全部.dll[MD5: 20D148 AB34B0 93FC5E C1E9E1 91E453 B32261 9F6679 5CCB03 AD105B]

野马

扫一扫？

[ 本帖最后由 野马 于 2007-7-21 16:13 编辑 ]

promised

MD5拜托

promised

C:\ABC\9个dll\新建文件夹\fyso0.dll - 特征码 'Trojan-PWS.Win32.OnLineGames.abi' 被发现
C:\ABC\9个dll\新建文件夹\jtso0.dll - 特征码 'Generic.Onlinegames.3' 被发现
C:\ABC\9个dll\新建文件夹\mhso0.dll - 特征码 'Generic.PWS.Games' 被发现
C:\ABC\9个dll\新建文件夹\qjso0.dll - 特征码 'Trojan-PWS.Win32.OnLineGames.bs' 被发现
C:\ABC\9个dll\新建文件夹\rxso0.dll - 特征码 'Generic.PWS.Games' 被发现
C:\ABC\9个dll\新建文件夹\wmso0.dll - 特征码 'Trojan-PWS.Win32.OnLineGames.sl' 被发现
C:\ABC\9个dll\新建文件夹\woso0.dll - 特征码 'Trojan-PWS.Win32.Small.cf' 被发现
C:\ABC\9个dll\新建文件夹\ztso0.dll - 特征码 'Trojan-PWS.Win32.Nilage.bjp' 被发现
C:\ABC\9个dll\新建文件夹\zxso0.dll - 特征码 'Trojan-PWS.Win32.OnLineGames.qo' 被发现

        9 个文件被扫描
          (0 个压缩档 0 个文件)
        9 个特征码被侦测
        0 个可疑代码段被发现
        耗时: 0:00.047

woai_jolin

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/19 17:24:52 (812833 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 833174
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~ODB1.tmp"
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files in the directory: F:\v\新建文件夹\
        0 ms F:\v\新建文件夹\fyso0.dll                                   
       15 ms F:\v\新建文件夹\jtso0.dll                                   
        0 ms F:\v\新建文件夹\mhso0.dll                                   
       16 ms F:\v\新建文件夹\qjso0.dll                                    Trojan W32/OnLineGames.IHM ()
        0 ms F:\v\新建文件夹\rxso0.dll                                   
        0 ms F:\v\新建文件夹\wmso0.dll                                   
       31 ms F:\v\新建文件夹\woso0.dll                                    Trojan W32/Smalltroj.BILQ ()
       15 ms F:\v\新建文件夹\ztso0.dll                                    Backdoor W32/Lineage.AUPZ ()
        0 ms F:\v\新建文件夹\zxso0.dll                                    Trojan W32/OnLineGames.IHA ()
- File F:\v\新建文件夹\qjso0.dll quarantined.
- File F:\v\新建文件夹\qjso0.dll deleted.
- File F:\v\新建文件夹\woso0.dll quarantined.
- File F:\v\新建文件夹\woso0.dll deleted.
- File F:\v\新建文件夹\ztso0.dll quarantined.
- File F:\v\新建文件夹\ztso0.dll deleted.
- File F:\v\新建文件夹\zxso0.dll quarantined.
- File F:\v\新建文件夹\zxso0.dll deleted.

===================================================================================================

The scanning started: 2007/07/21 16:10:58
               ended: 2007/07/21 16:10:58
Logged on as        : Administrator
on hostname         : BE29C0E1C4C9406

Scanning results:
   Total number of files found..............................:       9
   Number of files scanned..................................:       9
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       0
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       4

Copyright (c) 1993-2005 Norman ASA.

The EQs

nod32杀dll的确很弱
Scan performed at: 2007-7-21 16:13:39
Scanning Log
NOD32 version 2410 (20070720) NT
Command line: C:\Documents and Settings\EQ2\桌面\9个dll.rar
Operating memory - is OK

Date: 21.7.2007  Time: 16:13:46
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\9个dll.rar
C:\Documents and Settings\EQ2\桌面\9个dll.rar ?RAR ?新建文件夹\rxso0.dll - a variant of Win32/PSW.OnLineGames.NBD trojan
C:\Documents and Settings\EQ2\桌面\9个dll.rar ?RAR ?新建文件夹\qjso0.dll - a variant of Win32/PSW.OnLineGames.NAZ trojan
C:\Documents and Settings\EQ2\桌面\9个dll.rar ?RAR ?新建文件夹\ztso0.dll - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\EQ2\桌面\9个dll.rar ?RAR ?新建文件夹\mhso0.dll - a variant of Win32/PSW.OnLineGames.NAT trojan
C:\Documents and Settings\EQ2\桌面\9个dll.rar ?RAR ?新建文件夹\woso0.dll - a variant of Win32/PSW.WOW.NCD trojan
Number of scanned files: 10
Number of threats found: 5
Number of files cleaned: 1
Time of completion: 16:13:46 Total scanning time: 0 sec (00:00:00)

pine

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\9个dll.rar'
C:\Documents and Settings\Administrator\桌面\9个dll.rar
  [0] Archive type: RAR
  --> н¨Îļþ¼Ð\wmso0.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> н¨Îļþ¼Ð\zxso0.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> н¨Îļþ¼Ð\rxso0.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> н¨Îļþ¼Ð\qjso0.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> н¨Îļþ¼Ð\ztso0.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> н¨Îļþ¼Ð\fyso0.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> н¨Îļþ¼Ð\mhso0.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> н¨Îļþ¼Ð\jtso0.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> н¨Îļþ¼Ð\woso0.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年7月21日  16:14
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
     11 Files were scanned
      9 viruses and/or unwanted programs were found
      0 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

风野胤

扫描情况和我想像的差不多
nod比我想像的表现要好

The EQs

nod32的虚拟机模拟不了原生的dll。。。上次和eset反应了。。。但是还没得到回复。。。

野马

原帖由 promised 于 2007-7-21 16:12 发表
MD5拜托

我很自觉的！
只是发了好几次，都上传不了附件，一下找不到MD5了。

woai_jolin

DLL是NORMAN的软肋