一包

solcroft

从http://bbs.kafan.cn/viewthread.php?tid=132214&extra=page%3D1挖来的

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\zx.zip'
C:\Documents and Settings\Administrator\桌面\zx.zip
  [0] Archive type: ZIP
  --> zx.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 2.exe
      [DETECTION] Is the Trojan horse TR/PSW.QQPass.bau
  --> arp.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPI.Gen
  --> cq.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> cqsj.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> dh.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.czm
  --> jh.exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.bak
  --> mh.exe
      [DETECTION] Is the Trojan horse TR/Hijack.12462.B
  --> my.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> qj.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> wl.exe
      [DETECTION] Is the Trojan horse TR/Agent.12716.1
  --> wmgj.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineG.TF.1
  --> wow.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> zt.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineG.TF.1
      [INFO]      The file was deleted!


End of the scan: 2007年9月18日  19:02
Used time: 00:26 min

The scan has been done completely

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.OnlineGames.yry
病毒： Trojan.Win32.ArpCheater.b
病毒： Trojan.PSW.Win32.XYOnline.id
病毒： Trojan.PSW.Win32.XYOnline.hu
病毒： Trojan.PSW.Win32.OnlineGames.yqi
病毒： Trojan.PSW.Win32.ZhuXian.bp
病毒： Trojan.PSW.Win32.OnlineGames.yrx

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.41.12

kp2006

avast!有一个qj.exe没报

globe

bd 8

浪滔天

卡巴 7.0.0.125 高启发
11个

已隔离: 病毒 Heur.Trojan.Generic (变种)        文件: F:\病毒样本\zx\cq.exe//PE_Patch//UPack
已隔离: 病毒 Heur.Trojan.Generic (变种)        文件: F:\病毒样本\zx\wow.exe
已隔离: 病毒 Heur.Trojan.Generic (变种)        文件: F:\病毒样本\zx\wmgj.exe//PE_Patch//UPack
已删除: 木马程序 Backdoor.Win32.Delf.bmo        文件: F:\病毒样本\zx\arp.exe//NSPack
已删除: 木马程序 Trojan-Downloader.Win32.Agent.czk        文件: F:\病毒样本\zx\cqsj.exe//#
已删除: 木马程序 Trojan-PSW.Win32.Delf.bak        文件: F:\病毒样本\zx\jh.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cnz        文件: F:\病毒样本\zx\mh.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.cvy        文件: F:\病毒样本\zx\wl.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.czm        文件: F:\病毒样本\zx\dh.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.QQPass.bau        文件: F:\病毒样本\zx\2.exe//UPack
已删除: 木马程序 Trojan.Win32.Obfuscated.hv        文件: F:\病毒样本\zx\zt.exe//PE_Patch//UPack

promised

C:\ABC\zx\2.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\zx\arp.exe - 特征码 'Win32.SuspectCrc' 被发现
C:\ABC\zx\cq.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\zx\cqsj.exe - 特征码 'Win32.SuspectCrc' 被发现
C:\ABC\zx\dh.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\zx\jh.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\zx\mh.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\zx\my.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\zx\qj.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\zx\wl.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\zx\wmgj.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\zx\wow.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\zx\zt.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\zx\zx.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现

        14 文件被扫描
          (0 压缩档 0 文件)
        14 特征码被侦测
        0 可疑代码段被发现
        耗时: 0:00.063

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 87
Paranoia Database - 5289
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\zx.exe - Infected with PDB:9b3 Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\2.exe - Infected with PDB:b01 Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\arp.exe - Suspicious of MalwareSpy.Win32.Trojan-Downloader.Delf.1
C:\Documents and Settings\uhthn\Desktop\New Folder\cq.exe - Infected with SDB:Trojan-PSW.OnLineGames.wq - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\cqsj.exe - Suspicious of MalwareSpy.Trojan-Downloader.Delf.1
C:\Documents and Settings\uhthn\Desktop\New Folder\dh.exe - Infected with PDB:931 Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\jh.exe - Infected with PDB:bda Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\mh.exe - Infected with PDB:a8f Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\my.exe - Infected with PDB:881 Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\qj.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\wl.exe - Infected with PDB:9b2 Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\wmgj.exe - Infected with SDB:Trojan-PSW.OnLineGames.wq - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\wow.exe - Infected with PDB:3a1 Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\zt.exe - Infected with PDB:9f8 Malware program - Deleted

14 Files scanned
11 Infected files found
3 Suspicious files found
0 Files cured
11 Files deleted

kidaaaa

扫描开始时间: 2007-9-18 21:53:31
扫描日志
NOD32 版本 2537 (20070918) NT
命令行: H:\Download\毒样\zx.zip
D:\Program Files\Eset\nod32.exe<病毒 - 正常>
系统内存<病毒 - >
物理磁盘 1 的 MBR 扇区，<病毒 - 正常>
物理磁盘 1 的活动引导扇区，<病毒 - 正常>

日期: 2007年9月18日  时间: 21:53:44
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: H:\Download\毒样\zx.zip
H:\Download\毒样\zx.zip ?ZIP ?zx.exe<病毒 - 可能是 Win32/Genetik 木马 变种>
H:\Download\毒样\zx.zip ?ZIP ?2.exe<病毒 - Win32/PSW.OnLineGames.NEN 木马 变种>
H:\Download\毒样\zx.zip ?ZIP ?arp.exe<病毒 - Win32/Delf.AWY 木马>
H:\Download\毒样\zx.zip ?ZIP ?cq.exe<病毒 - 可能是 Win32/PSW.OnLineGames.NEP 木马 变种>
H:\Download\毒样\zx.zip ?ZIP ?cqsj.exe<病毒 - 正常>
H:\Download\毒样\zx.zip ?ZIP ?dh.exe<病毒 - Win32/PSW.OnLineGames.NEN 木马 变种>
H:\Download\毒样\zx.zip ?ZIP ?jh.exe<病毒 - 可能是 Win32/PSW.OnLineGames.NEN 木马 变种>
H:\Download\毒样\zx.zip ?ZIP ?mh.exe<病毒 - 可能是 Win32/PSW.OnLineGames.NEN 木马 变种>
H:\Download\毒样\zx.zip ?ZIP ?my.exe<病毒 - 可能是 Win32/Genetik 木马 变种>
H:\Download\毒样\zx.zip ?ZIP ?qj.exe<病毒 - 正常>
H:\Download\毒样\zx.zip ?ZIP ?wl.exe<病毒 - 可能是 Win32/Genetik 木马 变种>
H:\Download\毒样\zx.zip ?ZIP ?wmgj.exe<病毒 - 可能是 Win32/PSW.OnLineGames.NEP 木马 变种>
H:\Download\毒样\zx.zip ?ZIP ?wow.exe<病毒 - 可能是 Win32/PSW.OnLineGames.NEP 木马 变种>
H:\Download\毒样\zx.zip ?ZIP ?zt.exe<病毒 - 可能是 Win32/PSW.OnLineGames.NEP 木马 变种>
H:\Download\毒样\zx.zip:Zone.Identifier<病毒 - 正常>
已扫描文件数量: 15
已发现病毒数量: 12
完成时间: 21:53:53 总共扫描时间: 9 秒 (00:00:09)

The EQs

Scan performed at: 2007-9-18 21:55:26
Scanning Log
NOD32 version 2537 (20070918) NT
Command line: C:\Documents and Settings\Don johnson\桌面\zx.zip
Operating memory - is OK

Date: 18.9.2007  Time: 21:55:30
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\zx.zip
C:\Documents and Settings\Don johnson\桌面\zx.zip ?ZIP ?zx.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\zx.zip ?ZIP ?2.exe - a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\zx.zip ?ZIP ?arp.exe - Win32/Delf.AWY trojan - was a part of the deleted object
C:\Documents and Settings\Don johnson\桌面\zx.zip ?ZIP ?cq.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\zx.zip ?ZIP ?dh.exe - a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\zx.zip ?ZIP ?jh.exe - probably a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\zx.zip ?ZIP ?mh.exe - probably a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\zx.zip ?ZIP ?my.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\zx.zip ?ZIP ?wl.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\zx.zip ?ZIP ?wmgj.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\zx.zip ?ZIP ?wow.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\zx.zip ?ZIP ?zt.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
Number of scanned files: 15
Number of threats found: 12
Number of files cleaned: 1
Time of completion: 21:55:39 Total scanning time: 9 sec (00:00:09)