再来10ge

zane_xzz

[MD5: FB5A9E B43CAF BC1969 CE20FD 37E9F7 278EFA CDB1FB E575EB 2F79AE 254014]

The EQs

发现LZ挺有意思的。。。。先是用 命名，然后依次用桌，面来命名

The EQs

Scan performed at: 2007-9-9 19:32:04
Scanning Log
NOD32 version 2515 (20070909) NT
Command line: C:\Documents and Settings\Don johnson\桌面\面.rar
Operating memory - is OK

Date: 9.9.2007  Time: 19:32:07
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\面.rar
C:\Documents and Settings\Don johnson\桌面\面.rar ?RAR ?my.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\面.rar ?RAR ?qj.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\面.rar ?RAR ?tl.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\面.rar ?RAR ?zt.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\面.rar ?RAR ?zx.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\面.rar ?RAR ?vip.exe - a variant of Win32/AutoRun.K worm
C:\Documents and Settings\Don johnson\桌面\面.rar ?RAR ?gj.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\面.rar ?RAR ?mh.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\面.rar ?RAR ?ms.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
Number of scanned files: 11
Number of threats found: 9
Number of files cleaned: 1
Time of completion: 19:32:10 Total scanning time: 3 sec (00:00:03)

平淡

promised

C:\ABC\面\gj.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\面\mh.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\面\ms.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\面\my.exe
C:\ABC\面\qj.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\面\rx.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\面\tl.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\面\vip.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现
C:\ABC\面\zt.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\面\zx.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现

[ 本帖最后由 promised 于 2007-9-9 19:35 编辑 ]

曲中求

。。。


Begin scan in 'E:\病毒\面.rar'
E:\病毒\面.rar
  [0] Archive type: RAR
  --> my.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> qj.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.cdp
  --> rx.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> tl.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.cel
  --> zt.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> zx.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> vip.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> gj.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> mh.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.bnr.1
  --> ms.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!


End of the scan: 2007年9月9日  19:34
Used time: 00:11 min

The scan has been done completely.

      0 Scanning directories
     12 Files were scanned
      4 viruses and/or unwanted programs were found
      6 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      8 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

微点卫士

微点：
木马名称:Trojan-PSW.Win32.OnLineGames.kgo

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\面\QJ.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.kgv

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\面\TL.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.kjk

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\面\ZT.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.AutoRun.ce

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\面\VIP.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.kjj

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\面\GJ.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\面\MH.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\RAVMHMON.EXE
2) C:\PROGRAM FILES\NETMEETING\RAVMHMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\面\MS.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\RAVMSMON.EXE
2) C:\PROGRAM FILES\NETMEETING\RAVMSMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\面\MY.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\RAVMYMON.EXE
2) C:\PROGRAM FILES\NETMEETING\RAVMYMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\面\RX.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\MSSQL.DLL
2) C:\WINDOWS.0\SYSTEM32\MSSOCK.SYS
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\面\ZX.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\RAVZXMON.EXE
2) C:\PROGRAM FILES\NETMEETING\RAVZXMON.DAT
是否删除木马程序及其衍生物?

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.OnlineGames.ykr
病毒： Trojan.PSW.Win32.ZhuXian.av
病毒： Trojan.PSW.Win32.OnlineGames.yke
病毒： Worm.Win32.Autorun.ff   
病毒： Trojan.PSW.Win32.OnlineGames.ykv
病毒： Trojan.PSW.Win32.OnlineGames.yhr

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.39.62

浪滔天

卡巴 7.0.0.125 高启发
10个

已隔离: 病毒 Heur.Trojan.Generic (变种)        文件: F:\病毒样本\面\zx.exe//PE_Patch//UPack
已隔离: 病毒 Heur.Trojan.Generic (变种)        文件: F:\病毒样本\面\ms.exe//PE_Patch//UPack
已隔离: 病毒 Heur.Trojan.Generic (变种)        文件: F:\病毒样本\面\my.exe
已隔离: 病毒 Heur.Trojan.Generic (变种)        文件: F:\病毒样本\面\gj.exe//PE_Patch//UPack
已删除: 病毒 Virus.Win32.AutoRun.ky        文件: F:\病毒样本\面\vip.exe//NSPack//PE_Patch.MaskPE
已删除: 木马程序 Trojan-PSW.Win32.Agent.qa        文件: F:\病毒样本\面\rx.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.bnr        文件: F:\病毒样本\面\mh.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cdp        文件: F:\病毒样本\面\qj.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cei        文件: F:\病毒样本\面\zt.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cel        文件: F:\病毒样本\面\tl.exe//PE_Patch//UPack

qiqi7300

红伞P版
Begin scan in 'I:\Users\Ricky\Desktop\面.rar'
I:\Users\Ricky\Desktop\面.rar
  [0] Archive type: RAR
  --> my.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> qj.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.cdp
  --> rx.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> tl.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.cel
  --> zt.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> zx.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> vip.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> gj.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> mh.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.bnr.1
  --> ms.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!