刚从别人U盘上抓的一个及其生成物,过的比较多

显示全部楼层 · 发表于 2007-7-19 12:47:50

4b35000086f0b180de27206b3c630589

显示全部楼层 · 发表于 2007-7-19 12:50:27

通杀
C:\ABC\ABC\daso0.dll - 特征码 'Win32.SuspectCrc' 被发现
C:\ABC\ABC\fyso0.dll - 特征码 'Trojan-PWS.Win32.OnLineGames.abi' 被发现
C:\ABC\ABC\jtso0.dll - 特征码 'Generic.Onlinegames.3' 被发现
C:\ABC\ABC\M1.exe - 特征码 'Virus.Win32.AutoRun.bk' 被发现
C:\ABC\ABC\mhso0.dll - 特征码 'Generic.PWS.Games' 被发现
C:\ABC\ABC\qjso0.dll - 特征码 'Trojan-PWS.Win32.OnLineGames.bs' 被发现
C:\ABC\ABC\rxso0.dll - 特征码 'Generic.PWS.Games' 被发现

      7 个文件被扫描
      (0 个压缩档 0 个文件)
      7 个特征码被侦测
      0 个可疑代码段被发现
      耗时: 0:00.047

[ 本帖最后由 promised 于 2007-7-19 12:52 编辑 ]

显示全部楼层 · 发表于 2007-7-19 12:56:09

detected: Trojan program Trojan-PSW.Win32.OnLineGames.ui File: C:\Documents and Settings\Owner\×ÀÃæ\Éú³ÉÎï.rar/jtso0.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.abi File: C:\Documents and Settings\Owner\×ÀÃæ\Éú³ÉÎï.rar/fyso0.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.abv File: C:\Documents and Settings\Owner\×ÀÃæ\Éú³ÉÎï.rar/rxso0.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.bs File: C:\Documents and Settings\Owner\×ÀÃæ\Éú³ÉÎï.rar/qjso0.dll
detected: virus Virus.Win32.AutoRun.bk File: C:\Documents and Settings\Owner\×ÀÃæ\M1.rar/M1.exe//PE_Patch.UPX//UPX

显示全部楼层 · 发表于 2007-7-19 13:07:04

1184821566,2007-7-19 13:06:06,TrojanPSW.OnlineGames.djp.mfta.dll,木马,mygood,D:\3\新建文件夹\新建文件夹\daso0.dll,Manual scan
1184821566,2007-7-19 13:06:06,TrojanPSW.OnLineGames.abi.nfst.dll,木马,mygood,D:\3\新建文件夹\新建文件夹\fyso0.dll,Manual scan
1184821566,2007-7-19 13:06:06,TrojanPSW.OnlineGames.bhw.cnms.dll,木马,mygood,D:\3\新建文件夹\新建文件夹\jtso0.dll,Manual scan
1184821566,2007-7-19 13:06:06,TrojanPSW.OnlineGames.bhu.onvn.dll,木马,mygood,D:\3\新建文件夹\新建文件夹\qjso0.dll,Manual scan
1184821566,2007-7-19 13:06:06,TrojanPSW.OnLineGames.abv.vgds.dll,木马,mygood,D:\3\新建文件夹\新建文件夹\rxso0.dll,Manual scan
费尔

显示全部楼层 · 发表于 2007-7-19 13:14:21

扫描开始时间: 2007-7-19 13:14:03
扫描日志
NOD32 版本 2405 (20070718) NT
命令行: C:\Documents and Settings\Martin\桌面\M1.rar
系统内存<病毒 - >

日期: 2007年7月19日时间: 13:14:11
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: C:\Documents and Settings\Martin\桌面\M1.rar
C:\Documents and Settings\Martin\桌面\M1.rar ?RAR ?M1.exe<病毒 - Win32/PSW.OnLineGames.NBR 木马> - 是删除目标的一部分
已扫描文件数量: 2
已发现病毒数量: 1
已清除病毒的文件数量: 1
完成时间: 13:14:12 总共扫描时间: 1 秒 (00:00:01)

显示全部楼层 · 发表于 2007-7-19 13:16:49

--> jtso0.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> mhso0.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> fyso0.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> rxso0.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> qjso0.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> daso0.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-19 13:19:17

M1.rar
  [0] Archive type: RAR
  --> M1.exe
   [DETECTION] Is the Trojan horse TR/Autorun.BK

显示全部楼层 · 发表于 2007-7-19 13:43:50

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/18 08:11:18 (811592 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 831933
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~ODB.tmp"
===================================================================================================

   Time  Filename                                                    Virus name
---------------------------------------------------------------------------------------------------
- Scanning files in the directory: F:\v\
      0 ms F:\v\daso0.dll
   16 ms F:\v\fyso0.dll
      0 ms F:\v\jtso0.dll
   3078 ms F:\v\M1.exe
      0 ms F:\v\mhso0.dll
   16 ms F:\v\qjso0.dll                                              Trojan W32/OnLineGames.IHM ()
      0 ms F:\v\rxso0.dll
- File F:\v\qjso0.dll quarantined.
- File F:\v\qjso0.dll deleted.

===================================================================================================

The scanning started: 2007/07/19 13:43:29
            ended: 2007/07/19 13:43:32
Logged on as       : Administrator
on hostname       : BE29C0E1C4C9406

Scanning results:
Total number of files found..............................:    7
Number of files scanned..................................:    7
Number of files/directories skipped due to exclude list..:    0
Number of files that could not be opened.................:    0
Number of archive files unpacked.........................:    0
Number of archive files not unpacked.....................:    0
Number of infections.....................................:    1

Copyright (c) 1993-2005 Norman ASA.

显示全部楼层 · 发表于 2007-7-19 14:14:02

The requested URL http://bbs.kafan.cn/attachment.php?aid=102601 is infected with Virus.Win32.AutoRun.bk virus

The requested URL http://bbs.kafan.cn/attachment.php?aid=102602 is infected with Trojan-PSW.Win32.OnLineGames.ui virus

显示全部楼层 · 发表于 2007-7-19 14:27:45

2007/7/19 14:27:23 Scanning Log
2007/7/19 14:27:23 Version of virus signature database: 2405 (20070718)
2007/7/19 14:27:23 Date: 19.7.2007 Time: 14:27:23
2007/7/19 14:27:23 Scanned disks, folders and files: F:\v\
2007/7/19 14:27:23 F:\v\M1.rar - Win32/PSW.OnLineGames.NBR trojan - deleted - quarantined
2007/7/19 14:27:23 F:\v\M1.rar » RAR » M1.exe - Win32/PSW.OnLineGames.NBR trojan
2007/7/19 14:27:24 F:\v\生成物.rar - multiple threats - deleted - quarantined
2007/7/19 14:27:24 F:\v\生成物.rar » RAR » mhso0.dll - a variant of Win32/PSW.OnLineGames.NAT trojan
2007/7/19 14:27:24 F:\v\生成物.rar » RAR » rxso0.dll - a variant of Win32/PSW.OnLineGames.NBD trojan
2007/7/19 14:27:24 F:\v\生成物.rar » RAR » qjso0.dll - a variant of Win32/PSW.OnLineGames.NAZ trojan
2007/7/19 14:27:24 Number of scanned files: 9
2007/7/19 14:27:24 Number of threats found: 4
2007/7/19 14:27:24 Time of completion: 14:27:24 Total scanning time: 1 sec (00:00:01)

[病毒样本] 刚从别人U盘上抓的一个及其生成物,过的比较多

本帖子中包含更多资源