再来4个[MD5: EC09D7 06D9E3 C6E2D4 086F10]

promised

[MD5: EC09D7 06D9E3 C6E2D4 086F10]

The EQs

Scan performed at: 2007-9-9 20:23:52
Scanning Log
NOD32 version 2515 (20070909) NT
Command line: C:\Documents and Settings\Don johnson\桌面\样本1.rar
Operating memory - is OK

Date: 9.9.2007  Time: 20:23:56
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\样本1.rar
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?F3ABADFC4883.dll - Win32/PSW.OnLineGames.NEF trojan - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?svchost.exe - Win32/PSW.OnLineGames.NEF trojan - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?retadpu403.exe - a variant of Win32/TrojanDownloader.Agent.BLS trojan
C:\Documents and Settings\Don johnson\桌面\样本1.rar ?RAR ?cn.exe - a variant of Win32/TrojanDownloader.Delf.BHO trojan
Number of scanned files: 5
Number of threats found: 4
Number of files cleaned: 1
Time of completion: 20:23:56 Total scanning time: 0 sec (00:00:00)

Killer_cg

直接拦截，小A

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Win32.Agent.weh

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.39.62

xjw_1990

卡巴4个～

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 4078
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\F3ABADFC4883.dll - Suspicious of Win32.Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder\svchost.exe - Suspicious of Win32.Trojan-PSW.Game.16
C:\Documents and Settings\uhthn\Desktop\New Folder\retadpu403.exe - Infected with PDB-96 Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\cn.exe - Suspicious of Trojan-PSW.Game.2

4 Files scanned
1 Infected files found
3 Suspicious files found
0 Files cured
1 Files deleted

king6808

检测到：木马程序 Trojan-PSW.Win32.OnLineGames.dr        URL: http://bbs.kafan.cn/attachment.p ... ABADFC4883.dll//UPX
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.dr        URL: http://bbs.kafan.cn/attachment.p ... ecBundle//PECompact
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.dr        URL: http://bbs.kafan.cn/attachment.p ... //PECompact//#//UPX
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.dr        URL: http://bbs.kafan.cn/attachment.p ... undle//PECompact//#
检测到：木马程序 Trojan-Downloader.Win32.Agent.bls        URL: http://bbs.kafan.cn/attachment.p ... //PE_Patch.UPX//UPX
检测到：木马程序 Trojan-Downloader.Win32.Delf.bnb        URL: http://bbs.kafan.cn/attachment.php?aid=125751//cn.exe//FSG
检测到：木马程序 Trojan-Downloader.Win32.Delf.bnb        URL: http://bbs.kafan.cn/attachment.php?aid=125751//cn.exe//FSG//#

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\样本1.rar'
C:\Documents and Settings\Administrator\My Documents\
  样本1.rar
    [0] Archive type: RAR
    --> F3ABADFC4883.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.DR.187
        [WARNING]   Infected files in archives cannot be repaired!
    --> svchost.exe
        [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> retadpu403.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> cn.exe
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

微点卫士

微点：
木马名称:Trojan-PSW.Win32.OnLineGames.hrx

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SVCHOST.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\CN.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\SERNVET.EXE
是否删除木马程序及其衍生物?

上报retadpu403.exe