Zbot x 6

qianwenxiang

尤金卡巴斯基

Kaspersky kill all

nosferatu

Begin scan in 'C:\Documents and Settings\Administrator\桌面\z6'
C:\Documents and Settings\Administrator\桌面\z6\bablo.exe
    [DETECTION] Is the TR/Spy.ZBot.nns Trojan
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\z6\chk.exe
    [DETECTION] Is the TR/Drop.VB.iuj.17 Trojan
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\z6\load.exe
    [DETECTION] Is the TR/Spy.ZBot.nkz Trojan
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\z6\loader.exe
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      The file was deleted!
25267071          bum.exe          67.5 KB          MALWARE
25267070          ldr.exe          65 KB          MALWARE

ledled

All to VB

NobleT

NORMAN 1,  5 to submit

saga3721

红伞已全杀，入库2个。
先前漏的2个的行为应该说比较明显：拷贝自身注册启动。卡7主防也很感冒，但大概是卡巴不习惯根据行为来认定一个程序是木马所以到卡8对此也还含糊其辞，不知道卡巴2010的HIPS模块会怎样，如果红伞V10加入HIPS模块估计会严打这种行为的。

[ 本帖最后由 saga3721 于 2009-2-21 01:05 编辑 ]

xxl

2009-2-21 1:13:40        http://bbs.kafan.cn/attachment.p ... 35149997//bablo.exe        Internet Explorer        检测到威胁: Trojan-Spy.Win32.Zbot.nns

leonfg

K ALL
C:\Documents and Settings\GUNDAM\桌面\z6.rar » RAR » bablo.exe - a variant of Win32/Spy.Zbot.IB trojan
C:\Documents and Settings\GUNDAM\桌面\z6.rar » RAR » bum.exe - a variant of Win32/Spy.Zbot.IB trojan
C:\Documents and Settings\GUNDAM\桌面\z6.rar » RAR » chk.exe - Win32/AutoRun.Agent.IG worm
C:\Documents and Settings\GUNDAM\桌面\z6.rar » RAR » ldr.exe - a variant of Win32/Spy.Zbot.IB trojan
C:\Documents and Settings\GUNDAM\桌面\z6.rar » RAR » load.exe - Win32/Spy.Zbot.JF trojan
C:\Documents and Settings\GUNDAM\桌面\z6.rar » RAR » loader.exe » UPX v12_m2 - a variant of Win32/Kryptik.EB trojan

红心王子

2009-2-21        10:58:46        1235185126        Administrator        3400        Sign of "Win32:Zbot-BAI [Trj]" has been found in "d:\我的文档\桌面\Threats\bablo.exe" file.  
2009-2-21        10:58:49        1235185129        Administrator        3400        Sign of "Win32:Zbot-BAI [Trj]" has been found in "d:\我的文档\桌面\Threats\bum.exe" file.  
2009-2-21        10:58:49        1235185129        Administrator        3400        Sign of "Win32:VB-KZD [Drp]" has been found in "d:\我的文档\桌面\Threats\chk.exe" file.  
2009-2-21        10:58:49        1235185129        Administrator        3400        Sign of "Win32:Zbot-BAI [Trj]" has been found in "d:\我的文档\桌面\Threats\ldr.exe" file.  
2009-2-21        10:58:49        1235185129        Administrator        3400        Sign of "Win32:Ups [Cryp]" has been found in "d:\我的文档\桌面\Threats\loader.exe\[UPX]" file.

江湖的fans

TO  KV