4只[MD5: DA44A0 A7A3A5 96FF47 F89033]

显示全部楼层 · 发表于 2007-9-18 18:30:55

C:\ABC\avpcq.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\avpms.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\ravgjmon.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\ravztmon.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
4 文件被扫描
(0 压缩档 0 文件)
4 特征码被侦测
0 可疑代码段被发现
耗时: 0:00.032

显示全部楼层 · 发表于 2007-9-18 18:56:33

Begin scan in 'C:\Documents and Settings\dell\桌面\样本.rar'
C:\Documents and Settings\dell\桌面\样本.rar
  [0] Archive type: RAR
  --> avpcq.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> avpms.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> ravgjmon.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineG.TF.1
  --> ravztmon.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineG.TF.1
   [INFO]    The file was successfully wiped!
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-9-18 19:00:02

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.ZhuXian.bp
病毒： Trojan.PSW.Win32.OnlineGames.yrx

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.41.12

显示全部楼层 · 发表于 2007-9-18 19:18:35

avast!都报

显示全部楼层 · 发表于 2007-9-18 21:11:13

D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » ravztmon.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » ravgjmon.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » avpms.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar » RAR » avpcq.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
D:\Documents and Settings\EKINCHENG\桌面\样本.rar - probably a variant of Win32/PSW.OnLineGames.NEP trojan - deleted - quarantined

显示全部楼层 · 发表于 2007-9-18 21:29:58

detected: virus Heur.Trojan.Generic (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/avpcq.exe//PE_Patch//UPack
detected: virus Heur.Trojan.Generic (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/avpms.exe//PE_Patch//UPack
detected: virus Heur.Trojan.Generic (modification) File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/ravgjmon.exe//PE_Patch//UPack
detected: Trojan program Trojan.Win32.Obfuscated.hv File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/ravztmon.exe//PE_Patch//UPack

显示全部楼层 · 发表于 2007-9-18 21:38:45

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 85
Paranoia Database - 5271
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\avpcq.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\avpms.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\ravgjmon.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\ravztmon.exe - Suspicious of Trojan-PSW.OnLineGames.2

4 Files scanned
0 Infected files found
4 Suspicious files found
0 Files cured
0 Files deleted

显示全部楼层 · 发表于 2007-9-18 21:46:09

Scan performed at: 2007-9-18 21:45:44
Scanning Log
NOD32 version 2537 (20070918) NT
Command line: C:\Documents and Settings\Don johnson\桌面\345.rar
Operating memory - is OK

Date: 18.9.2007 Time: 21:45:48
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\345.rar
C:\Documents and Settings\Don johnson\桌面\345.rar ?RAR ?avpcq.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\345.rar ?RAR ?avpms.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\345.rar ?RAR ?ravgjmon.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\345.rar ?RAR ?ravztmon.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
Number of scanned files: 5
Number of threats found: 4
Number of files cleaned: 1
Time of completion: 21:45:49 Total scanning time: 1 sec (00:00:01)

显示全部楼层 · 发表于 2007-9-18 21:46:24

KIS7
已隔离：病毒 Heur.Trojan.Generic (修改) 文件: D:\Downloads\样本.rar/avpcq.exe//PE_Patch//UPack
已隔离：病毒 Heur.Trojan.Generic (修改) 文件: D:\Downloads\样本.rar/avpms.exe//PE_Patch//UPack
已隔离：病毒 Heur.Trojan.Generic (修改) 文件: D:\Downloads\样本.rar/ravgjmon.exe//PE_Patch//UPack
已删除：木马程序 Trojan.Win32.Obfuscated.hv 文件: D:\Downloads\样本.rar/ravztmon.exe//PE_Patch//UPack

显示全部楼层 · 发表于 2007-9-18 22:21:37

[病毒样本] 4只[MD5: DA44A0 A7A3A5 96FF47 F89033]

本帖子中包含更多资源

本帖子中包含更多资源