Zbot x 2 + 1

显示全部楼层 · 发表于 2009-3-3 22:01:14

1未知 from:
hxp://files.drbobah.com/pinnaclesystems/ems/load/file.exe

显示全部楼层 · 发表于 2009-3-3 22:07:24

to rs

显示全部楼层 · 发表于 2009-3-3 22:09:05

TR/Dropper.Gen [trojan]'
'TR/Crypt.XPACK.Gen [trojan]'
'TR/Spy.ZBot.mex [trojan]'

显示全部楼层 · 发表于 2009-3-3 22:32:50

名称: TrojanSpy.ZBot.Gen!Pac.8
类型: Mutant

描述:

文件:
c:\users\administrator\desktop\zeus.exe

显示全部楼层 · 发表于 2009-3-3 22:53:07

2009/3/3 22:53:07 已清除木马程序 Trojan-Spy.Win32.Zbot.mex G:\Temp\Virus\z2.rar/ZeuS.exe
2009/3/3 22:53:07 已清除木马程序 Trojan-Dropper.Win32.VB.iyk G:\Temp\Virus\z2.rar/file.exe
Miss 1,To KL

显示全部楼层 · 发表于 2009-3-3 23:18:09

dr.web
\file.exe - infected with Trojan.DownLoader.46203
ZeuS.exe - infected with Trojan.Packed.139

显示全部楼层 · 发表于 2009-3-3 23:21:22

eset k all
C:\Documents and Settings\GUNDAM\桌面\z2.rar » RAR » file.exe - Win32/Poison trojan
C:\Documents and Settings\GUNDAM\桌面\z2.rar » RAR » tapok.exe - a variant of Win32/Kryptik.IG trojan
C:\Documents and Settings\GUNDAM\桌面\z2.rar » RAR » ZeuS.exe - a variant of Win32/Spy.Zbot.IB trojan

显示全部楼层 · 发表于 2009-3-3 23:29:35

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\z2.rar'
C:\Documents and Settings\Administrator\桌面\z2.rar
[0] Archive type: RAR
--> file.exe
   [DETECTION] Is the TR/Dropper.Gen Trojan
--> tapok.exe
   [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
--> ZeuS.exe
   [DETECTION] Is the TR/Spy.ZBot.mex Trojan
[NOTE]    A backup was created as '49db4cf3.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2009年3月3日  23:29
Used time: 00:03 Minute(s)

The scan has been done completely.

   0 Scanning directories
   4 Files were scanned
   3 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2009-3-3 23:59:39

2009-03-03 23:58:26 修改文件    操作:阻止并结束进程
进程路径:E:\virus\file.exe
文件路径:E:\virus\file.exe
触发规则:应用程序规则->02-允许修改的程序->%ProgramFiles%\Internet Explorer\iexplore.exe->*\*.exe

2009-03-03 23:58:26 修改文件    操作:阻止并结束进程
进程路径:E:\virus\file.exe
文件路径:E:\virus\file.exe
触发规则:应用程序规则->02-允许修改的程序->%ProgramFiles%\Internet Explorer\iexplore.exe->*\*.exe

2009-03-03 23:58:27 修改注册表内容    操作:阻止
进程路径:E:\virus\tapok.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:AppData
触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*

2009-03-03 23:58:27 修改文件    操作:阻止并结束进程
进程路径:E:\virus\tapok.exe
文件路径:E:\virus\sdra64.exe
触发规则:应用程序规则->02-允许修改的程序->%ProgramFiles%\Internet Explorer\iexplore.exe->*\*.exe

2009-03-03 23:58:31 修改注册表内容    操作:阻止
进程路径:E:\virus\ZeuS.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:AppData
触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*

2009-03-03 23:58:31 修改文件    操作:阻止并结束进程
进程路径:E:\virus\ZeuS.exe
文件路径:E:\virus\twex.exe
触发规则:应用程序规则->02-允许修改的程序->%ProgramFiles%\Internet Explorer\iexplore.exe->*\*.exe

2009-03-03 23:58:33 修改注册表内容    操作:阻止
进程路径:E:\virus\sdra64.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:AppData
触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*

2009-03-03 23:58:33 修改文件    操作:阻止并结束进程
进程路径:E:\virus\sdra64.exe
文件路径:E:\virus\sdra64.exe
触发规则:应用程序规则->02-允许修改的程序->%ProgramFiles%\Internet Explorer\iexplore.exe->*\*.exe

2009-03-03 23:58:33 修改文件    操作:阻止并结束进程
进程路径:E:\virus\sdra64.exe
文件路径:E:\virus\sdra64.exe
触发规则:应用程序规则->02-允许修改的程序->%ProgramFiles%\Internet Explorer\iexplore.exe->*\*.exe

2009-03-03 23:58:38 修改注册表内容    操作:阻止
进程路径:E:\virus\twex.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:AppData
触发规则:所有程序规则->06-系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*

2009-03-03 23:58:38 修改文件    操作:阻止并结束进程
进程路径:E:\virus\twex.exe
文件路径:E:\virus\twex.exe
触发规则:应用程序规则->02-允许修改的程序->%ProgramFiles%\Internet Explorer\iexplore.exe->*\*.exe

2009-03-03 23:58:38 修改文件    操作:阻止并结束进程
进程路径:E:\virus\twex.exe
文件路径:E:\virus\twex.exe
触发规则:应用程序规则->02-允许修改的程序->%ProgramFiles%\Internet Explorer\iexplore.exe->*\*.exe

[ 本帖最后由左手于 2009-3-4 00:02 编辑 ]

显示全部楼层 · 发表于 2009-3-4 00:08:40

原帖由左手于 2009-3-3 23:59 发表
2009-03-03 23:58:26 修改文件操作:阻止并结束进程
进程路径:E:\virus\file.exe
文件路径:E:\virus\file.exe
触发规则:应用程序规则->02-允许修改的程序->%ProgramFiles%\Internet Explorer\iexplore.ex ...

C:\Documents and Settings\GUNDAM\桌面\sdra64.rar » RAR » sdra64.exe - a variant of Win32/Kryptik.IG trojan
C:\Documents and Settings\GUNDAM\桌面\twex.rar » RAR » twex.exe - a variant of Win32/Spy.Zbot.IB trojan

[病毒样本] Zbot x 2 + 1

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块