测试\临时解压\21400630227.EXE
D:\病毒测试\临时解压\21540361282.EXE
D:\病毒测试\临时解压\22185030685.EXE
D:\病毒测试\临时解压\22270676934.EXE - 特征码 'Packed.Win32.Tibs.kg' 被发现
D:\病毒测试\临时解压\22433772380.EXE
D:\病毒测试\临时解压\22490826023.EXE
D:\病毒测试\临时解压\22572484924.EXE
D:\病毒测试\临时解压\23000981607.EXE
D:\病毒测试\临时解压\23053987048.EXE
D:\病毒测试\临时解压\23396-Backup.EXE
D:\病毒测试\临时解压\25970-Backup.EXE
D:\病毒测试\临时解压\26765-Backup.EXE
D:\病毒测试\临时解压\37969-Backup.EXE
D:\病毒测试\临时解压\38665-Backup.EXE - 特征码 'Packed.Win32.Tibs.kg' 被发现
D:\病毒测试\临时解压\41434-Backup.EXE
D:\病毒测试\临时解压\41722-Backup.EXE
D:\病毒测试\临时解压\42434-Backup.EXE
D:\病毒测试\临时解压\44230-Backup.EXE
D:\病毒测试\临时解压\45713-Backup.EXE
D:\病毒测试\临时解压\46778-Backup.EXE
D:\病毒测试\临时解压\5252-Backup.EXE - 特征码 'Packed.Win32.Tibs.kg' 被发现
D:\病毒测试\临时解压\58615-Backup.EXE
D:\病毒测试\临时解压\61709-Backup.EXE
D:\病毒测试\临时解压\68662-Backup.EXE - 特征码 'Packed.Win32.Tibs.kg' 被发现
D:\病毒测试\临时解压\74025-Backup.EXE
D:\病毒测试\临时解压\7446-Backup.EXE
D:\病毒测试\临时解压\75-Backup.EXE
D:\病毒测试\临时解压\75104-Backup.EXE
D:\病毒测试\临时解压\78396-Backup.EXE
D:\病毒测试\临时解压\80518-Backup.EXE
D:\病毒测试\临时解压\82586-Backup.EXE - 特征码 'Packed.Win32.Tibs.kg' 被发现
D:\病毒测试\临时解压\86286-Backup.EXE
D:\病毒测试\临时解压\89185-Backup.EXE
D:\病毒测试\临时解压\90643-Backup.EXE
D:\病毒测试\临时解压\9884-Backup.EXE
D:\病毒测试\临时解压\99358-Backup.EXE

56 文件被扫描
(0 压缩档 0 文件)
8 特征码被侦测
0 可疑代码段被发现
耗时: 0:04.236

显示全部楼层 · 发表于 2008-7-28 12:50:04

avast！清空

显示全部楼层 · 发表于 2008-7-28 13:05:04

kaspersky 2009 451 RC2 Kill all(全部文件包括残废、正常、严重残废)

显示全部楼层 · 发表于 2008-7-28 15:17:30

红伞杀剩下的微点都没反应……

显示全部楼层 · 发表于 2008-7-28 20:31:06

[Scanning : C:\Download Files]

C:\Download Files\残废版.part1.rar<RAR>:56633-Backup.EXE <- Heur.Win32.E : No action

Scanned objects : 133

Infected objects : 1

显示全部楼层 · 发表于 2008-7-29 00:56:41

Begin scan in 'C:\Users\TOSHIBA\Desktop\zhelatin'
C:\Users\TOSHIBA\Desktop\zhelatin\10395-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c0fa47.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\1159-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c2fa48.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\123.exe
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c0fa49.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\12684-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c3fa4a.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\16500947015.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c2fa4e.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\17064498681.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48bdfa4f.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\1717487756.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48befa4f.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\18352443149.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c0fa50.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\18514687316.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c2fa51.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\18540021917.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '4abb2aea.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\18554-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c2fa53.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\18575235143.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '4abb2aec.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\18709-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c4fa52.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\19080999024.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48bdfa53.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\19284680413.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48bffa53.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\2008-7-27__4A23C.exe
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48bdfa4a.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\20584757159.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c2fa4b.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\20679-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c3fa4b.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\20683-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '4aba2af4.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\21151856014.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48befa4c.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\21400630227.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c1fa4d.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\21540361282.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c2fa4d.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\22185030685.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48befa4e.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\22270676934.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48bffa4e.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\22433772380.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c1fa4e.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\22490826023.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c1fa4f.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\22572484924.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c2fa4f.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\23000981607.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48bdfa50.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\23053987048.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '4ac42ae9.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\23396-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c0fa51.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\25970-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c6fa53.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\26765-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c4fa54.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\37969-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c6fa55.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\38665-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c3fa57.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\41434-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c1fa50.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\41722-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c4fa50.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\42434-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c1fa51.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\44230-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48bffa54.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\45713-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c4fa55.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\46778-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c4fa56.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\5252-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c2fa52.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\58615-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c3fa58.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\61709-Backup.EXE
[DETECTION] Is the TR/PCK.Tibs.KG.69 Trojan
[NOTE]    A backup was created as '4abd2843.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\68662-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c3fa59.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\74025-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48bdfa55.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\7446-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c1fa55.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\75-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48bafa57.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\75104-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48befa57.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\78396-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c0fa5a.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\80518-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '4abb2aeb.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\82586-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c2fa55.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\86286-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48bffa59.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\89185-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48befa5c.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\90643-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c3fa53.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\9884-Backup.EXE
[DETECTION] Contains recognition pattern of the WORM/Zhelatin.zk worm
[NOTE]    A backup was created as '48c5fa5c.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Desktop\zhelatin\99358-Backup.EXE
[DETECTION] Is the TR/PCK.Tibs.KG.68 Trojan
[NOTE]    A backup was created as '48c0fa5d.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2008年7月29日  00:56
Used time: 00:15 Minute(s)

The scan has been done completely.

   1 Scanning directories
   56 Files were scanned
   56 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   56 files were deleted
   0 files were repaired
   56 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   0 Files not concerned
   0 Archives were scanned
   0 Warnings
   56 Notes

[病毒样本] 07.28 56x

本帖子中包含更多资源

ArcaVir2008