MD5: f7c845

显示全部楼层 · 发表于 2007-6-20 00:42:15

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\1237.rar'
C:\Documents and Settings\Administrator\桌面\1237.rar
  [0] Archive type: RAR
  --> 1237.exe
   [DETECTION] Is the Trojan horse TR/Zlob
   [INFO]    The file was moved to '46ab0898.qua'!

显示全部楼层 · 发表于 2007-6-20 00:45:20

detected: Trojan program Trojan.Win32.DNSChanger.jb URL: http://bbs.kafan.cn/attachment.p ... exe//stream//Script

显示全部楼层 · 发表于 2007-6-20 00:56:19

sophos报

显示全部楼层 · 发表于 2007-6-20 00:57:53

Scan performed at: 2007-6-20 1:01:35
Scanning Log
NOD32 version 2338 (20070619) NT
Command line: C:\Documents and Settings\EQ2\桌面\1237.rar
Operating memory - is OK

Date: 20.6.2007 Time: 01:01:40
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\1237.rar
C:\Documents and Settings\EQ2\桌面\1237.rar ?RAR ?1237.exe ?NSIS ?00.exe ?RAR ?01.exe - Incorrect file checksum (CRC), the file is probably password protected.
C:\Documents and Settings\EQ2\桌面\1237.rar ?RAR ?1237.exe ?NSIS ?00.exe ?RAR ?02.exe - Incorrect file checksum (CRC), the file is probably password protected.
Number of scanned files: 6
Number of threats found: 0
Time of completion: 01:01:40 Total scanning time: 0 sec (00:00:00)

[ 本帖最后由 EQ2 于 2007-6-20 01:03 编辑 ]

显示全部楼层 · 发表于 2007-6-20 01:29:08

病毒: Trojan.Win32.DNSChanger.jb
檔案: 1237[1].rar
目錄: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\VM1NGYS8
處理序: GreenBrowser.exe

显示全部楼层 · 发表于 2007-6-20 02:13:16

哎,过不了微点.

显示全部楼层 · 发表于 2007-6-20 03:33:10

国外流行的流氓啊，不杀的话真的别想混了

Zlob木马是通过加密压缩包传播的，而为了可以直接查杀这个目前正在猖狂着的病毒，有些厂商直接把整个加密压缩包入库了，不必解压就能杀
可是一般来说，只要执行，把里面的东西解放出来了，很多杀软都能杀
整个包装是NSIS安装包，里面藏着个00.exe，是RAR压缩包，解压后会把1.exe放出来，即是病毒体了

显示全部楼层 · 发表于 2007-6-20 05:19:34

不行，这个斧头没动静
上报去

显示全部楼层 · 发表于 2007-6-20 06:53:48

Virus: Trojan.Win32.DNSChanger.jb

Virus found while downloading Web content.

Address: bbs.kafan.cn

[病毒样本] MD5: f7c845

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源