产物更新第三波14个

promised

[MD5: 53346C 5E3C51 D93128 C2B4CF 281A2F B30EEB E2BB8A AB0EAF 2D726C 6528AC 8626F4 0895FD 3DFCFF A8EAB5]

电影结束了

对象: 1.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\样本1.rar
        Status: 已发现病毒
        病毒: Dropped:Generic.PWS.Games.3.8CFCDB05 (BD 引擎)
对象: 2.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\样本1.rar
        Status: 已发现病毒
        病毒: DeepScan:Generic.PWS.Games.1.8F7AD8CA (BD 引擎)
对象: 3.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\样本1.rar
        Status: 已发现病毒
        病毒: Generic.PWS.Games.4.DABF96CE (BD 引擎)
对象: 6.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\样本1.rar
        Status: 已发现病毒
        病毒: Generic.PWS.Games.4.EE038E92 (BD 引擎)
对象: 7.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\样本1.rar
        Status: 已发现病毒
        病毒: Generic.PWStealer.77D1A7EA (BD 引擎)
对象: 8.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\样本1.rar
        Status: 已发现病毒
        病毒: Generic.PWS.Games.4.2EF422B5 (BD 引擎)
对象: 10.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\样本1.rar
        Status: 已发现病毒
        病毒: Generic.PWS.Games.4.C1095710 (BD 引擎)
对象: 11.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\样本1.rar
        Status: 已发现病毒
        病毒: Generic.PWStealer.C0407CE2 (BD 引擎)
对象: 12.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\样本1.rar
        Status: 已发现病毒
        病毒: Generic.Onlinegames.1.CE1F97AC (BD 引擎)
对象: 14.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\样本1.rar
        Status: 已发现病毒
        病毒: Trojan.PWS.Delf.MO (BD 引擎)
对象: 15.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\样本1.rar
        Status: 已发现病毒
        病毒: Generic.PWStealer.A8444151 (BD 引擎)
对象: 19.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\样本1.rar
        Status: 已发现病毒
        病毒: Generic.Onlinegames9.1C78D5ED (BD 引擎)
对象: 20.exe
        在压缩档案里: C:\Documents and Settings\wangcheng\桌面\样本1.rar
        Status: 已发现病毒
        病毒: Backdoor.Agent.YUU (BD 引擎)

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\样本1.rar'
F:\病毒样本\样本1.rar
  [0] Archive type: RAR
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLine.agb.2
  --> 2.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ako
  --> 3.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.YF
  --> 6.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 7.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agen.26778.A
  --> 8.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.YF
  --> 10.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.YF
  --> 11.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agen.26778.A
  --> 12.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.YF
  --> 14.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> 15.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agen.26778.A
  --> 16.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> 19.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
  --> 20.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.alh.32 Backdoor server programs
      [INFO]      The file was deleted!

风野胤

Scanning Log
NOD32 version 2486 (20070827) NT
Command line: R:\??1.rar
Checking CRC of NOD32.EXE: Status OK
Scanning memory: Not performed (option disabled)
Error occurred while scanning MBR sector of the 2.  ?
?physical disk. Error reading sector.
Date: 28.8.2007  Time: 08:22:23
Anti-Stealth technology is enabled.
Scanned disks, folders and files: R:\??1.rar
R:\??1.rar ?RAR ?1.exe - a variant of Win32/PSW.Agent.NEC  ?
?trojan
R:\??1.rar ?RAR ?2.exe - probably a variant of Win32/PSW. ?
?OnLineGames.YA trojan
R:\??1.rar ?RAR ?3.exe - a variant of Win32/PSW. ?
?OnLineGames.YA trojan
R:\??1.rar ?RAR ?6.exe - a variant of Win32/PSW. ?
?OnLineGames.YA trojan
R:\??1.rar ?RAR ?7.exe - probably unknown NewHeur_PE  ?
?virus [7]
R:\??1.rar ?RAR ?8.exe - a variant of Win32/PSW. ?
?OnLineGames.YA trojan
R:\??1.rar ?RAR ?10.exe - a variant of Win32/PSW. ?
?OnLineGames.YA trojan
R:\??1.rar ?RAR ?11.exe - probably unknown NewHeur_PE  ?
?virus [7]
R:\??1.rar ?RAR ?12.exe - a variant of Win32/PSW. ?
?OnLineGames.YA trojan
R:\??1.rar ?RAR ?14.exe - a variant of Win32/AutoRun.Q worm
R:\??1.rar ?RAR ?15.exe - probably unknown NewHeur_PE  ?
?virus [7]
R:\??1.rar ?RAR ?16.exe - probably unknown NewHeur_PE  ?
?virus [7]
R:\??1.rar ?RAR ?19.exe - a variant of Win32/PSW. ?
?Legendmir.NEP trojan
R:\??1.rar ?RAR ?20.exe - Win32/Agent.NEM trojan
Number of scanned files: 14
Number of threats found: 14
Time of completion: 08:22:27 Total scanning time: 4 sec  ?
?(00:00:04)
Notes:
[7] File is probably infected with an unknown virus.

wangjay1980

detected: Trojan program Trojan-PSW.Win32.OnLineGames.aih        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/1.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.ako        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/2.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.arh        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/3.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-PSW.Win32.OnLineGames.arj        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/6.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-Spy.Win32.Delf.yj        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/7.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.arl        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/8.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-PSW.Win32.OnLineGames.aqw        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/10.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-PSW.Win32.OnLineGames.akc        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/11.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.akm        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/12.exe//PE_Patch.UPX//UPX
detected: virus Virus.Win32.AutoRun.ix        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/14.exe//UPX
detected: Trojan program Trojan-Spy.Win32.Delf.xb        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/15.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.akj        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/19.exe//PE_Patch//UPack
detected: Trojan program Backdoor.Win32.Agent.alh        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/20.exe//UPack

ssy275

Result: 13 malware found
Trojan-PSW.Win32.OnLineGames.aih (virus)
C:\Documents and Settings\ssy\×ÀÃæ\1.rar\1.exe
Trojan-PSW.Win32.OnLineGames.ako (virus)
C:\Documents and Settings\ssy\×ÀÃæ\1.rar\2.exe
Trojan-PSW.Win32.OnLineGames.arh (virus)
C:\Documents and Settings\ssy\×ÀÃæ\1.rar\3.exe
Trojan-PSW.Win32.OnLineGames.arj (virus)
C:\Documents and Settings\ssy\×ÀÃæ\1.rar\6.exe
Trojan-Spy.Win32.Delf.yj (virus)
C:\Documents and Settings\ssy\×ÀÃæ\1.rar\7.exe
Trojan-PSW.Win32.OnLineGames.arl (virus)
C:\Documents and Settings\ssy\×ÀÃæ\1.rar\8.exe
Trojan-PSW.Win32.OnLineGames.aqw (virus)
C:\Documents and Settings\ssy\×ÀÃæ\1.rar\10.exe
Trojan-PSW.Win32.OnLineGames.akc (virus)
C:\Documents and Settings\ssy\×ÀÃæ\1.rar\11.exe
Trojan-PSW.Win32.OnLineGames.akm (virus)
C:\Documents and Settings\ssy\×ÀÃæ\1.rar\12.exe
Virus.Win32.AutoRun.ix (virus)
C:\Documents and Settings\ssy\×ÀÃæ\1.rar\14.exe
Trojan-Spy.Win32.Delf.xb (virus)
C:\Documents and Settings\ssy\×ÀÃæ\1.rar\15.exe
Trojan-PSW.Win32.OnLineGames.akj (virus)
C:\Documents and Settings\ssy\×ÀÃæ\1.rar\19.exe
Backdoor.Win32.Agent.alh (virus)
C:\Documents and Settings\ssy\×ÀÃæ\1.rar\20.exe

FBAV

为PC护航风暴微塔
_____________________________________________
                                          
             风暴微塔反间谋
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]              
                            [内测版]      
                   http://www.v0day.com/  
----------------------------------------------
开始扫描……


正在检查启动……
[C:\Documents and Settings\Administrator\桌面\virus\样本1\7.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\样本1\7.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\样本1\11.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\样本1\11.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\样本1\14.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\样本1\15.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\样本1\15.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\样本1\19.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
[C:\Documents and Settings\Administrator\桌面\virus\样本1\20.exe]
                    …………特征码引擎[1]发现病毒
[C:\Documents and Settings\Administrator\桌面\virus\样本1\20.exe]
                    …………引擎[2]发现病毒:Win32.Unknow
文件数:14   病毒数:10  比重:0.7142857142857
OK  扫描完毕！

soul20010

C:\Documents and Settings\Administrator\桌面\样本1.rar » RAR » 20.exe - Win32/Agent.NEM trojan
C:\Documents and Settings\Administrator\桌面\样本1.rar » RAR » 19.exe - a variant of Win32/PSW.Legendmir.NEP trojan
C:\Documents and Settings\Administrator\桌面\样本1.rar » RAR » 16.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\Administrator\桌面\样本1.rar » RAR » 15.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\Administrator\桌面\样本1.rar » RAR » 14.exe - a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\Administrator\桌面\样本1.rar » RAR » 12.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Administrator\桌面\样本1.rar » RAR » 11.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\Administrator\桌面\样本1.rar » RAR » 10.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Administrator\桌面\样本1.rar » RAR » 8.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Administrator\桌面\样本1.rar » RAR » 7.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\Administrator\桌面\样本1.rar » RAR » 6.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Administrator\桌面\样本1.rar » RAR » 3.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Administrator\桌面\样本1.rar » RAR » 2.exe - probably a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Administrator\桌面\样本1.rar » RAR » 1.exe - a variant of Win32/PSW.Agent.NEC trojan

微点卫士

微点：
木马名称:Trojan-PSW.Win32.OnLineGames.jdx

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\1.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.jbn

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\2.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.jcy

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\8.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.jcg

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\11.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.Agent.dew

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\20.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\3.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\DISKMAN32.EXE
2) C:\WINDOWS.0\SYSTEM32\DISKMAN32.DLL
是否删除木马程序及其衍生物?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\3.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\6.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\CMDBCS.EXE
2) C:\WINDOWS.0\SYSTEM32\CMDBCS.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\7.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\KULIONZX.EXE
2) C:\WINDOWS.0\KULIONZX.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\10.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\AVPSRV.EXE
2) C:\WINDOWS.0\SYSTEM32\AVPSRV.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\12.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\MSIMMS32.EXE
2) C:\WINDOWS.0\SYSTEM32\MSIMMS32.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\14.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSWIN64.JMP
2) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\WINSYS64.SYS
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\15.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\WINWM.EXE
2) C:\WINDOWS.0\KULIONWM.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本1\16.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\215366WO.DLL
2) C:\WINDOWS.0\IG.EXE
是否删除木马程序及其衍生物?


19挂了，上报，怎么运行后消失了

uhthn2002

C:\Documents and Settings\uhthn\Desktop\virus\1.exe : infected Trojan-PSW.Win32.OnLineGames.aih
C:\Documents and Settings\uhthn\Desktop\virus\2.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\virus\3.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\virus\6.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\virus\7.exe : infected MalwareScope.Trojan-PSW.Game.17
C:\Documents and Settings\uhthn\Desktop\virus\8.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\virus\10.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\virus\11.exe : infected MalwareScope.Trojan-PSW.Game.17
C:\Documents and Settings\uhthn\Desktop\virus\12.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\virus\14.exe : infected MalwareScope.Trojan-PSW.Game.7
C:\Documents and Settings\uhthn\Desktop\virus\15.exe : infected MalwareScope.Trojan-PSW.Game.17
C:\Documents and Settings\uhthn\Desktop\virus\16.exe : infected MalwareScope.Trojan-PSW.Game.16
C:\Documents and Settings\uhthn\Desktop\virus\19.exe : infected Trojan-PSW.Win32.OnLineGames.akj
C:\Documents and Settings\uhthn\Desktop\virus\20.exe : infected Trojan.Arpspoof


Directories       : 0       Files in archives:      Files on disks:
Archives:                   - total       : 0       - total       : 14   
- scanned         : 0       -  scanned    : 0       - scanned     : 14   
- contain viruses : 0       -  infected   : 0       - infected    : 14   
- deleted         : 0       -  suspicious : 0       - suspicious  : 0     


Uhthn Anti-Spyware V3 Alpha

C:\Documents and Settings\uhthn\Desktop\virus\1.exe - Suspicious of Trojan-PSW.Win32.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\virus\2.exe - Suspicious of Trojan-PSW.Win32.OnLineGames.1
C:\Documents and Settings\uhthn\Desktop\virus\3.exe - Suspicious of Trojan-Downloader.Win32.Small.2
C:\Documents and Settings\uhthn\Desktop\virus\6.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\virus\7.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\virus\8.exe - Suspicious of Trojan-Downloader.Win32.Small.2
C:\Documents and Settings\uhthn\Desktop\virus\10.exe - Suspicious of Trojan-Downloader.Win32.Small.2
C:\Documents and Settings\uhthn\Desktop\virus\11.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\virus\12.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\virus\14.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\virus\15.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\virus\16.exe - Suspicious of Trojan-PSW.Game.8
C:\Documents and Settings\uhthn\Desktop\virus\19.exe - Suspicious of Trojan-PSW.Win32.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\virus\20.exe - Suspicious of Trojan-PSW.Game.3

14 - scanned
0 - infected
14 - suspicious
0 - cured
0 - deleted