manage.exe , sdra64.exe (Win32.Krap.ar : Kaspersky)
File size 110 KB (113,152 bytes)
MD5: 439200DE66578EC9CE31AC9030853DF5
SHA-1: D9D7D0B463716AC727684CCF36B53D477366FD75
=======================================================
| Antivirus | Version | Last Update | Result |
|---|---|---|---|
| a-squared | 4.5.0.50 | 2010.02.10 | PWS.Win32!IK |
| AhnLab-V3 | 5.0.0.2 | 2010.02.09 | - |
| AntiVir | 7.9.1.160 | 2010.02.10 | TR/PSW.Zbot.113152W.2 |
| Antiy-AVL | 2.0.3.7 | 2010.02.09 | - |
| Authentium | 5.2.0.5 | 2010.02.10 | - |
| Avast | 4.8.1351.0 | 2010.02.10 | - |
| AVG | 9.0.0.730 | 2010.02.10 | - |
| BitDefender | 7.2 | 2010.02.10 | - |
| CAT-QuickHeal | 10.00 | 2010.02.10 | (Suspicious) - DNAScan |
| ClamAV | 0.96.0.0-git | 2010.02.10 | - |
| Comodo | 3886 | 2010.02.10 | TrojWare.Win32.TrojanSpy.Zbot.Gen |
| DrWeb | 5.0.1.12222 | 2010.02.10 | - |
| eSafe | 7.0.17.0 | 2010.02.09 | Win32.PWSZbot |
| eTrust-Vet | 35.2.7294 | 2010.02.10 | Win32/Koobface.C!generic |
| F-Prot | 4.5.1.85 | 2010.02.09 | - |
| F-Secure | 9.0.15370.0 | 2010.02.10 | Suspicious:W32/Malware!Online |
| Fortinet | 4.0.14.0 | 2010.02.10 | - |
| GData | 19 | 2010.02.10 | - |
| Ikarus | T3.1.1.80.0 | 2010.02.10 | PWS.Win32 |
| Jiangmin | 13.0.900 | 2010.02.08 | - |
| K7AntiVirus | 7.10.969 | 2010.02.08 | - |
| Kaspersky | 7.0.0.125 | 2010.02.10 | Packed.Win32.Krap.ar |
| McAfee | 5887 | 2010.02.09 | - |
| McAfee+Artemis | 5887 | 2010.02.09 | Artemis!439200DE6657 |
| McAfee-GW-Edition | 6.8.5 | 2010.02.10 | Trojan.PSW.Zbot.113152W.2 |
| Microsoft | 1.5406 | 2010.02.10 | PWS:Win32/Zbot.gen!W |
| NOD32 | 4853 | 2010.02.10 | - |
| Norman | 6.04.03 | 2010.02.10 | - |
| nProtect | 2009.1.8.0 | 2010.02.10 | - |
| Panda | 10.0.2.2 | 2010.02.09 | - |
| PCTools | 7.0.3.5 | 2010.02.10 | - |
| Prevx | 3.0 | 2010.02.10 | Medium Risk Malware |
| Rising | 22.34.01.02 | 2010.02.10 | Packer.Win32.Agent.bk |
| Sophos | 4.50.0 | 2010.02.10 | Mal/Generic-A |
| Sunbelt | 3.2.1858.2 | 2010.02.10 | Worm.Win32.Koobface.Gen.3 (v) |
| Symantec | 20091.2.0.41 | 2010.02.10 | Suspicious.Insight |
| TheHacker | 6.5.1.1.186 | 2010.02.10 | - |
| TrendMicro | 9.120.0.1004 | 2010.02.10 | WORM_KUBFACE.SMF |
| VBA32 | 3.12.12.2 | 2010.02.09 | - |
| ViRobot | 2010.2.10.2180 | 2010.02.10 | - |
| VirusBuster | 5.0.21.0 | 2010.02.09 | Trojan.PWS.Zbot.UFL |
-------------------------------------------------------------------------------
Files Created
%System%\sdra64.exe
%System%\lowsec\local.ds
%System%\lowsec\user.ds
%System%\lowsec\user.ds.lll
%System% = C:\Windows\System32
Registry Modifications
Keys added
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\
{334613DB-50C1-B3BE-95ED-E9915A134FF1}
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\
{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6}
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\
{4776C4DC-E894-7C06-2148-5D73CEF5F905}
HKU\.DEFAULT\Software\Microsoft\Protected Storage System Provider
Values added
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\
UID = "%ComputerName%_B4DF7611BB99FF8A"
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\
{334613DB-50C1-B3BE-95ED-E9915A134FF1}\
{3039636B-5F3D-6C64-6675-696870667265} = F7 09 F2 0D
{33373039-3132-3864-6B30-303233343434} = F7 09 F2 0D
{6E633338-267E-2A79-6830-386668666866} = F7 09 F2 0D
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\
{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6}
{3039636B-5F3D-6C64-6675-696870667265} = F7 09 F2 0D
{33373039-3132-3864-6B30-303233343434} = F7 09 F2 0D
{6E633338-267E-2A79-6830-386668666866} = F7 09 F2 0D
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\
{4776C4DC-E894-7C06-2148-5D73CEF5F905}\
{3039636B-5F3D-6C64-6675-696870667265} = F7 09 F2 0D
{33373039-3132-3864-6B30-303233343434} = F7 09 F2 0D
{6E633338-267E-2A79-6830-386668666866} = F7 09 F2 0D
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
ProxyEnable = 0x00000000
Values modified
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
Userinit =
------------------------------------------------------------------------------
วิธีกำจัด /แก้ : manage.exe , sdra64.exe (Win32.Krap.ar : Kaspersky)
-------------------------------------------------------------------------------
Download Fix Tool : ZbotKiller (Kaspersky)
No comments:
Post a Comment