高质量：过绝大多数，卡巴报

显示全部楼层 · 发表于 2010-1-17 03:39:56

已上报avira～扫描党别忙了： http://www.virustotal.com/analisis/d3cd577af517e434af891451f4bb562eb87cf185241fd647223b76261b21c94f-1263670522

显示全部楼层 · 发表于 2010-1-17 04:21:36

C:\WINDOWS\system32\sdra64.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon

Old: (SZ) userinit =C:\WINDOWS\system32\userinit.exe,
New: (SZ) userinit =C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,

显示全部楼层 · 发表于 2010-1-17 08:45:33

依然mcafee月神

显示全部楼层 · 发表于 2010-1-17 09:15:51

panda很牛X

显示全部楼层 · 发表于 2010-1-17 09:25:02

to MS

显示全部楼层 · 发表于 2010-1-17 10:41:11

靠瑞星都能查出来的把红伞过了真假啊

显示全部楼层 · 发表于 2010-1-17 13:10:41

C:\Documents and Settings\Palkia\My Documents\DL\tz.rar>>tz.exe TrojanSpy.Zbot.aduc.kcyu 木马还未处理

显示全部楼层 · 发表于 2010-1-17 13:14:52

看来ZBOT作者又搞自写壳了
除KAV之外全部报壳

显示全部楼层 · 发表于 2010-1-17 13:26:06

C:\Documents and Settings\Administrator\桌面\tz.rar > RAR > tz.exe - 正常
C:\Documents and Settings\Administrator\桌面\tz.rar:Zone.Identifier - 正常

显示全部楼层 · 发表于 2010-1-17 13:37:34

本帖最后由 saskecn 于 2010-1-17 13:40 编辑

to mcafee

McAfee Labs - Beaverton
Current Scan Engine Version:5400.1158
Current DAT Version:5863.0000
Thank you for your submission.

Analysis ID: 5742275

File Name          Findings                      Detection                   Type       Extra
--------------------|------------------------------|----------------------------|------------|-----
tz.exe             |inconclusive                |                         |          |no

inconclusive [tz.exe]

Upon analysis the file submitted does not appear to contain one of the 200,000 known
threats in the AutoImmune database. The file may contain a new threat, or no code
capable of being infected. Your submission is being forwarded to an Avert Labs
Researcher for further analysis. You will be contacted by AVERT through e-mail with
the results of that analysis.

To find detailed information about viruses and other malware, please review McAfee
Labs' Virus Information Library:

http://vil.mcafeesecurity.com

You may wish to submit future malware samples to:

https://www.webimmune.net/default.asp

It may be the best option if you are having a problem with gateway scanners stripping
your sample submission.

If you believe your computer is infected, but are unsure which files should be
submitted to McAfee Labs for review, please visit:

http://vil.mcafeesecurity.com/vil/submit-sample.aspx

For other virus-related information, please review McAfee Labs' homepage at:

http://www.mcafee.com/us/threat_center/default.asp

Support ?

Virus Research accepts file-samples for analysis and possible inclusion into AV
signature DAT sets. We are also prepared to answer general virus questions. All
product-related questions and comments can be addressed through technical support and
customer service, including:

* Product installation and update questions
* Product usage questions
* Specific operating system/version questions
* Assistance with detection and cleaning or removal of viruses or trojans

Use the following link to update your DAT and scan engine to the most current version:

http://www.mcafee.com/apps/downloads/security_updates/dat.asp

Use the following links to reach online technical support for McAfee products -

Corporate Customers:

http://www.mcafeesecurity.com/us/support/

Single User/Retail Customers:

http://www.mcafeehelp.com

Note ?

Due to the prevalence of network gateway AV products, it is important that all
submissions be zipped and the zip file password-protected (password - infected). Some
products will reject an email that contains a virus that is not sent in this way. In
addition, often we receive a file that appears not to have been infected, to find
later that the file was infected when it left the sender, and was cleaned somewhere
along the line.

Regards,

McAfee Labs

附件(0 个)

[病毒样本] 高质量：过绝大多数，卡巴报

本帖子中包含更多资源