28个（MD5略）

wangjay1980

如题

The EQs

Scan performed at: 2007-9-26 17:03:49
Scanning Log
NOD32 version 2550 (20070925) NT
Command line: C:\Documents and Settings\Don johnson\桌面\28.rar
Operating memory - is OK

Date: 26.9.2007  Time: 17:03:53
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\28.rar
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?qq.exe - probably a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?zhuxian.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?1(1)(3).exe - a variant of Win32/PSW.Agent.NEC trojan
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?1(3).exe - a variant of Win32/PSW.Agent.NEC trojan
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?01mh.exe - probably a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?3(2)(1).exe - a variant of Win32/PSW.Agent.NEC trojan
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?7.exe - a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?8(1).exe - a variant of Win32/TrojanDownloader.Delf.BHO trojan
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?10(1)(1).exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?103.exe - probably a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?1630.exe - a variant of Win32/PSW.Agent.NEC trojan
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?a3.exe - a variant of Win32/PSW.Agent.NEC trojan
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?a6.exe - probably a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?a8.exe - probably a variant of Win32/PSW.OnLineGames.NEP trojan
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?a20.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?menghuan.exe - probably a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?mh.exe - probably a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?mminstall.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?moon.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\28.rar ?RAR ?potian.exe - probably a variant of Win32/Genetik trojan
Number of scanned files: 29
Number of threats found: 20
Number of files cleaned: 1
Time of completion: 17:03:58 Total scanning time: 5 sec (00:00:05)

Notes:
[7] File is probably infected with an unknown virus.

caocao

KIS7  发现25个
已删除：病毒 Worm.Win32.QQPass.u        文件: D:\Downloads\28.rar/qq.exe//UPX
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpd        文件: D:\Downloads\28.rar/zhuxian.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpc        文件: D:\Downloads\28.rar/1(1)(3).exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpc        文件: D:\Downloads\28.rar/1(3).exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpb        文件: D:\Downloads\28.rar/01mh.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.doy        文件: D:\Downloads\28.rar/3(2)(1).exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpk        文件: D:\Downloads\28.rar/3.exe//PE_Patch//UPack//#
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpb        文件: D:\Downloads\28.rar/7.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpf        文件: D:\Downloads\28.rar/8(1).exe//NSPack//PE_Patch.MaskPE
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpd        文件: D:\Downloads\28.rar/10(1)(1).exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dmz        文件: D:\Downloads\28.rar/10my.exe//PE_Patch//UPack//#
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpb        文件: D:\Downloads\28.rar/103.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpk        文件: D:\Downloads\28.rar/163g.exe//PE_Patch//UPack//#
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpe        文件: D:\Downloads\28.rar/1630.exe
已删除：木马程序 Trojan.Win32.StartPage.baf        文件: D:\Downloads\28.rar/a1.exe//FSG//PEPatch
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dmz        文件: D:\Downloads\28.rar/a2.exe//PE_Patch//UPack//#
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpg        文件: D:\Downloads\28.rar/a3.exe
已删除：病毒 Worm.Win32.QQPass.u        文件: D:\Downloads\28.rar/a6.exe//UPX
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dph        文件: D:\Downloads\28.rar/a8.exe//PE_Patch//UPack
已删除：木马程序 Backdoor.Win32.Delf.bvj        文件: D:\Downloads\28.rar/a20.exe//FSG//PEPatch
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpb        文件: D:\Downloads\28.rar/menghuan.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpb        文件: D:\Downloads\28.rar/mh.exe//UPack
已删除：木马程序 Trojan-Downloader.Win32.Hmir.ae        文件: D:\Downloads\28.rar/mminstall.exe
已删除：木马程序 Trojan-Downloader.Win32.Agent.doy        文件: D:\Downloads\28.rar/moon.exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpi        文件: D:\Downloads\28.rar/potian.exe//UPack

啊弥陀佛

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\28\01MH.EXE
1) C:\DFD29194390.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\28\1(3).EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\LYLOADER.EXE
2) C:\WINDOWS\SYSTEM32\MSDEG32.DLL
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYLOADER.EXE
4) C:\WINDOWS\SYSTEM32\LYLOADER.EXE
是否删除木马程序及其衍生物?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\28\3.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\MSAVP.DLL
是否删除木马程序及其衍生物?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\28\7.EXE
1) C:\DFD29279859.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\28\10MY.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\MSRAV.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\28\1630.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYLOADER.EXE
2) C:\WINDOWS\SYSTEM32\LYLOADER.EXE
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\MSDEG32.DLL
4) C:\WINDOWS\SYSTEM32\MSDEG32.DLL
是否删除木马程序及其衍生物?



程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\28\163G.EXE
是否删除木马程序及其衍生物?




除了这张静态的图片go368.gif,其他都砍

欠妳緈諨

rasis

28.rar
  [0] Archive type: RAR
  --> qq.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> zhuxian.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 1(1)(3).exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 1(3).exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 01mh.exe
      [DETECTION] Is the Trojan horse TR/Spy.Banker.SB.10
  --> 3(2)(1).exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 3.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> 7.exe
      [DETECTION] Is the Trojan horse TR/Banbra.DPY
  --> 8(1).exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 10(1)(1).exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 10my.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> 103.exe
      [DETECTION] Is the Trojan horse TR/Spy.Banker.SB.10
  --> 163g.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> 1630.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> a1.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> a2.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> a3.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> a6.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> a8.exe
      [DETECTION] Is the Trojan horse TR/PSW.Onlineg.TF.1
  --> a20.exe
      [DETECTION] Is the Trojan horse TR/Proxy.Delf.CA
  --> menghuan.exe
      [DETECTION] Is the Trojan horse TR/Spy.Banker.SB.10
  --> mh.exe
      [DETECTION] Is the Trojan horse TR/Spy.Banker.SB.10
  --> moon.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> potian.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!


End of the scan: 2007年9月26日  17:51
Used time: 00:02 min

The scan has been done completely.

      0 Scanning directories
     29 Files were scanned
     20 viruses and/or unwanted programs were found
      4 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      9 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

[ 本帖最后由 rasis 于 2007-9-26 17:51 编辑 ]

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 254
Paranoia Database - 5836
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\qq.exe - Infected with SDB:Win32.Trojan-PSW.QQPass.a - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\zhuxian.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\go368.gif - OK
C:\Documents and Settings\uhthn\Desktop\New Folder\usa.vbs - OK
C:\Documents and Settings\uhthn\Desktop\New Folder\1(1)(3).exe - Infected with SDB:Trojan-PSW.OnLineGames.u - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\1(3).exe - Infected with SDB:Trojan-PSW.OnLineGames.u - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\01mh.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\3(2)(1).exe - Infected with SDB:Trojan-PSW.OnLineGames.u - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\3.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\7.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\8(1).exe - Infected with SDB:MalwareSpy.Win32.Trojan-Downloader.Agent.3 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\10(1)(1).exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\10my.exe - Infected with SDB:Trojan-Spy.Delf.2 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\103.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\163g.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\1630.exe - Infected with SDB:Trojan-PSW.OnLineGames.u - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\a1.exe - Suspicious of Trojan-PSW.Game.2
C:\Documents and Settings\uhthn\Desktop\New Folder\a2.exe - Infected with SDB:Trojan-Spy.Delf.2 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\a3.exe - Infected with SDB:Trojan-PSW.OnLineGames.u - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\a6.exe - Infected with SDB:Win32.Trojan-PSW.QQPass.a - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\a8.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\a20.exe - Suspicious of Trojan-PSW.Game.2
C:\Documents and Settings\uhthn\Desktop\New Folder\installer.exe - Suspicious file
C:\Documents and Settings\uhthn\Desktop\New Folder\menghuan.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\mh.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\mminstall.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder\moon.exe - Infected with SDB:MalwareSpy.Trojan-Downloader.Agent.3 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\potian.exe - Suspicious of Trojan-PSW.Game.3

28 Files scanned
11 Infected files found
15 Suspicious files found
0 Files cured
11 Files deleted

king6808

已删除：病毒 Worm.Win32.QQPass.u        文件: F:\9.26\28.rar/qq.exe//UPX
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpd        文件: F:\9.26\28.rar/zhuxian.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpc        文件: F:\9.26\28.rar/1(1)(3).exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpc        文件: F:\9.26\28.rar/1(3).exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpb        文件: F:\9.26\28.rar/01mh.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.doy        文件: F:\9.26\28.rar/3(2)(1).exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpk        文件: F:\9.26\28.rar/3.exe//PE_Patch//UPack//#
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpb        文件: F:\9.26\28.rar/7.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpf        文件: F:\9.26\28.rar/8(1).exe//NSPack//PE_Patch.MaskPE
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpd        文件: F:\9.26\28.rar/10(1)(1).exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dmz        文件: F:\9.26\28.rar/10my.exe//PE_Patch//UPack//#
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpb        文件: F:\9.26\28.rar/103.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpk        文件: F:\9.26\28.rar/163g.exe//PE_Patch//UPack//#
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpe        文件: F:\9.26\28.rar/1630.exe
已删除：木马程序 Trojan.Win32.StartPage.baf        文件: F:\9.26\28.rar/a1.exe//FSG//PEPatch
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dmz        文件: F:\9.26\28.rar/a2.exe//PE_Patch//UPack//#
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpg        文件: F:\9.26\28.rar/a3.exe
已删除：病毒 Worm.Win32.QQPass.u        文件: F:\9.26\28.rar/a6.exe//UPX
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dph        文件: F:\9.26\28.rar/a8.exe//PE_Patch//UPack
已删除：木马程序 Backdoor.Win32.Delf.bvj        文件: F:\9.26\28.rar/a20.exe//FSG//PEPatch
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpb        文件: F:\9.26\28.rar/menghuan.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dpb        文件: F:\9.26\28.rar/mh.exe//UPack

平淡

kp2006

江民杀毒软件报告文件

        北京江民新科技术有限公司

        扫描引擎 11.00.702
        病毒库日期 2007-09-26
        更新日期 2007-09-26

扫描目标 D:\Documents and Settings\Administrator\桌面\28.rar

开始时间 2007-09-26 19:40:31

在 D:\Documents and Settings\Administrator\桌面\28.rar->1(1)(3).exe 中发现 Trojan/PSW.OnLineGames.gyf 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->1(3).exe 中发现 Trojan/PSW.OnLineGames.gyf 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->01mh.exe 中发现 TrojanDropper.Agent.dkk 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->3(2)(1).exe 中发现 Trojan/PSW.OnLineGames.gyf 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->3.exe 中发现 TrojanDownloader.Adload.lp 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->7.exe 中发现 TrojanDropper.Agent.dkk 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->8(1).exe 中发现 TrojanDownloader.Agent.ori 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->10my.exe 中发现 TrojanDownloader.Adload.lp 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->103.exe 中发现 TrojanDropper.Agent.dkk 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->163g.exe 中发现 TrojanDownloader.Adload.lp 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->1630.exe 中发现 Trojan/PSW.OnLineGames.gyf 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->a2.exe 中发现 TrojanDownloader.Adload.lp 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->a3.exe 中发现 Trojan/PSW.OnLineGames.gyf 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->a20.exe 中发现 Backdoor/Agent.mje 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->menghuan.exe 中发现 TrojanDropper.Agent.dkk 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->mh.exe 中发现 TrojanDropper.Agent.dkk 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->moon.exe 中发现 Backdoor/Agent.absr 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\28.rar->potian.exe 中发现 TrojanDropper.Agent.dkk 病毒, 已删除
正常结束。

扫描结果:
                 文件数 :513                                 病毒体 :18        
                   删除 :18                                    解毒 :0         
    扫描速度(千字节/秒) :4098                              扫描时间 :00:00:31
    扫描文件速度(个/秒) :16

其余有6个被kv2008威胁性参考分析功能标有来历不能判断图标

[ 本帖最后由 kp2006 于 2007-9-26 19:51 编辑 ]