ZBot Trojan Remover是一款可以檢測并查殺ZBot變種木馬病毒的查殺工具,ZBot變種木馬會在電腦中潛伏,并且專門針對用戶的各種銀行賬號,是一種威脅非常大的病毒,大家一定要小心防范。
病毒樣本:
Malware Analyzer by HX
Analysis started
MD5: 2BB9A1C4B35719ABD022C605A546D6C4
Executing -> \Device\HarddiskVolume3\Users\Gateway\Desktop\2BB9A1C4B35719ABD022C605A546D6C4.exe (PID: 13440)
Command-line: "C:\Users\Gateway\Desktop\2BB9A1C4B35719ABD022C605A546D6C4.exe"
C:\Users\Gateway\Desktop\2BB9A1C4B35719ABD022C605A546D6C4.exe
WriteFile, C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe
C:\Users\Gateway\Desktop\2BB9A1C4B35719ABD022C605A546D6C4.exe
WriteRegistryKey, Software\Microsoft
C:\Users\Gateway\Desktop\2BB9A1C4B35719ABD022C605A546D6C4.exe
WriteRegistryKey, Juat
C:\Users\Gateway\Desktop\2BB9A1C4B35719ABD022C605A546D6C4.exe
DeleteFile, C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe
C:\Users\Gateway\Desktop\2BB9A1C4B35719ABD022C605A546D6C4.exe
WriteFile, C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe
C:\Users\Gateway\Desktop\2BB9A1C4B35719ABD022C605A546D6C4.exe
WriteFile, C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe
Executing -> \Device\HarddiskVolume3\Sandbox\Gateway\Analyzer\user\current\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
Command-line: "C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe"
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe
WriteRegistryKey, Software\Microsoft\Juat
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe
WriteRegistryKey, f62bfi
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\Windows\System32\taskhost.exe (PID: 1992)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\Windows\System32\dwm.exe (PID: 2976)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\Users\Gateway\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (PID: 3484)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\Program Files (x86)\Google\Drive\googledrivesync.exe (PID: 3496)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\Program Files\Sandboxie\SbieCtrl.exe (PID: 3524)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (PID: 3584)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, K:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 8 for Windows\avp.exe (PID: 3592)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\Users\Gateway\Desktop\goagent-goagent-a51d6a2\local\goagent.exe (PID: 3600)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\Windows\System32\conhost.exe (PID: 3608)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\Program Files\BOINC\boincmgr.exe (PID: 3696)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\Users\Gateway\Desktop\goagent-goagent-a51d6a2\local\python27.exe (PID: 3704)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\Program Files\BOINC\boinctray.exe (PID: 3776)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, K:\SkyDrive\Programs\VB\Sherlogger\Sherlogger.exe (PID: 3840)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, K:\Program Files (x86)\BaiduYun\baiduyun.exe (PID: 3868)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\Program Files (x86)\Google\Drive\googledrivesync.exe (PID: 3952)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\Program Files\BOINC\boinc.exe (PID: 3964)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\Windows\System32\conhost.exe (PID: 3972)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\Program Files (x86)\alipay\SafeTransaction\AlipaySafeTran.exe (PID: 17800)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\ProgramData\BOINC\projects\www.worldcommunitygrid.org\wcgrid_dsfl_vina_6.25_windows_x86_64 (PID: 57092)
C:\Users\Gateway\AppData\Roaming\Gola\xyeq.exe (PID: 16540)
AccessPROTECTEDProgram, C:\Windows\System32\conhost.exe (PID: 58156)
Rolling back...
Analysis ended
Reason: Malware detected and rolled back
Anomalies:
- Modifies protected resource. The executable modifies important resources (files, processes, etc.)
- PC官方版
- 安卓官方手機版
- IOS官方手機版