Zlob还没死?

sam.to

原帖由 lingbo110120 于 2009-2-11 23:13 发表
你怎么不上报？

quota用完

The EQs

Hello,

40028.exe_ - Trojan-Downloader.Win32.FraudLoad.dmf

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.


> The password:infected
>
-----------------
Regards, Andrey Ladikov
Virus Analyst, Kaspersky Lab.

328397663

2009-2-12 15:05:48        已删除: Trojan-Downloader.Win32.FraudLoad.dmf        C:\Documents and Settings\Administrator\桌面\viewtubesoftware.40028.zip/viewtubesoftware.40028.exe

solcroft

Sign of "Win32:Zbot-AXF [Trj]" has been found in "http://bbs.kafan.cn/attachment.php?aid=463314&k=84cd8436608903ce56a6e7768e167e11&t=1234422424" file.

一下子丫

原帖由 rok827 于 2009-2-11 23:11 发表
File ID FilenameSize (Byte)Result25256859 viewtubesoftware....28.exe 61.5 KB MALWAREThe file 'viewtubesoftware.40028.exe' has been determined to be 'MALWARE'.
Our analysts discovered that the file i ...

已入库呵呵
入库有点慢MS

雨宫优子

Zlob的确没完


偶尔在几个挂马站见到

左手

2009-02-12 17:05:37    修改文件      操作:阻止并结束进程
进程路径:C:\Program Files\WinRAR\WinRAR.exe
文件路径:E:\virus\viewtubesoftware.40028.exe
触发规则:应用程序规则->允许修改的程序->?:\Program Files\*\*.exe->*\*.exe


2009-02-12 17:06:16    修改注册表内容      操作:阻止
进程路径:E:\virus\viewtubesoftware.40028.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:Personal
触发规则:所有程序规则->系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*


2009-02-12 17:06:16    修改注册表内容      操作:阻止
进程路径:E:\virus\viewtubesoftware.40028.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:Desktop
触发规则:所有程序规则->系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*


2009-02-12 17:06:16    修改注册表内容      操作:阻止
进程路径:E:\virus\viewtubesoftware.40028.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:Cookies
触发规则:所有程序规则->IE浏览器设置保护（黑名单）增强，多谢zhia->*\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders


2009-02-12 17:06:16    运行应用程序      操作:阻止
进程路径:E:\virus\viewtubesoftware.40028.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c del E:\virus\VIEWTU~1.EXE > nul
触发规则:所有程序规则->禁止运行的高危程序（黑名单）->%windir%\system32\*

saga3721

关机除灰再开机红伞怎么升完级鼠标划过压缩包就删了？

[ 本帖最后由 saga3721 于 2009-2-12 17:16 编辑 ]

llydmissile

viewtubesoftware.40028.ex3e        inconclusive