14只

promised

[MD5: 2B0A9B 0856D2 3C84B6 84BCB5 D5F715 8AB6DA B31C1A B70A2E 181EDE 3C2926 C51FF1 31047C A98617 BE4730]

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.rar'
C:\Documents and Settings\Administrator\桌面\样本.rar
  [0] Archive type: RAR
  --> rsmyapm.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> kaqhcaz.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> kvdxbis.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.czm
  --> kvmxcis.exe
      [DETECTION] Is the Trojan horse TR/Hijack.12462.B
  --> rarjatl.exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.bak
  --> rsmyasp.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> avwlast.exe
      [DETECTION] Is the Trojan horse TR/Agent.12716.1
  --> avzxbst.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> avwlamn.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.cvy
  --> avzxbmn.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> kaqhczy.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> kvdxbma.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> kvmxcma.dll
      [DETECTION] Is the Trojan horse TR/Hijack.12462.A
  --> rarjapi.dll
      [DETECTION] Is the Trojan horse TR/PSW.Delf.bak.1
      [INFO]      The file was deleted!


End of the scan: 2007年9月18日  18:39
Used time: 00:25 min

The scan has been done completely.

      0 Scanning directories
     16 Files were scanned
      7 viruses and/or unwanted programs were found
      7 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      9 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

英仔

費爾2個~瑞星8個 bd 12個 nod12個 dr.web7個

promised

C:\ABC\样本\avwlamn.dll - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本\avwlast.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\样本\avzxbmn.dll - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本\avzxbst.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\样本\kaqhcaz.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\样本\kaqhczy.dll - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本\kvdxbis.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\样本\kvdxbma.dll - 特征码 'Trojan-Downloader.Agent.YJA' 被发现
C:\ABC\样本\kvmxcis.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\样本\kvmxcma.dll - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本\rarjapi.dll - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本\rarjatl.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\样本\rsmyapm.dll - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本\rsmyasp.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现

        14 文件被扫描
          (0 压缩档 0 文件)
        14 特征码被侦测
        0 可疑代码段被发现
        耗时: 0:00.047

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\样本.rar'
F:\病毒样本\样本.rar
  [0] Archive type: RAR
  --> rsmyapm.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> kaqhcaz.exe
      [DETECTION] Is the Trojan horse TR/PSW.QQPass.bau
  --> kvdxbis.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.czm
  --> kvmxcis.exe
      [DETECTION] Is the Trojan horse TR/Hijack.12462.B
  --> rarjatl.exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.bak
  --> rsmyasp.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> avwlast.exe
      [DETECTION] Is the Trojan horse TR/Agent.12716.1
  --> avzxbst.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> avwlamn.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.cvy
  --> avzxbmn.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> kaqhczy.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> kvdxbma.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> kvmxcma.dll
      [DETECTION] Is the Trojan horse TR/Hijack.12462.A
  --> rarjapi.dll
      [DETECTION] Is the Trojan horse TR/PSW.Delf.bak.1
      [INFO]      The file was deleted!


End of the scan: 2007年9月18日  18:50
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
     16 Files were scanned
      8 viruses and/or unwanted programs were found
      6 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      8 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.OnlineGames.yry
病毒： Trojan.PSW.Win32.XYOnline.id
病毒： Trojan.PSW.Win32.XYOnline.hu
病毒： Trojan.PSW.Win32.OnlineGames.yqi
病毒： Trojan.PSW.Win32.OnlineGames.yph
病毒： Trojan.PSW.Win32.XYOnline.id
病毒： Trojan.PSW.Win32.XYOnline.hu
病毒： Trojan.PSW.Win32.JHOnline.fba

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.41.12

kp2006

avast!报14

浪滔天

卡巴 7.0.0.125 高启发
10个

已删除: 木马程序 Trojan-PSW.Win32.Delf.bak        文件: F:\病毒样本\样本\rarjapi.dll
已删除: 木马程序 Trojan-PSW.Win32.Delf.bak        文件: F:\病毒样本\样本\rarjatl.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cnz        文件: F:\病毒样本\样本\kvmxcma.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cnz        文件: F:\病毒样本\样本\kvmxcis.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cvy        文件: F:\病毒样本\样本\avwlamn.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cvy        文件: F:\病毒样本\样本\avwlast.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.czm        文件: F:\病毒样本\样本\kvdxbis.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.QQPass.bau        文件: F:\病毒样本\样本\kaqhczy.dll
已删除: 木马程序 Trojan-PSW.Win32.QQPass.bau        文件: F:\病毒样本\样本\kaqhcaz.exe//UPack
已删除: 木马程序 Trojan-Spy.Win32.Delf.bbu        文件: F:\病毒样本\样本\kvdxbma.dll

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 85
Paranoia Database - 5271
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\rsmyapm.dll - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\kaqhcaz.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\kvdxbis.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\kvmxcis.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\rarjatl.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\rsmyasp.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\avwlast.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\avzxbst.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\avwlamn.dll - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\avzxbmn.dll - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\kaqhczy.dll - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\kvdxbma.dll - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\kvmxcma.dll - Suspicious of Win32.Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\rarjapi.dll - Suspicious of Win32.Trojan-PSW.OnLineGames.3

14 Files scanned
0 Infected files found
14 Suspicious files found
0 Files cured
0 Files deleted

The EQs

Scan performed at: 2007-9-18 21:48:15
Scanning Log
NOD32 version 2537 (20070918) NT
Command line: C:\Documents and Settings\Don johnson\桌面\2.rar
Operating memory - is OK

Date: 18.9.2007  Time: 21:48:19
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\2.rar
C:\Documents and Settings\Don johnson\桌面\2.rar ?RAR ?rsmyapm.dll - probably a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\2.rar ?RAR ?kaqhcaz.exe - a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\2.rar ?RAR ?kvdxbis.exe - a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\2.rar ?RAR ?kvmxcis.exe - probably a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\2.rar ?RAR ?rarjatl.exe - probably a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\2.rar ?RAR ?rsmyasp.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\2.rar ?RAR ?avwlast.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\2.rar ?RAR ?avzxbst.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\2.rar ?RAR ?kaqhczy.dll - a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\2.rar ?RAR ?kvdxbma.dll - a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\2.rar ?RAR ?kvmxcma.dll - probably a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\2.rar ?RAR ?rarjapi.dll - probably a variant of Win32/PSW.OnLineGames.NEN trojan
Number of scanned files: 15
Number of threats found: 12
Number of files cleaned: 1
Time of completion: 21:48:21 Total scanning time: 2 sec (00:00:02)