刚从别人U盘上抓的一个及其生成物,过的比较多

T-G001

4b35000086f0b180de27206b3c630589

promised

通杀
C:\ABC\ABC\daso0.dll - 特征码 'Win32.SuspectCrc' 被发现
C:\ABC\ABC\fyso0.dll - 特征码 'Trojan-PWS.Win32.OnLineGames.abi' 被发现
C:\ABC\ABC\jtso0.dll - 特征码 'Generic.Onlinegames.3' 被发现
C:\ABC\ABC\M1.exe - 特征码 'Virus.Win32.AutoRun.bk' 被发现
C:\ABC\ABC\mhso0.dll - 特征码 'Generic.PWS.Games' 被发现
C:\ABC\ABC\qjso0.dll - 特征码 'Trojan-PWS.Win32.OnLineGames.bs' 被发现
C:\ABC\ABC\rxso0.dll - 特征码 'Generic.PWS.Games' 被发现

        7 个文件被扫描
          (0 个压缩档 0 个文件)
        7 个特征码被侦测
        0 个可疑代码段被发现
        耗时: 0:00.047

[ 本帖最后由 promised 于 2007-7-19 12:52 编辑 ]

wangjay1980

detected: Trojan program Trojan-PSW.Win32.OnLineGames.ui        File: C:\Documents and Settings\Owner\×ÀÃæ\Éú³ÉÎï.rar/jtso0.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.abi        File: C:\Documents and Settings\Owner\×ÀÃæ\Éú³ÉÎï.rar/fyso0.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.abv        File: C:\Documents and Settings\Owner\×ÀÃæ\Éú³ÉÎï.rar/rxso0.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.bs        File: C:\Documents and Settings\Owner\×ÀÃæ\Éú³ÉÎï.rar/qjso0.dll
detected: virus Virus.Win32.AutoRun.bk        File: C:\Documents and Settings\Owner\×ÀÃæ\M1.rar/M1.exe//PE_Patch.UPX//UPX

风雪

1184821566,2007-7-19 13:06:06,TrojanPSW.OnlineGames.djp.mfta.dll,木马,mygood,D:\3\新建文件夹\新建文件夹\daso0.dll,Manual scan
1184821566,2007-7-19 13:06:06,TrojanPSW.OnLineGames.abi.nfst.dll,木马,mygood,D:\3\新建文件夹\新建文件夹\fyso0.dll,Manual scan
1184821566,2007-7-19 13:06:06,TrojanPSW.OnlineGames.bhw.cnms.dll,木马,mygood,D:\3\新建文件夹\新建文件夹\jtso0.dll,Manual scan
1184821566,2007-7-19 13:06:06,TrojanPSW.OnlineGames.bhu.onvn.dll,木马,mygood,D:\3\新建文件夹\新建文件夹\qjso0.dll,Manual scan
1184821566,2007-7-19 13:06:06,TrojanPSW.OnLineGames.abv.vgds.dll,木马,mygood,D:\3\新建文件夹\新建文件夹\rxso0.dll,Manual scan
费尔

xiaopangmd

扫描开始时间: 2007-7-19 13:14:03
扫描日志
NOD32 版本 2405 (20070718) NT
命令行: C:\Documents and Settings\Martin\桌面\M1.rar
系统内存<病毒 - >

日期: 2007年7月19日  时间: 13:14:11
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: C:\Documents and Settings\Martin\桌面\M1.rar
C:\Documents and Settings\Martin\桌面\M1.rar ?RAR ?M1.exe<病毒 - Win32/PSW.OnLineGames.NBR 木马> - 是删除目标的一部分
已扫描文件数量: 2
已发现病毒数量: 1
已清除病毒的文件数量: 1
完成时间: 13:14:12 总共扫描时间: 1 秒 (00:00:01)

quansen83

--> jtso0.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> mhso0.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> fyso0.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> rxso0.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> qjso0.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> daso0.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [INFO]      The file was deleted!

rasis

M1.rar
  [0] Archive type: RAR
  --> M1.exe
      [DETECTION] Is the Trojan horse TR/Autorun.BK

woai_jolin

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/18 08:11:18 (811592 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 831933
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~ODB.tmp"
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files in the directory: F:\v\
        0 ms F:\v\daso0.dll                                             
       16 ms F:\v\fyso0.dll                                             
        0 ms F:\v\jtso0.dll                                             
     3078 ms F:\v\M1.exe                                                
        0 ms F:\v\mhso0.dll                                             
       16 ms F:\v\qjso0.dll                                               Trojan W32/OnLineGames.IHM ()
        0 ms F:\v\rxso0.dll                                             
- File F:\v\qjso0.dll quarantined.
- File F:\v\qjso0.dll deleted.

===================================================================================================

The scanning started: 2007/07/19 13:43:29
               ended: 2007/07/19 13:43:32
Logged on as        : Administrator
on hostname         : BE29C0E1C4C9406

Scanning results:
   Total number of files found..............................:       7
   Number of files scanned..................................:       7
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       0
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       1

Copyright (c) 1993-2005 Norman ASA.

yyg747

The requested URL http://bbs.kafan.cn/attachment.php?aid=102601 is infected with Virus.Win32.AutoRun.bk virus


The requested URL http://bbs.kafan.cn/attachment.php?aid=102602 is infected with Trojan-PSW.Win32.OnLineGames.ui virus

woai_jolin

2007/7/19 14:27:23        Scanning Log
2007/7/19 14:27:23        Version of virus signature database: 2405 (20070718)
2007/7/19 14:27:23        Date: 19.7.2007  Time: 14:27:23
2007/7/19 14:27:23        Scanned disks, folders and files: F:\v\
2007/7/19 14:27:23        F:\v\M1.rar - Win32/PSW.OnLineGames.NBR trojan - deleted - quarantined
2007/7/19 14:27:23        F:\v\M1.rar &raquo; RAR &raquo; M1.exe - Win32/PSW.OnLineGames.NBR trojan
2007/7/19 14:27:24        F:\v\生成物.rar - multiple threats - deleted - quarantined
2007/7/19 14:27:24        F:\v\生成物.rar &raquo; RAR &raquo; mhso0.dll - a variant of Win32/PSW.OnLineGames.NAT trojan
2007/7/19 14:27:24        F:\v\生成物.rar &raquo; RAR &raquo; rxso0.dll - a variant of Win32/PSW.OnLineGames.NBD trojan
2007/7/19 14:27:24        F:\v\生成物.rar &raquo; RAR &raquo; qjso0.dll - a variant of Win32/PSW.OnLineGames.NAZ trojan
2007/7/19 14:27:24        Number of scanned files: 9
2007/7/19 14:27:24        Number of threats found: 4
2007/7/19 14:27:24        Time of completion: 14:27:24  Total scanning time: 1 sec (00:00:01)