3

sam.to

aef759b1d1e4455b18550309b5afe64e   v.css1
51bd54d7cadca2b087448e648a0d5f28   S0L1NG3N.exe2
499ba63734be3cf565ef2ae19a0d0e9e   loader.e3xe
to kl

Hello,

loader.e3xe - Trojan-Spy.Win32.Zbot.vwn,
S0L1NG3N.exe2 - Trojan-Clicker.Win32.AutoIt.h

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

v.css1 - Trojan-Downloader.Win32.Geral.vz

This file is already detected. Please update your antivirus bases.

[ 本帖最后由 sam.to 于 2009-5-31 00:24 编辑 ]

schumi小粉

C:\Documents and Settings\Administrator\桌面\新建文件夹\003.rar > RAR > loader.e3xe - Win32/Spy.Zbot.RK 特洛伊木马 的变种
C:\Documents and Settings\Administrator\桌面\新建文件夹\003.rar > RAR > v.css1 - 可能是 Win32/Genetik 特洛伊木马 的变种
Miss one

Palkia

to js

The EQs

干净的为啥要报？

rok827

--> loader.e3xe
      [DETECTION] Is the TR/PSW.Zbot.PJ.1 Trojan
    --> v.css1
      [DETECTION] Is the TR/Crypt.XDR.Gen Trojan

hddu

2009-05-29 23:09:39    修改注册表内容      操作:阻止并结束进程
进程路径:F:\003\LOADER.EXE
注册表路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
注册表名称:userinit
更改后:C:\WINDOWS\system32\Userinit.exe,C:\Documents and Settings\Administrator\Application Data\sdra64.exe,
更改前:C:\WINDOWS\system32\Userinit.exe,
触发规则:所有程序规则->WinLogon->*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

2009-05-29 23:09:39    创建注册表值      操作:阻止
进程路径:F:\003\LOADER.EXE
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
注册表名称:userinit
触发规则:所有程序规则->自动运行->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*



[ 本帖最后由 hddu 于 2009-5-29 23:14 编辑 ]

einnawy

avira
C:\Documents and Settings\Administrator\桌面\003\loader.e3xe
    [DETECTION] Is the TR/PSW.Zbot.PJ.1 Trojan
    [NOTE]      The file was moved to '4a80fb96.qua'!
C:\Documents and Settings\Administrator\桌面\003\v.css1
      [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [NOTE]      The file was moved to '4a82fb55.qua'!

黑衣~魂

dw
loader.e3xe;D:\Documents and Settings\Administrator\桌面\003;Trojan.PWS.Panda.114;Deleted.;
v.css1;D:\Documents and Settings\Administrator\桌面\003;Win32.HLLW.Autoruner.6779;Deleted.;

kingmuro

过kis6.0

kalynn84

Win32:Rootkit-gen [Rtk]
Win32:Perkesh [Rtk]