8[MD5: 556A17 730DB7 43894C 36BD5C BD7E1F 5CB7CF 62C618 7A64F6]

qianwenxiang

[MD5: 556A17 730DB7 43894C 36BD5C BD7E1F 5CB7CF 62C618 7A64F6]
8个（7exe1dll）

promised

C:\ABC\~temp_(8)\~temp (1).exe - 特征码 'Trojan-PWS.Win32.OnLineGames.acx' 被发现
C:\ABC\~temp_(8)\~temp (2).exe - 特征码 'Trojan-Dropper.Win32.Mudrop.dy' 被发现
C:\ABC\~temp_(8)\~temp (3).exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\~temp_(8)\~temp (4).exe - 特征码 'Trojan-PWS.Win32.Nilage.bbr' 被发现
C:\ABC\~temp_(8)\~temp (5).exe - 特征码 'Trojan-Dropper.Microjoin.WA' 被发现
C:\ABC\~temp_(8)\~temp (6).exe - 特征码 'Generic.Onlinegames.2' 被发现
C:\ABC\~temp_(8)\~temp (7).exe - 特征码 'Trojan-PWS.OnlineGames.AYD' 被发现
C:\ABC\~temp_(8)\~temp (8).DLL - 特征码 'AdWare.ToolBar.MyWebSearch' 被发现

        8 个文件被扫描
          (0 个压缩档 0 个文件)
        8 个特征码被侦测
        0 个可疑代码段被发现
        耗时: 0:00.141

The EQs

Scan performed at: 2007-7-22 22:15:56
Scanning Log
NOD32 version 2411 (20070721) NT
Command line: C:\Documents and Settings\EQ2\桌面\~temp_(8).rar
Operating memory - is OK

Date: 22.7.2007  Time: 22:16:01
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\~temp_(8).rar
C:\Documents and Settings\EQ2\桌面\~temp_(8).rar ?RAR ?~temp (3).exe - a variant of Win32/PSW.OnLineGames.NCU trojan
C:\Documents and Settings\EQ2\桌面\~temp_(8).rar ?RAR ?~temp (4).exe - a variant of Win32/PSW.Agent.NDP trojan
C:\Documents and Settings\EQ2\桌面\~temp_(8).rar ?RAR ?~temp (5).exe - probably a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\EQ2\桌面\~temp_(8).rar ?RAR ?~temp (6).exe - probably a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\EQ2\桌面\~temp_(8).rar ?RAR ?~temp (7).exe - a variant of Win32/Agent.NIK trojan
C:\Documents and Settings\EQ2\桌面\~temp_(8).rar ?RAR ?~temp (1).exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\EQ2\桌面\~temp_(8).rar ?RAR ?~temp (2).exe - probably a variant of Win32/PSW.Agent.KV trojan
Number of scanned files: 9
Number of threats found: 7
Number of files cleaned: 1
Time of completion: 22:16:02 Total scanning time: 1 sec (00:00:01)

aerbeisi

detected: virus Trojan.Generic (modification)        File: ~temp (8).rar/~temp (3).exe//PE_Patch//UPack
detected: virus Invader (modification)        File: ~temp (8).rar/~temp (4).exe
detected: virus Invader (modification)        File: ~temp (8).rar/~temp (5).exe
detected: virus Invader (modification)        File: ~temp (8).rar/~temp (6).exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.acx        File: ~temp (8).rar/~temp (1).exe//PE_Patch.UPX//UPX
detected: adware not-a-virus:AdWare.Win32.FunWeb.e        File: ~temp (8).rar/~temp (8).DLL

dyw1021

Start of the scan: 2007年7月22日  22:26

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\~temp_(8).rar'
C:\Documents and Settings\Administrator\桌面\~temp_(8).rar
  [0] Archive type: RAR
  --> ~temp (3).exe
      [DETECTION] Is the Trojan horse TR/PSW.Agent.rwa
  --> ~temp (4).exe
      [DETECTION] Is the Trojan horse TR/Agent.34708.B
  --> ~temp (5).exe
      [DETECTION] Is the Trojan horse TR/PSW.LdPinch.jm1
  --> ~temp (6).exe
      [DETECTION] Is the Trojan horse TR/PSW.Agent.20480
  --> ~temp (7).exe
      [DETECTION] Is the Trojan horse TR/Agent.22016.B
  --> ~temp (1).exe
      [DETECTION] Is the Trojan horse TR/PSW.Agent.20480
  --> ~temp (2).exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '4708699b.qua'!


End of the scan: 2007年7月22日  22:26
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
      9 Files were scanned
      7 viruses and/or unwanted programs were found
      1 classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

hj5abc

除了那个广告dll..其他KO.

微点卫士

微点:
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.953\~TEMP (1).EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\CMDBCS.EXE
2) C:\WINDOWS.0\SYSTEM32\CMDBCS.DLL
是否删除木马程序及其衍生物?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX02.500\~TEMP (1).EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX03.313\~TEMP (1).EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX02.500\~TEMP (2).EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\DATB.TMP
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX03.313\~TEMP (3).EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\RAV012F.EXE
是否删除木马程序及其衍生物?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX07.047\~TEMP (3).EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX07.047\~TEMP (1).EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX07.047\~TEMP (2).EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX07.047\~TEMP (4).EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\IEXPLORER.EXE
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ZXZO0.DLL
是否删除木马程序及其衍生物?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX10.391\~TEMP (3).EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX10.391\~TEMP (4).EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX10.391\~TEMP (1).EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX10.391\~TEMP (2).EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX10.391\~TEMP (5).EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\ZT.EXE
是否删除木马程序及其衍生物?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX13.047\~TEMP (3).EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX13.047\~TEMP (4).EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX13.047\~TEMP (5).EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX13.047\~TEMP (1).EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX13.047\~TEMP (2).EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX13.047\~TEMP (6).EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\UPXDND.EXE
2) C:\WINDOWS.0\SYSTEM32\UPXDND.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX17.485\~TEMP (7).EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\WINDHCP.OCX
是否删除木马程序及其衍生物?

微点通杀

风雪

1185115094,2007-7-22 22:38:14,Heuri.ERNM,启发式扫描,mygood,D:\3\新建文件夹\新建文件夹\新建文件夹\~temp (8).rar>>~temp (3).exe,Manual scan
1185115094,2007-7-22 22:38:14,Backdoor.Huigezi.2007.tkp.kltj,后门,mygood,D:\3\新建文件夹\新建文件夹\新建文件夹\~temp (8).rar>>~temp (5).exe,Manual scan
1185115094,2007-7-22 22:38:14,Adware.FunWeb.e.db.dll,广告程序,mygood,D:\3\新建文件夹\新建文件夹\新建文件夹\~temp (8).rar>>~temp (8).DLL,Manual scan
费尔

wangjay1980

Hello,

~temp (2).exek - Trojan.Win32.Small.lv,
~temp (3).exek - Trojan-PSW.Win32.OnLineGames.es,
~temp (4).exek - Trojan-PSW.Win32.OnLineGames.kw,
~temp (5).exek - Trojan-PSW.Win32.OnLineGames.rt,
~temp (6).exek - Trojan-PSW.Win32.OnLineGames.wt,
~temp (7).exek - Trojan-Proxy.Win32.Small.du

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Krylov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: ~temp (8).zip

欠妳緈諨

7只