7个

qianwenxiang

zbot 4个左右

ledled

名称: TrojanSpy.ZBot.Gen!Pac.3
类型: Trojan

描述:


文件:
c:\users\administrator\desktop\7\winamp.exe

左手

2009-03-02 21:49:53    修改注册表内容      操作:阻止
进程路径:E:\virus\a.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:AppData
触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*


2009-03-02 21:49:53    修改文件      操作:阻止并结束进程
进程路径:E:\virus\a.exe
文件路径:E:\virus\ntos.exe
触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe


2009-03-02 21:49:55    修改注册表内容      操作:阻止
进程路径:E:\virus\d.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:AppData
触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*


2009-03-02 21:49:55    修改文件      操作:阻止并结束进程
进程路径:E:\virus\d.exe
文件路径:E:\virus\ntos.exe
触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe


2009-03-02 21:49:55    修改文件      操作:阻止并结束进程
进程路径:E:\virus\d.exe
文件路径:E:\virus\ntos.exe
触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe


2009-03-02 21:49:58    修改注册表内容      操作:阻止
进程路径:E:\virus\darwin.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:AppData
触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*


2009-03-02 21:49:58    修改文件      操作:阻止并结束进程
进程路径:E:\virus\darwin.exe
文件路径:E:\virus\twex.exe
触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe


2009-03-02 21:50:01    修改注册表内容      操作:阻止
进程路径:E:\virus\winamp.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:AppData
触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*


2009-03-02 21:50:01    修改文件      操作:阻止并结束进程
进程路径:E:\virus\winamp.exe
文件路径:E:\virus\ntos.exe
触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe


2009-03-02 21:50:01    修改文件      操作:阻止并结束进程
进程路径:E:\virus\winamp.exe
文件路径:E:\virus\ntos.exe
触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe


2009-03-02 21:50:03    修改注册表内容      操作:阻止
进程路径:E:\virus\winamp2.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:AppData
触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*


2009-03-02 21:50:03    修改文件      操作:阻止并结束进程
进程路径:E:\virus\winamp2.exe
文件路径:E:\virus\twext.exe
触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe


2009-03-02 21:50:07    修改注册表内容      操作:阻止
进程路径:E:\virus\ntos.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:AppData
触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*


2009-03-02 21:50:07    修改文件      操作:阻止并结束进程
进程路径:E:\virus\ntos.exe
文件路径:E:\virus\ntos.exe
触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe


2009-03-02 21:50:07    修改文件      操作:阻止并结束进程
进程路径:E:\virus\ntos.exe
文件路径:E:\virus\ntos.exe
触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe


2009-03-02 21:50:11    修改注册表内容      操作:阻止
进程路径:E:\virus\twex.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:AppData
触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*


2009-03-02 21:50:11    修改文件      操作:阻止并结束进程
进程路径:E:\virus\twex.exe
文件路径:E:\virus\twex.exe
触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe


2009-03-02 21:50:11    修改文件      操作:阻止并结束进程
进程路径:E:\virus\twex.exe
文件路径:E:\virus\twex.exe
触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe


2009-03-02 21:50:12    修改注册表内容      操作:阻止
进程路径:E:\virus\twext.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:AppData
触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*


2009-03-02 21:50:12    修改文件      操作:阻止并结束进程
进程路径:E:\virus\twext.exe
文件路径:E:\virus\twext.exe
触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe


2009-03-02 21:50:12    修改文件      操作:阻止并结束进程
进程路径:E:\virus\twext.exe
文件路径:E:\virus\twext.exe
触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe

Palkia

rs ntos.bt

to rs*6

左手

生成物~~~~~~

Palkia

to rs

ledled

生成物to VB

黑衣~魂

dr.web
a.exe - infected with Trojan.PWS.Panda.9
darwin.exe - infected with Trojan.PWS.Panda.112
Install.exe - probably infected with DLOADER.Trojan
winamp.exe - infected with Trojan.Packed.424
winamp2.exe - infected with Trojan.Packed.120
miss-2-to

左手

2009-03-02 21:49:53 修改注册表内容 操作:阻止进程路径:E:\virus\a.exe 注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders 注册表名称:AppData 触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\* 2009-03-02 21:49:53 修改文件 操作:阻止并结束进程进程路径:E:\virus\a.exe 文件路径:E:\virus\ntos.exe 触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe 2009-03-02 21:49:55 修改注册表内容 操作:阻止进程路径:E:\virus\d.exe 注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders 注册表名称:AppData 触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\* 2009-03-02 21:49:55 修改文件 操作:阻止并结束进程进程路径:E:\virus\d.exe 文件路径:E:\virus\ntos.exe 触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe 2009-03-02 21:49:55 修改文件 操作:阻止并结束进程进程路径:E:\virus\d.exe 文件路径:E:\virus\ntos.exe 触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe 2009-03-02 21:49:58 修改注册表内容 操作:阻止进程路径:E:\virus\darwin.exe 注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders 注册表名称:AppData 触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\* 2009-03-02 21:49:58 修改文件 操作:阻止并结束进程进程路径:E:\virus\darwin.exe 文件路径:E:\virus\twex.exe 触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe 2009-03-02 21:50:01 修改注册表内容 操作:阻止进程路径:E:\virus\winamp.exe 注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders 注册表名称:AppData 触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\* 2009-03-02 21:50:01 修改文件 操作:阻止并结束进程进程路径:E:\virus\winamp.exe 文件路径:E:\virus\ntos.exe 触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe 2009-03-02 21:50:01 修改文件 操作:阻止并结束进程进程路径:E:\virus\winamp.exe 文件路径:E:\virus\ntos.exe 触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe 2009-03-02 21:50:03 修改注册表内容 操作:阻止进程路径:E:\virus\winamp2.exe 注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders 注册表名称:AppData 触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\* 2009-03-02 21:50:03 修改文件 操作:阻止并结束进程进程路径:E:\virus\winamp2.exe 文件路径:E:\virus\twext.exe 触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe 2009-03-02 21:50:07 修改注册表内容 操作:阻止进程路径:E:\virus\ntos.exe 注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders 注册表名称:AppData 触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\* 2009-03-02 21:50:07 修改文件 操作:阻止并结束进程进程路径:E:\virus\ntos.exe 文件路径:E:\virus\ntos.exe 触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe 2009-03-02 21:50:07 修改文件 操作:阻止并结束进程进程路径:E:\virus\ntos.exe 文件路径:E:\virus\ntos.exe 触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe 2009-03-02 21:50:11 修改注册表内容 操作:阻止进程路径:E:\virus\twex.exe 注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders 注册表名称:AppData 触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\* 2009-03-02 21:50:11 修改文件 操作:阻止并结束进程进程路径:E:\virus\twex.exe 文件路径:E:\virus\twex.exe 触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe 2009-03-02 21:50:11 修改文件 操作:阻止并结束进程进程路径:E:\virus\twex.exe 文件路径:E:\virus\twex.exe 触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe 2009-03-02 21:50:12 修改注册表内容 操作:阻止进程路径:E:\virus\twext.exe 注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders 注册表名称:AppData 触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\* 2009-03-02 21:50:12 修改文件 操作:阻止并结束进程进程路径:E:\virus\twext.exe 文件路径:E:\virus\twext.exe 触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe 2009-03-02 21:50:12 修改文件 操作:阻止并结束进程进程路径:E:\virus\twext.exe 文件路径:E:\virus\twext.exe 触发规则:应用程序规则->02-允许修改的程序->*.*->*\*.exe

328397663

燜ilename	Result
ntos.exe	MALWARE

The file 'ntos.exe' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Dropper.Gen. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.This malware is detected by a special detection routine from the engine module.

燜ilename	Result
d.exe	MALWARE

The file 'd.exe' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Spy.ZBot.lxp. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

燜ilename	Result
twex.exe	MALWARE

The file 'twex.exe' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Spy.ZBot.olp. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.01.02.97.

燜ilename	Result
Install.exe	MALWARE

The file 'Install.exe' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Crypt.XPACK.Gen. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.05.171. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: TR/Crypt..XPACK.Gen.

燜ilename	Result
winamp2.exe	MALWARE

The file 'winamp2.exe' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Dropper.Gen. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.This malware is detected by a special detection routine from the engine module.

燜ilename	Result
winamp.exe	MALWARE

The file 'winamp.exe' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Crypt.XPACK.Gen. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.05.171. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: TR/Crypt..XPACK.Gen.

燜ilename	Result
xXx.exe	MALWARE

The file 'xXx.exe' has been determined to be 'MALWARE'.
Our analysts named the threat TR/Spy.ZBot.onz. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

[ 本帖最后由 328397663 于 2009-3-2 23:20 编辑 ]