MD5: 6248E8

显示全部楼层 · 发表于 2007-9-15 13:03:44

Hello,
gleits.dll,
lldtvg.dll,
qvlunu.dll,
towfpp.dll - Trojan-PSW.Win32.OnLineGames.cxi
New malicious software was found in these files. Detection will be included in the next update. Thank you for your help
.
昨天在装微点的机上，找出来的，全让我上报给微点了，这几个卡巴无视。
顺便说一个题外话题，360貌似用MD5加路径来判断是否是病毒

[ 本帖最后由自由于 2007-9-15 13:10 编辑 ]

显示全部楼层 · 发表于 2007-9-15 13:07:50

C:\ABC\2\2\gleits.dll : infected MalwareScope.Trojan-PSW.Game.12
C:\ABC\2\2\lldtvg.dll : infected MalwareScope.Trojan-PSW.Game.12
C:\ABC\2\2\qvlunu.dll : infected MalwareScope.Trojan-PSW.Game.12
C:\ABC\2\2\towfpp.dll : infected MalwareScope.Trojan-PSW.Game.12

显示全部楼层 · 发表于 2007-9-15 13:08:31

Scan performed at: 2007-9-15 13:07:22
Scanning Log
NOD32 version 2531 (20070915) NT
Command line: C:\Documents and Settings\wangcheng\桌面\2.rar
C:\Program Files\Eset\nod32.exe - is OK

Date: 15.9.2007 Time: 13:07:24
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\wangcheng\桌面\2.rar
C:\Documents and Settings\wangcheng\桌面\2.rar ?RAR ?2\gleits.dll - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\wangcheng\桌面\2.rar ?RAR ?2\lldtvg.dll - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\wangcheng\桌面\2.rar ?RAR ?2\qvlunu.dll - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\wangcheng\桌面\2.rar ?RAR ?2\towfpp.dll - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\wangcheng\桌面\2.rar:Zone.Identifier - is OK
Number of scanned files: 6
Number of threats found: 4
Number of active threats: 1
Time of completion: 13:07:27 Total scanning time: 3 sec (00:00:03)

显示全部楼层 · 发表于 2007-9-15 13:18:37

Undet [             ](    ) in D:\download\virusscan\2.rar,(2\gleits.dll)
Undet [             ](    ) in D:\download\virusscan\2.rar,(2\lldtvg.dll)
Undet [             ](    ) in D:\download\virusscan\2.rar,(2\qvlunu.dll)
Undet [             ](    ) in D:\download\virusscan\2.rar,(2\towfpp.dll)
Undet [             ](    ) in D:\download\virusscan\2.rar

显示全部楼层 · 发表于 2007-9-15 13:30:50

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\2.rar'
C:\Documents and Settings\Administrator\My Documents\
  2.rar
[0] Archive type: RAR
--> 2\gleits.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> 2\lldtvg.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> 2\qvlunu.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
--> 2\towfpp.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

End of the scan: 2007年9月14日  22:30
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   5 Files were scanned
   0 viruses and/or unwanted programs were found
   4 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   5 Files not concerned
   1 Archives were scanned
   5 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-9-15 13:35:21

费尔全杀

显示全部楼层 · 发表于 2007-9-15 14:33:54

卡巴斯基互联网安全套装 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=127867 is infected with Trojan-PSW.Win32.OnLineGames.cxi virus

显示全部楼层 · 发表于 2007-9-15 14:45:02

D:\av\2.rar >>RAR >>2\gleits.dll - 可能是 Win32/Genetik 木马的一个变种
D:\av\2.rar >>RAR >>2\lldtvg.dll - 可能是 Win32/Genetik 木马的一个变种
D:\av\2.rar >>RAR >>2\qvlunu.dll - 可能是 Win32/Genetik 木马的一个变种
D:\av\2.rar >>RAR >>2\towfpp.dll - 可能是 Win32/Genetik 木马的一个变种
已扫描的文件数目：4

NOD老是报这个

显示全部楼层 · 发表于 2007-9-15 17:08:57

Virus: Trojan-PSW.Win32.OnLineGames.cxi (4x)

Virus found while downloading Web content.

Address: bbs.kafan.cn

显示全部楼层 · 发表于 2007-9-15 18:56:11

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Paranoia Database - 4948
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\2

C:\Documents and Settings\uhthn\Desktop\2\gleits.dll - Suspicious of Trojan-PSW.OnLineGames.1
C:\Documents and Settings\uhthn\Desktop\2\lldtvg.dll - Suspicious of Trojan-PSW.OnLineGames.1
C:\Documents and Settings\uhthn\Desktop\2\qvlunu.dll - Suspicious of Trojan-PSW.OnLineGames.1
C:\Documents and Settings\uhthn\Desktop\2\towfpp.dll - Suspicious of Trojan-PSW.OnLineGames.1

4 Files scanned
0 Infected files found
4 Suspicious files found
0 Files cured
0 Files deleted

[病毒样本] MD5: 6248E8

本帖子中包含更多资源

本帖子中包含更多资源