[MD5: 488EE4]

lanvin

taihuxian

Kaspersky Internet Security 7.0

The requested URL http://bbs.kafan.cn/attachment.php?aid=86948 is infected with Backdoor.IRC.Zapchast virus

yashoo

mcafee pass

promised

Nblock

Micropoint

[ 本帖最后由 Nblock 于 2007-6-13 18:06 编辑 ]

kp2006

avast!基因识别报病毒

Win32:Trojan-gen. {VC}

zane_xzz

Virus or unwanted program 'TR/Zapchas.CA [TR/Zapchas.CA]'
detected in file 'C:\Documents and Settings\Administrator\桌面\样本\greeting.exe.
Action performed: Delete file

rasis

greeting.exe
      [DETECTION] Is the Trojan horse TR/Zapchas.CA
      [WARNING]   The file was ignored!
D:\My Download\greeting.exe
  [0] Archive type: RAR SFX (self extracting)
  --> DLL\hex.exe
      [DETECTION] Contains signature of the SPR/HideWindow.B program
  --> DLL\mirc.ini
      [DETECTION] Contains signature of the IRC virus IRC/Flood.CR
  --> DLL\regedit
      [DETECTION] Is the Trojan horse TR/IRC.Flood.1
  --> DLL\remote.ini
      [DETECTION] Contains signature of the IRC virus IRC/Zapchast.PF
  --> DLL\rundll.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/mIRC-1649664.A Backdoor server programs
  --> DLL\script.ini
      [DETECTION] Contains signature of the IRC virus IRC/Zapchast.M

红心王子

卡巴7前一个包不报
费尔两个

hj5abc

不知道里面有几个是毒?

NOD32 杀了5个. 2个EXE倒是不杀

Scanned disks, folders and files: F:\样本[1]\greeting.exe
F:\样本[1]\greeting.exe ?RAR ?DLL\mirc.ini - IRC/Flood.CP trojan
F:\样本[1]\greeting.exe ?RAR ?DLL\remote.ini - IRC/Zapchast.PE trojan -
F:\样本[1]\greeting.exe ?RAR ?DLL\script.ini - probably a variant of IRC/Zapchast.J trojan
F:\样本[1]\greeting.exe ?RAR ?DLL\ident.txt - IRC/Zapchast.AB trojan
F:\样本[1]\greeting.exe ?RAR ?DLL\identd.txt - IRC/Zapchast.AB trojan

[ 本帖最后由 hj5abc 于 2007-6-13 18:48 编辑 ]