Zbot x 8

qianwenxiang

有效性没检查 z.exe可能不是zbot

没了。。

红心王子

2009-2-27        21:58:11        1235743091        Administrator        1680        Sign of "Win32:Dropper-BEJ [Trj]" has been found in "d:\我的文档\桌面\threats\ZeuS.exe\[Embedded_Ix#2407]" file.  
2009-2-27        21:58:16        1235743096        Administrator        1680        Sign of "Win32:Zbot-AZQ [Trj]" has been found in "d:\我的文档\桌面\threats\svhost1.exe" file.  
2009-2-27        21:58:16        1235743096        Administrator        1680        Sign of "Win32:VB-LAF [Drp]" has been found in "d:\我的文档\桌面\threats\z.exe" file.  
2009-2-27        21:58:16        1235743096        Administrator        1680        Sign of "Win32:Zbot-AMR [Trj]" has been found in "d:\我的文档\桌面\threats\87.exe" file.  
2009-2-27        21:58:16        1235743096        Administrator        1680        Sign of "Win32:Spyware-gen [Trj]" has been found in "d:\我的文档\桌面\threats\8c.exe" file.

hahacomcn

Begin scan in 'C:\Documents and Settings\cnelf\桌面\z8.rar'
C:\Documents and Settings\cnelf\桌面\z8.rar
    [0] Archive type: RAR
    --> ldr.exe
      [DETECTION] Contains recognition pattern of the DR/Delphi.Gen dropper
    --> ZeuS.exe
      [DETECTION] Is the TR/Dropper.Gen Trojan
    --> main.exe
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    --> svhost1.exe
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    --> z.exe
      [DETECTION] Is the TR/Dropper.Gen Trojan
    --> 87.exe
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    --> 8c.exe
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      A backup was created as '49d5f2ba.qua'  ( QUARANTINE )


End of the scan: 2009年2月27日  22:02
Used time: 00:03 Minute(s)

The scan has been done completely.

      0 Scanning directories
      9 Files were scanned
      7 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:

Elcondorposa

Starting the file scan:

Begin scan in 'E:\DownLoad\z8'
E:\DownLoad\z8\87.exe
    [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      A backup was created as '49d5f2be.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
E:\DownLoad\z8\8c.exe
    [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      A backup was created as '49d5f2ea.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
E:\DownLoad\z8\ldr.exe
    [DETECTION] Contains recognition pattern of the DR/Delphi.Gen dropper
    [NOTE]      A backup was created as '4a19f2ec.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
E:\DownLoad\z8\main.exe
    [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      A backup was created as '4a10f2ea.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
E:\DownLoad\z8\svhost1.exe
    [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      A backup was created as '4a0ff2ff.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
E:\DownLoad\z8\z.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a0cf2b7.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
E:\DownLoad\z8\ZeuS.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a1cf2ef.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!

Filename	Result
ZeuS2.exe	UNDER ANALYSIS

[ 本帖最后由 Elcondorposa 于 2009-2-27 22:06 编辑 ]

Palkia

to rs

ledled

VirusBuster found nothing

尤金卡巴斯基

2009/2/27 22:45:38        已清除        木马程序 Trojan.Win32.Buzus.angb        G:\Temp\Virus\z8.rar/ZeuS.exe//PE_Patch.UPX//UPX               
2009/2/27 22:45:38        已清除        木马程序 Trojan.Win32.Agent2.dvj        G:\Temp\Virus\z8.rar/z.exe               
2009/2/27 22:45:38        已清除        木马程序 Trojan-Spy.Win32.Zbot.oiq        G:\Temp\Virus\z8.rar/svhost1.exe               
2009/2/27 22:45:38        已清除        木马程序 Trojan-Spy.Win32.Zbot.ohd        G:\Temp\Virus\z8.rar/main.exe               
2009/2/27 22:45:38        已清除        木马程序 Trojan-Spy.Win32.Zbot.oha        G:\Temp\Virus\z8.rar/ldr.exe               
2009/2/27 22:45:38        已清除        木马程序 Trojan-Spy.Win32.Zbot.nrn        G:\Temp\Virus\z8.rar/87.exe               
2009/2/27 22:45:38        已清除        木马程序 Trojan-Spy.Win32.Zbot.myd        G:\Temp\Virus\z8.rar/8c.exe       

Miss 1，To KL

尤金卡巴斯基

Hello,


ZeuS2.exe - Trojan-Spy.Win32.Zbot.oji

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Best regards, Sergey Prokudin
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.


10/1, 1st Volokolamsky Proezd, Moscow, 123060, Russia
Tel./Fax: + 7 (495) 797 8700
http://www.kaspersky.com http://www.viruslist.com

zdlzp

微点全歼

程序：
C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\RAR$EX03.627\LDR.EXE
是否删除木马程序及其衍生物?

程序：
C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\RAR$EX07.917\SVHOST1.EXE
是否删除木马程序及其衍生物?

程序：
C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\RAR$EX15.452\ZEUS2.EXE
是否删除木马程序及其衍生物?

木马名称：未知木马
程序：
C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\RAR$EX00.293\LDR.EXE

是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称：未知木马
程序：
C:\DOCUMENTS AND SETTINGS\LOCAL SETTINGS\TEMP\RAR$EX00.503\LDR.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序：
C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\TEMP\RAR$EX00.503\MAIN.EXE
是否删除木马程序及其衍生物?

[ 本帖最后由 zdlzp 于 2009-2-27 23:18 编辑 ]

leonfg

eset 全
C:\Documents and Settings\GUNDAM\桌面\z8.rar » RAR » ldr.exe - Win32/Spy.Zbot.KN trojan
C:\Documents and Settings\GUNDAM\桌面\z8.rar » RAR » ZeuS.exe - Win32/Spy.Zbot.BA trojan
C:\Documents and Settings\GUNDAM\桌面\z8.rar » RAR » main.exe - Win32/Spy.Zbot.KR trojan
C:\Documents and Settings\GUNDAM\桌面\z8.rar » RAR » svhost1.exe - a variant of Win32/Spy.Zbot.IB trojan
C:\Documents and Settings\GUNDAM\桌面\z8.rar » RAR » ZeuS2.exe - Win32/Spy.Zbot.KO trojan
C:\Documents and Settings\GUNDAM\桌面\z8.rar » RAR » z.exe - Win32/TrojanDropper.VB.NGU trojan
C:\Documents and Settings\GUNDAM\桌面\z8.rar » RAR » 87.exe - Win32/Spy.Zbot.JF trojan
C:\Documents and Settings\GUNDAM\桌面\z8.rar » RAR » 8c.exe - Win32/Spy.Zbot.AD trojan