下载者缴获９个

显示全部楼层 · 发表于 2007-9-14 14:29:46

９个

显示全部楼层 · 发表于 2007-9-14 14:30:46

Starting the file scan:

Begin scan in 'D:\2.rar'
D:\2.rar
  [0] Archive type: RAR
  --> 2.exe
   [DETECTION] Is the Trojan horse TR/Spy.Agent.9463.B
  --> 1.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 3.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.cpy
  --> 4.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 5.exe
   [DETECTION] Is the Trojan horse TR/Agent.12716.1
  --> 6.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 7.exe
   [DETECTION] Is the Trojan horse TR/Agent.12229
  --> 8.exe
   [DETECTION] Is the Trojan horse TR/PSW.Steal.25921
  --> 9.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.cqb
   [WARNING] The file was ignored!

End of the scan: 2007年9月13日  23:02
Used time: 00:08 min

The scan has been done completely.

   0 Scanning directories
   10 Files were scanned
   7 viruses and/or unwanted programs were found
   2 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   1 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-9-14 14:32:17

2007-9-14 14:31:21 1189751481 Administrator 700 Sign of "Win32:Onlinegames-BBH [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\2.rar\2.exe\[Upack]\[Embedded#9060]\[Upack]" file.
2007-9-14 14:31:25 1189751485 Administrator 700 Sign of "Win32:OnLineGames-ST [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\2.rar\1.exe\[Embedded#0c80]\[Upack]\[Embedded#5158]\[Upack]" file.
2007-9-14 14:31:28 1189751488 Administrator 700 Sign of "Win32:OnLineGames-SR [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\2.rar\1.exe" file.
2007-9-14 14:31:30 1189751490 Administrator 700 Sign of "Win32:Delf-FVM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\2.rar\5.exe\[Upack]\[Embedded#MUSIC]" file.
2007-9-14 14:31:32 1189751492 Administrator 700 Sign of "Win32:Onlinegames-AUQ [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\2.rar\6.exe\[Upack]\[Embedded#9060]\[Upack]" file.
2007-9-14 14:31:34 1189751494 Administrator 700 Sign of "Win32:Delf-FFM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\2.rar\8.exe\[Upack]\[Embedded#DOWN]" file.

小A报6个

显示全部楼层 · 发表于 2007-9-14 14:47:53

已经发过了
http://bbs.kafan.cn/viewthread.p ... mp%3Bascdesc%3DDESC

显示全部楼层 · 发表于 2007-9-14 14:47:59

NOD32报8个

扫描进行于：2007-9-14 14:46:31
扫描日志
NOD32版本 2529 (20070913) NT
命令行： C:\Documents and Settings\Administrator\桌面\2.rar

日期： 14.9.2007 时间：14:46:33
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Administrator\桌面\2.rar
C:\Documents and Settings\Administrator\桌面\2.rar >>RAR >>2.exe - 可能是 Win32/PSW.OnLineGames.NEP 木马的一个变种
C:\Documents and Settings\Administrator\桌面\2.rar >>RAR >>1.exe - Win32/PSW.Agent.NEC 木马的变种
C:\Documents and Settings\Administrator\桌面\2.rar >>RAR >>3.exe - 可能是 Win32/PSW.OnLineGames.NEN 木马的一个变种
C:\Documents and Settings\Administrator\桌面\2.rar >>RAR >>5.exe - 可能是 Win32/Genetik 木马的一个变种
C:\Documents and Settings\Administrator\桌面\2.rar >>RAR >>6.exe - 可能是 Win32/PSW.OnLineGames.NEP 木马的一个变种
C:\Documents and Settings\Administrator\桌面\2.rar >>RAR >>7.exe - 可能是 Win32/Genetik 木马的一个变种
C:\Documents and Settings\Administrator\桌面\2.rar >>RAR >>8.exe - 未查明的 NewHeur_PE 病毒 [7]
C:\Documents and Settings\Administrator\桌面\2.rar >>RAR >>9.exe - 可能是 Win32/PSW.OnLineGames.NEP 木马的一个变种
已扫描的文件数目：9
已发现的病毒数目：8
完成时间： 14:46:35 总扫描时间：2 秒 (00:00:02)

注意：
[7] 该文件可能感染上未知病毒。

显示全部楼层 · 发表于 2007-9-14 14:52:15

有几个的吗
我和楼上一样也是NOD32报告8个

显示全部楼层 · 发表于 2007-9-14 14:57:12

trustport 全杀。。重复了？

显示全部楼层 · 发表于 2007-9-14 19:55:56

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 4804
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\tonger2003

C:\Documents and Settings\uhthn\Desktop\tonger2003\2.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\tonger2003\1.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\tonger2003\3.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\tonger2003\4.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\tonger2003\5.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\tonger2003\6.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\tonger2003\7.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\tonger2003\8.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\tonger2003\9.exe - Suspicious of Trojan-PSW.OnLineGames.2

9 Files scanned
0 Infected files found
9 Suspicious files found
0 Files cured
0 Files deleted

显示全部楼层 · 发表于 2007-9-14 20:20:09

微点:
木马名称:Trojan-PSW.Win32.OnLineGames.kqw

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYMANGR.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2\1.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYLOADER.EXE
2) C:\WINDOWS.0\SYSTEM32\LYLOADER.EXE
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYMANGR.DLL
4) C:\WINDOWS.0\SYSTEM32\LYMANGR.DLL
是否删除木马程序及其衍生物?
木马名称:Trojan-PSW.Win32.OnLineGames.kqw

程序:
C:\WINDOWS.0\SYSTEM32\LYMANGR.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2\2.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\AVPMS.EXE
2) C:\PROGRAM FILES\NETMEETING\AVPMS.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2\3.EXE
1) C:\DFD353296.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2\3.EXE
1) C:\DFD353296.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2\4.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\DAT8.TMP
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2\5.EXE
1) C:\DFD382000.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2\5.EXE
1) C:\DFD382000.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2\6.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\RAVWDMON.EXE
2) C:\PROGRAM FILES\NETMEETING\RAVWDMON.DAT
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2\7.EXE
1) C:\DFD401640.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2\7.EXE
1) C:\DFD401640.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2\8.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\KULIONRX.EXE
2) C:\WINDOWS.0\KULIONRX.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2\9.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\NETMEETING\RAVZTMON.EXE
2) C:\PROGRAM FILES\NETMEETING\RAVZTMON.DAT
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2007-9-15 15:59:39

原帖由 绅博周幸 于 2007-9-14 14:29 发表
９个

江民杀毒软件扫描报告文件

北京江民新科技术有限公司

扫描引擎 11.00.702

病毒库日期 2007-09-16

更新日期 2007-09-15

扫描目标 V:\ViRusDoc20070915\034\2.rar

开始时间 2007-09-15 15:57:36

在 V:\ViRusDoc20070915\034\2.rar->1.exe 中发现 Trojan/PSW.OnLineGames.ftu 病毒, 发现病毒

在 V:\ViRusDoc20070915\034\2.rar->3.exe 中发现 Trojan/PSW.GamePass.yuj 病毒, 发现病毒

在 V:\ViRusDoc20070915\034\2.rar->4.exe 中发现 Backdoor/Bifrose.ala 病毒, 发现病毒

在 V:\ViRusDoc20070915\034\2.rar->5.exe 中发现 Trojan/PSW.OnLineGames.fnq 病毒, 发现病毒

在 V:\ViRusDoc20070915\034\2.rar->7.exe 中发现 Trojan/PSW.OnLineGames.flp 病毒, 发现病毒

在 V:\ViRusDoc20070915\034\2.rar->8.exe 中发现 Trojan/PSW.GamePass.xnr 病毒, 发现病毒

正常结束。

扫描结果:

文件数 : 11  病毒体 : 6
删除 : 0  解毒 : 0
扫描速度(Kb/sec) : 278  扫描时间 : 00:00:01
扫描文件速度(个/秒) :11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

下载者缴获９个

本帖子中包含更多资源

本帖子中包含更多资源