网上抓来11个

zane_xzz

[MD5: A17604 60703D DC154B B0062A ED34AE E29166 B84B25 525171 8E1BE4 BD97AA 0B5F51]

1688388728

已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.ben        URL: http://bbs.kafan.cn/attachment.p ... //PE_Patch.UPX//UPX

scottxzt

Begin scan in 'C:\Documents and Settings\dell\桌面\桌面.rar'
C:\Documents and Settings\dell\桌面\桌面.rar
  [0] Archive type: RAR
  --> 7.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.YF
  --> 8.exe
      [DETECTION] Is the Trojan horse TR/Agent.11112
  --> 9.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.acb
  --> 2.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> 3.exe
      [DETECTION] Is the Trojan horse TR/Agent.17971.1
  --> 4.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 5.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.blb
  --> 6.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.ace.1
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 10.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.blb.4
  --> 0.exe
      [DETECTION] Contains signature of the worm WORM/QQPass.A
      [INFO]      The file was successfully wiped!
      [INFO]      The file was deleted!


End of the scan: 2007年9月3日  21:22
Used time: 00:16 min

The scan has been done completely.

      0 Scanning directories
     13 Files were scanned
     11 viruses and/or unwanted programs were found

残缺的唯美

--> 7.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.YF
  --> 8.exe
      [DETECTION] Is the Trojan horse TR/Agent.11112
  --> 9.exe
      [DETECTION] Is the Trojan horse TR/Spy.Delf.acb
  --> 2.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
  --> 3.exe
      [DETECTION] Is the Trojan horse TR/Agent.17971.1
  --> 4.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 5.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.blb
  --> 6.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 10.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.blb.4
  --> 0.exe
      [DETECTION] Contains signature of the worm WORM/QQPass.A
      [INFO]      A backup was created as '470aa1f3.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

promised

C:\ABC\桌面\0.exe - 特征码 'Trojan-PWS.Win32.Delf.mc' 被发现
C:\ABC\桌面\1.exe - 特征码 'MalwareScope.Backdoor.Hupigon.1' 被发现
C:\ABC\桌面\10.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\桌面\2.exe - 特征码 'MalwareScope.Trojan-PWS.Game.16' 被发现
C:\ABC\桌面\3.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\桌面\4.exe - 特征码 'Generic.PWS.Games.1' 被发现
C:\ABC\桌面\5.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\桌面\6.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\桌面\7.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.wp' 被发现
C:\ABC\桌面\8.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\桌面\9.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现

        11 文件被扫描
          (0 压缩档 0 文件)
        11 特征码被侦测
        0 可疑代码段被发现
        耗时: 0:00.141

微点卫士

微点：
木马名称:Trojan-PSW.Win32.OnLineGames.jot

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\7.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan.Win32.StartPage.ada

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.Delf.ewf

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\0.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\215366WO.DLL
2) C:\WINDOWS.0\IG.EXE
是否删除木马程序及其衍生物
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\3.EXE
1) C:\DFD7290281.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\3.EXE
1) C:\DFD7290281.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\4.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\UPXDND.EXE
2) C:\WINDOWS.0\SYSTEM32\UPXDND.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\5.EXE
1) C:\DFD7312968.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\5.EXE
1) C:\DFD7312968.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\6.EXE
1) C:\DFD7324531.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\6.EXE
1) C:\DFD7324531.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\8.EXE
1) C:\DFD7336703.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\8.EXE
1) C:\DFD7336703.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\9.EXE
1) C:\DFD7348015.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\9.EXE
1) C:\DFD7348015.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\10.EXE
1) C:\DFD7359984.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\10.EXE
1) C:\DFD7359984.BAT
是否删除可疑程序?

欠妳緈諨

[ 本帖最后由 欠你幸福 于 2007-9-3 21:26 编辑 ]

wangjay1980

deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ben        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/7.exe//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Spy.Win32.Delf.abi        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/8.exe
deleted: Trojan program Trojan-Spy.Win32.Delf.acb        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/9.exe//UPack
deleted: Trojan program Trojan-Spy.Win32.Delf.abi        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/3.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.bjl        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/4.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.blb        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/5.exe
deleted: Trojan program Trojan-Spy.Win32.Delf.ace        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/6.exe//UPack
deleted: Trojan program Trojan.Win32.StartPage.apw        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/1.exe//PE_Patch
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.blb        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/10.exe
deleted: virus Worm.Win32.QQPass.a        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/0.exe//PE_Patch.UPX//UPX

scottxzt

是用的C版吧

The EQs

Scan performed at: 2007-9-3 22:06:01
Scanning Log
NOD32 version 2499 (20070903) NT
Command line: C:\Documents and Settings\Don johnson\桌面\124.rar
Operating memory - is OK

Date: 3.9.2007  Time: 22:06:05
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\124.rar
C:\Documents and Settings\Don johnson\桌面\124.rar ?RAR ?7.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\124.rar ?RAR ?8.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\124.rar ?RAR ?9.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\124.rar ?RAR ?2.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\Don johnson\桌面\124.rar ?RAR ?3.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\124.rar ?RAR ?4.exe - probably a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\124.rar ?RAR ?5.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\124.rar ?RAR ?6.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\124.rar ?RAR ?10.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\124.rar ?RAR ?0.exe - probably a variant of Win32/PSW.Delf.NHI trojan
Number of scanned files: 12
Number of threats found: 10
Number of files cleaned: 1
Time of completion: 22:06:07 Total scanning time: 2 sec (00:00:02)

Notes:
[7] File is probably infected with an unknown virus.