[MD5: 17BB9D 4B4B46 E370E9 CF8208 702C46 DFB48E]

qianwenxiang

[MD5: 17BB9D 4B4B46 E370E9 CF8208 702C46 DFB48E]

一中毒机器上抢救下来的样本

qianwenxiang

RAVWDMON.DAT, RAVWDMON.exe, RAVZTMON.DAT, RAVZTMON.exe - Trojan-PSW.Win32.OnLineGames.aet

liaoying112

１９．３６．０１过了，上报中

xxwpk007

已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.rt        文件: G:\样本\NVDispDrv\NVDispDrv.exe//PE_Patch.UPX//UPX
已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.rt        文件: G:\样本\NVDispDrv\NVDispDrv.dll

xxwpk007

Starting the file scan:

Begin scan in 'G:\样本\NVDispDrv'
G:\样本\NVDispDrv\
  NVDispDrv.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.YF
      [WARNING]   The file was ignored!
  RAVWDMON.DAT
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!
  RAVWDMON.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [WARNING]   The file was ignored!
  RAVZTMON.DAT
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!
  RAVZTMON.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [WARNING]   The file was ignored!
  NVDispDrv.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!

xxwpk007

[Scan path] G:\样本\NVDispDrv
>G:\样本\NVDispDrv\NVDispDrv.exe infected with Trojan.PWS.Gamania.3287
>G:\样本\NVDispDrv\RAVWDMON.DAT - Ok
>G:\样本\NVDispDrv\RAVWDMON.exe probably infected with BACKDOOR.Trojan
>G:\样本\NVDispDrv\RAVZTMON.DAT - Ok
>G:\样本\NVDispDrv\RAVZTMON.exe probably infected with BACKDOOR.Trojan
G:\样本\NVDispDrv\NVDispDrv.dll - Ok

moonsilver

原帖由 liaoying112 于 2007-8-13 16:29 发表
１９．３６．０１过了，上报中

汗，抢我生意呀

FBAV

为PC护航风暴微塔
_____________________________________________
                                          
             风暴微塔反病毒               
                            [内测版]      
                   http://www.v0day.com/  
----------------------------------------------
开始扫描……


正在检查启动……
[C:\Documents and Settings\Administrator\桌面\virus\NVDispDrv\RAVWDMON.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\NVDispDrv\RAVZTMON.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
文件数:4   病毒数:2  比重:0.5
OK  扫描完毕！

微点卫士

微点：
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\NVDISPDRV.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\NVDISPDRV.EXE
2) C:\WINDOWS.0\SYSTEM32\NVDISPDRV.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\RAVWDMON.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\FONTS\RAVWDMON.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\RAVZTMON.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\FONTS\RAVZTMON.EXE
是否删除木马程序及其衍生物?

还有3个不能运行的

The EQs

Scan performed at: 2007-8-13 16:58:38
Scanning Log
NOD32 version 2455 (20070813) NT
Command line: C:\Documents and Settings\EQ2\桌面\NVDispDrv.rar
Operating memory - is OK

Date: 13.8.2007  Time: 16:58:49
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\NVDispDrv.rar
C:\Documents and Settings\EQ2\桌面\NVDispDrv.rar ?RAR ?NVDispDrv.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\EQ2\桌面\NVDispDrv.rar ?RAR ?RAVWDMON.DAT - a variant of Win32/PSW.OnLineGames.NCU trojan
C:\Documents and Settings\EQ2\桌面\NVDispDrv.rar ?RAR ?RAVWDMON.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\NVDispDrv.rar ?RAR ?RAVZTMON.DAT - a variant of Win32/PSW.OnLineGames.NCU trojan
C:\Documents and Settings\EQ2\桌面\NVDispDrv.rar ?RAR ?RAVZTMON.exe - probably unknown NewHeur_PE virus [7]
Number of scanned files: 7
Number of threats found: 5
Number of files cleaned: 1
Time of completion: 16:58:50 Total scanning time: 1 sec (00:00:01)

Notes:
[7] File is probably infected with an unknown virus.