对卡巴斯基互联网安全套装7.0表示失望，35个

红心王子

时间漏洞可能只是卡巴软肋的一个方面，说不定还会有别的漏洞
可以攻破卡巴的主动防御，破了自然垮

taihuxian

Virus: Win32:Onlinegames-ACD [Trj] (11x), Win32:Onlinegames-ACS [Trj] (14x), Win32:Agent-GRV [Trj], Win32:Onlinegames-ACL [Trj] (3x), Win32:OnLineGames-OC [Trj], Win32:Agent-GPD [Trj]

Virus found while downloading Web content.

Address: bbs.kafan.cn

mofunzone

始终认为kav应该放弃时间就修改就停止服务这种做法。。
不给升级就ok了，有必要连服务都禁止么。。

风雪

昨天玩论坛的样本。去掉权限后。费尔查到病毒虽然只修改了注册表。没有想到还修改了服务启动。但是没有其他动作，还是让人感到一惊。

wangjay1980

添加那个启动项？卡巴的主动防御没有提示，只有在开始程序--启动里卡巴是不监控的。这个很幽默，通过添加个启动项修改时间？

woai_jolin

2007/6/30 8:43:26        eAmon        file        D:\病毒上报\dh2104.dll        a variant of Win32/PSW.OnLineGames.NCC trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:25        eAmon        file        D:\病毒上报\dh0616[1].exe        a variant of Win32/PSW.OnLineGames.RC trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:24        eAmon        file        D:\病毒上报\AVPSrv.dll        a variant of Win32/PSW.OnLineGames.NBZ trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:23        eAmon        file        D:\病毒上报\AVPSrv.exe        a variant of Win32/PSW.OnLineGames.YA trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:22        eAmon        file        D:\病毒上报\8B105054.DLL        probably a variant of Win32/Agent.NEO trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:21        eAmon        file        D:\病毒上报\zx0616[1].exe        a variant of Win32/PSW.OnLineGames.RC trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:20        eAmon        file        D:\病毒上报\ztinetzt.exe        a variant of Win32/PSW.Agent.NEW trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:19        eAmon        file        D:\病毒上报\zt0616[1].exe        a variant of Win32/PSW.Agent.NEW trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:18        eAmon        file        D:\病毒上报\wow0617[1].exe        a variant of Win32/PSW.OnLineGames.RC trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:17        eAmon        file        D:\病毒上报\wm0612[1].exe        a variant of Win32/PSW.OnLineGames.RC trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:16        eAmon        file        D:\病毒上报\wl0618[1].exe        a variant of Win32/PSW.Agent.NEW trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:16        eAmon        file        D:\病毒上报\WinForm.dll        a variant of Win32/PSW.OnLineGames.NBZ trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:15        eAmon        file        D:\病毒上报\WinForm.exe        a variant of Win32/PSW.OnLineGames.YA trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:14        eAmon        file        D:\病毒上报\wd0618[1].exe        a variant of Win32/PSW.OnLineGames.YA trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:12        eAmon        file        D:\病毒上报\vod[1].exe        Win32/TrojanDropper.Delf.NEG trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:07        eAmon        file        D:\病毒上报\TL0619[1].EXE        a variant of Win32/PSW.OnLineGames.YA trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred during an attempt to access the file by the application: C:\Program Files\Micropoint\MPSVC2.exe.
2007/6/30 8:43:04        eAmon        file        D:\病毒上报\TIMHost.exe        a variant of Win32/PSW.OnLineGames.YA trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:03        eAmon        file        D:\病毒上报\qj0617[1].exe        a variant of Win32/PSW.OnLineGames.RC trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:02        eAmon        file        D:\病毒上报\nwizzhuxians.exe        a variant of Win32/PSW.OnLineGames.RC trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:43:01        eAmon        file        D:\病毒上报\nwizwmgjs.exe        a variant of Win32/PSW.OnLineGames.RC trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:42:59        eAmon        file        D:\病毒上报\nwizwlwzs.exe        a variant of Win32/PSW.Agent.NEW trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:42:58        eAmon        file        D:\病毒上报\nwizqjsj.exe        a variant of Win32/PSW.OnLineGames.RC trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:42:57        eAmon        file        D:\病毒上报\nwizdh.exe        a variant of Win32/PSW.OnLineGames.RC trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:42:56        eAmon        file        D:\病毒上报\nslookupi.exe        Win32/Agent.NEM trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:42:54        eAmon        file        D:\病毒上报\my0616[1].exe        a variant of Win32/PSW.OnLineGames.YA trojan        cleaned by deleting - quarantined                Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007/6/30 8:42:50        eAmon        file        D:\病毒上报\MSIMMS32.DLL        a variant of Win32/PSW.OnLineGames.NBZ trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred during an attempt to access the file by the application: C:\Program Files\Micropoint\MPSVC2.exe.
2007/6/30 8:42:48        eAmon        file        D:\病毒上报\MSIMMS32.EXE        a variant of Win32/PSW.OnLineGames.YA trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred during an attempt to access the file by the application: C:\Program Files\Micropoint\MPSVC2.exe.
2007/6/30 8:42:46        eAmon        file        D:\病毒上报\MOSOU.EXE        a variant of Win32/PSW.OnLineGames.RC trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred during an attempt to access the file by the application: C:\Program Files\Micropoint\MPSVC2.exe.
2007/6/30 8:42:43        eAmon        file        D:\病毒上报\MH0618[1].EXE        a variant of Win32/PSW.OnLineGames.YA trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred during an attempt to access the file by the application: C:\Program Files\Micropoint\MPSVC2.exe.

woai_jolin

每个AV都有它的缺点
不是吗？？？

wangjay1980

Hello,

8B105054.DLL - Backdoor.Win32.Agent.ahj,
AVPSrv.exek, mh0618[1].exek, MsIMMs32.exek, tl0619[1].exek, wd0618[1].exek, WinForm.exek - Trojan-PSW.Win32.OnLineGames.aac,
dh0616[1].exek, dh2104.dll, mosou.exek, nwizdh.exek, nwizqjsj.dll, wow0617[1].exek - Trojan-PSW.Win32.Nilage.bjp,
jh0619[1].exek - Trojan.Win32.Agent.anj,
nwizqjsj.exek, qj0617[1].exek - Trojan-PSW.Win32.Nilage.bki

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Krylov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

promised

谀哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪姆
?            VirusBlokAda (Console scanner)             ?
?Vba32 Windows/CL 3.12.0.2 / 2007.06.29 18:41 (Vba32.W) ?
?         Copyright (c) 1993-2007 by VBA Ltd.           ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯图
License expired
License #000000119 Valid till 2006-12-31
Demo mode
Computer: PROMISED-CE046A
System: Windows XP
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /sfx /af+ /fd+ /ar+ /bt- /mr- /ml+ /rw+ /as-
Program settings:
/r=susp.rpt /ha=3 /collect_suspects /nc /sfx /af+ /fd+ /ar+ /qu+ /ml+ /rw+

*:
C:\
C:\ABC\新建文件夹.rar:<RAR>\mh0618[1].exe : infected MalwareScope.Trojan-PSW.Game.3
C:\ABC\新建文件夹.rar:<RAR>\mosou.exe : is suspected of Downloader.Small.160
C:\ABC\新建文件夹.rar:<RAR>\MsIMMs32.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\ABC\新建文件夹.rar:<RAR>\MsIMMs32.dll : infected MalwareScope.Trojan-PSW.Game.12
C:\ABC\新建文件夹.rar:<RAR>\my0616[1].exe : infected MalwareScope.Trojan-PSW.Game.3
C:\ABC\新建文件夹.rar:<RAR>\nslookupi.exe : infected Backdoor.Win32.Agent.alh
C:\ABC\新建文件夹.rar:<RAR>\nwizdh.exe : is suspected of Downloader.Small.160
C:\ABC\新建文件夹.rar:<RAR>\nwizqjsj.exe : is suspected of Downloader.Small.160
C:\ABC\新建文件夹.rar:<RAR>\nwizqjsj.dll : is suspected of Downloader.Small.160
C:\ABC\新建文件夹.rar:<RAR>\nwizwlwzs.exe : infected Trojan.PWS.Wsgame
C:\ABC\新建文件夹.rar:<RAR>\nwizwlwzs.dll : infected Trojan.PWS.Lineage
C:\ABC\新建文件夹.rar:<RAR>\nwizwmgjs.exe : infected Trojan-PSW.Win32.OnLineGames.sc
C:\ABC\新建文件夹.rar:<RAR>\nwizwmgjs.dll : infected Trojan.DownLoader.24130
C:\ABC\新建文件夹.rar:<RAR>\nwizzhuxians.exe : infected Trojan.PWS.Wsgame
C:\ABC\新建文件夹.rar:<RAR>\nwizzhuxians.dll : is suspected of Downloader.Small.160
C:\ABC\新建文件夹.rar:<RAR>\qj0617[1].exe : is suspected of Downloader.Small.160
C:\ABC\新建文件夹.rar:<RAR>\TIMHost.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\ABC\新建文件夹.rar:<RAR>\tl0619[1].exe : infected MalwareScope.Trojan-PSW.Game.3
C:\ABC\新建文件夹.rar:<RAR>\vod[1].exe : infected Trojan-Dropper.Win32.Small.axi
C:\ABC\新建文件夹.rar:<RAR>\wd0618[1].exe : infected MalwareScope.Trojan-PSW.Game.3
C:\ABC\新建文件夹.rar:<RAR>\WinForm.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\ABC\新建文件夹.rar:<RAR>\WinForm.dll : infected MalwareScope.Trojan-PSW.Game.1
C:\ABC\新建文件夹.rar:<RAR>\wl0618[1].exe : infected Trojan.PWS.Wsgame
C:\ABC\新建文件夹.rar:<RAR>\wm0612[1].exe : infected Trojan-PSW.Win32.OnLineGames.sc
C:\ABC\新建文件夹.rar:<RAR>\wow0617[1].exe : is suspected of Downloader.Small.160
C:\ABC\新建文件夹.rar:<RAR>\zt0616[1].exe : is suspected of Downloader.Small.160
C:\ABC\新建文件夹.rar:<RAR>\ztinetzt.exe : is suspected of Downloader.Small.160
C:\ABC\新建文件夹.rar:<RAR>\zx0616[1].exe : infected Trojan.PWS.Wsgame
C:\ABC\新建文件夹.rar:<RAR>\8B105054.DLL : is suspected of Trojan-PSW.Game.63 (paranoid heuristics)
C:\ABC\新建文件夹.rar:<RAR>\AVPSrv.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\ABC\新建文件夹.rar:<RAR>\AVPSrv.dll : infected MalwareScope.Trojan-PSW.Game.12
C:\ABC\新建文件夹.rar:<RAR>\dh0616[1].exe : is suspected of Downloader.Small.160
C:\ABC\新建文件夹.rar:<RAR>\dh2104.dll : is suspected of Downloader.Small.160
Program execution terminated by user


Directories       : 4       Files in archives:      Files on disks:
Archives:                   - total       : 38      - total       : 23   
- scanned         : 4       -  scanned    : 38      - scanned     : 23   
- contain viruses : 1       -  infected   : 21      - infected    : 1     
- deleted         : 0       -  suspicious : 12      - suspicious  : 0     

Startup    : 11:26:09 30-06-2007
End        : 11:26:20 30-06-2007
Total time : 00:00:11

小邪邪

全杀