[MD5: 401058 A76ACE 8E0329 667924]

qianwenxiang

[MD5: 401058 A76ACE 8E0329 667924]

1688388728

已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.nw        URL: http://bbs.kafan.cn/attachment.php?aid=122138//Dc2.exe//FSG

The EQs

Scan performed at: 2007-9-1 15:00:59
Scanning Log
NOD32 version 2495 (20070901) NT
Command line: C:\Documents and Settings\Don johnson\桌面\0901.rar
Operating memory - is OK

Date: 1.9.2007  Time: 15:01:03
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\0901.rar
C:\Documents and Settings\Don johnson\桌面\0901.rar ?RAR ?Dc8.exe - Win32/Delf.BS worm - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\0901.rar ?RAR ?gywendao_cns_yassist.exe ?NSIS ?cnsmin.dll - probably a variant of Win32/Genetik trojan - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\0901.rar ?RAR ?temp~3 - a variant of Win32/PSW.QQShou trojan
Number of scanned files: 12
Number of threats found: 3
Number of files cleaned: 1
Time of completion: 15:01:16 Total scanning time: 13 sec (00:00:13)

wangjay1980

detected: Trojan program Trojan-PSW.Win32.OnLineGames.nw        File: C:\Documents and Settings\Owner\×ÀÃæ\0901.rar/Dc2.exe//FSG
detected: virus Worm.Win32.Delf.bs        File: C:\Documents and Settings\Owner\×ÀÃæ\0901.rar/Dc8.exe//UPack
detected: Trojan program Trojan-PSW.Win32.QQShou.ej        File: C:\Documents and Settings\Owner\×ÀÃæ\0901.rar/temp~3

还有个雅虎助手

soul20010

C:\Documents and Settings\Administrator\桌面\0901.rar » RAR » temp~3 - a variant of Win32/PSW.QQShou trojan
C:\Documents and Settings\Administrator\桌面\0901.rar » RAR » gywendao_cns_yassist.exe » NSIS » cnsmin.dll - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Administrator\桌面\0901.rar » RAR » Dc8.exe - Win32/Delf.BS worm
C:\Documents and Settings\Administrator\桌面\0901.rar » RAR » Dc2.exe » FSG v2.0 - internal error

微点卫士

微点：
木马名称:Trojan-PSW.Win32.OnLineGames.chi

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DC2.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.Delf.ach

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DC8.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\GYWENDAO_CNS_YASSIST.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:4534
远端地址:60.191.101.146(浙江)
远端端口:80
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\GYWENDAO_CNS_YASSIST.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NSB3E.TMP\WMPNS.DLL
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NSB3E.TMP\SYSTEM.DLL
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NSB3E.TMP\SNPMW.D
LL
4) C:\PROGRAM FILES\3721\CNSM.DLL
是否删除木马程序及其衍生物?

生成的QQ大盗
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP~3.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\FF.EXE
2) C:\WINDOWS.0\SYSTEM32\RAVSETEK.EXE
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TEMP~3
是否删除木马程序及其衍生物?

碧水寒潭

Start of the scan: 2007年9月1日  16:00

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\0901.rar
  [0] Archive type: RAR
  --> Dc2.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW.6
  --> Dc8.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年9月1日  16:01
Used time: 00:09 min

The scan has been done completely.

      1 Scanning directories
      5 Files were scanned
      2 viruses and/or unwanted programs were found
      0 classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

ssy275

Result: 3 malware found
Trojan-PSW.Win32.OnLineGames.nw (virus)
C:\Documents and Settings\ssy\×ÀÃæ\0901.rar\Dc2.exe
Worm.Win32.Delf.bs (virus)
C:\Documents and Settings\ssy\×ÀÃæ\0901.rar\Dc8.exe
Trojan-PSW.Win32.QQShou.ej (virus)
C:\Documents and Settings\ssy\×ÀÃæ\0901.rar\temp~3

欠妳緈諨

yurius

Infostealer.Lemir
病毒 ID: 38500
类型: 已压缩
风险: 高 (高 隐蔽性，高 清除，高 性能，高 隐私)  
类别: 病毒
状态: 删除失败
-----------
1 个文件
[dc2.exe] 位于[c:\virus\0901.rar] - 已感染


Downloader
病毒 ID: 26637
类型: 已压缩
风险: 高 (高 隐蔽性，高 清除，高 性能，高 隐私)  
类别: 病毒
状态: 删除失败
-----------
1 个文件
[dc8.exe] 位于[c:\virus\0901.rar] - 已感染


Trojan.PWS.QQPass
病毒 ID: 28219
类型: 已压缩
风险: 高 (高 隐蔽性，高 清除，高 性能，高 隐私)  
类别: 病毒
状态: 删除失败
-----------
1 个文件
[temp~3] 位于[c:\virus\0901.rar] - 已感染