35个高质【MD5略】

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.OnlineGames.zbo
病毒： Trojan.PSW.Win32.OnlineGames.zao
病毒： Trojan.PSW.Win32.OnlineGames.zbc
病毒： Trojan.PSW.Win32.OnlineGames.zbx

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.42.62

微点卫士

木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\WINDOW.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\10(2)(1).EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\10(2).EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.ofr

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\14.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan.Win32.Genetik.cwe

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\1631.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.ofy

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\1633.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan.Win32.Genetik.cvl

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\MOON.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYMANGR.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\1(1)(3).EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYLOADER.EXE
2) C:\WINDOWS.0\SYSTEM32\LYLOADER.EXE
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYMANGR.DLL
4) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\MSDEG32.DLL
5) C:\WINDOWS.0\SYSTEM32\MSDEG32.DLL
6) C:\WINDOWS.0\SYSTEM32\LYLOADER.EXE
是否删除木马程序及其衍生物?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYLOADER.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\1(4).EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\MSRAV.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\01MH.EXE
1) C:\DFD3086640.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\2(3).EXE
1) C:\DFD3098390.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYMANGR.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.Lmir.cgg

程序:
C:\WINDOWS.0\SYSTEM32\MSAVP.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\3(2)(1).EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYLOADER.EXE
2) C:\WINDOWS.0\SYSTEM32\LYLOADER.EXE
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\MSDEG32.DLL
4) C:\WINDOWS.0\SYSTEM32\MSDEG32.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\3.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\03MS.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\MSRAV.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\5(3).EXE
1) C:\DFD3153046.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\5.EXE
1) C:\DFD3165640.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\8(1).EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\10.EXE
1) C:\DFD3185812.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
木马名称:Trojan-PSW.Win32.Lmir.cgg

程序:
C:\WINDOWS.0\SYSTEM32\MSAVP.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\13CQ.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\16XX.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\MSRAV.DLL
是否删除木马程序及其衍生物?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYMANGR.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\1630.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYLOADER.EXE
2) C:\WINDOWS.0\SYSTEM32\LYLOADER.EXE
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\MSDEG32.DLL
4) C:\WINDOWS.0\SYSTEM32\MSDEG32.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\AD_2311.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\OLNW\YVXG.DLL
2) C:\PROGRAM FILES\OLNW\BYAJ.DLL
3) C:\PROGRAM FILES\OLNW\DACL.DLL
4) C:\PROGRAM FILES\OLNW\GDFO.DLL
5) C:\PROGRAM FILES\OLNW\URTC.DLL
6) C:\~DE27.TMP
是否删除木马程序及其衍生物?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\TEMPS.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\AD_2311.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\MENGHUAN1.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\MSSOCK.SYS
2) C:\WINDOWS.0\SYSTEM32\MSEAM.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\MENGHUAN.EXE
1) C:\DFD3274484.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\MENGHUAN.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\KVMXDMA.DLL
2) C:\WINDOWS.0\SYSTEM32\KVMXDIS.EXE
是否删除木马程序及其衍生物?
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\MMINSTALL.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:4801
远端地址:58.211.7.35(江苏·苏州)
远端端口:80
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\MOYU.EXE
1) C:\DFD3357125.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\MOYU.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\RSMYDPM.DLL
2) C:\WINDOWS.0\SYSTEM32\RSMYDSP.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\MY.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\MYPERN0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\TEMPA.EXE
1) C:\DFD3392171.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\INTELX86.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\INTELX86.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\TEMPO.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\MSAVP.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\TEMPA.EXE
1) C:\DFD3433750.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\TEMPA.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\KVMXDMA.DLL
2) C:\WINDOWS.0\SYSTEM32\KVMXDIS.EXE
是否删除木马程序及其衍生物?
程序:
C:\WINDOWS.0\SYSTEM32\DRIVERS\ACPIDISK.SYS
是否删除RootKit程序?
程序:
C:\WINDOWS.0\SYSTEM32\WINLIB .DLL
是否删除木马程序及其衍生物?
木马名称:Trojan-PSW.Win32.Lmir.cgg

程序:
C:\WINDOWS.0\SYSTEM32\MSAVP.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\35\TEMPP.EXE
是否删除木马程序及其衍生物?

mminstall.exe挂了，如果瑞星用主防结果不可能那么差的

woai_jolin

Scanning Log
Version of virus signature database: 2560 (20070930)
Date: 30.9.2007  Time: 23:35:18
Scanned disks, folders and files: G:\v\35.zip
Number of scanned objects: 49
Number of threats found: 22
Time of completion: 23:35:28  Total scanning time: 10 sec (00:00:10)

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 279
Paranoia Database - 6252
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\tempU.exe - Suspicious of Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\window.exe - Infected with SDB:Win32.Trojan-PSW.Delf.b - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\1(1)(3).exe - Infected with SDB:Trojan-PSW.OnLineGames.u - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\1(2)(1).exe - Infected with SDB:Trojan-PSW.OnLineGames.u - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\1(3).exe - Infected with SDB:Trojan-PSW.OnLineGames.u - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\1(4).exe - Infected with SDB:Trojan-Spy.Delf.2 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\01mh.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\2(3).exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\3(2)(1).exe - Infected with SDB:Trojan-PSW.OnLineGames.u - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\3.exe - Infected with SDB:Trojan-PSW.OnLineGames.39 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\03ms.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\5(3).exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\5.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\8(1).exe - Infected with SDB:Win32.Backdoor.Agent.1 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\10(2)(1).exe - Infected with SDB:Trojan-PSW.OnLineGames.39 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\10(2).exe - Infected with SDB:Trojan-PSW.OnLineGames.39 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\10.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\13cq.exe - Infected with SDB:Trojan-PSW.OnLineGames.39 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\14.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder\16xx.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\1630.exe - Infected with SDB:Trojan-PSW.OnLineGames.u - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\1631.exe - Infected with SDB:Trojan-PSW.OnLineGames.12 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\1633.exe - Infected with PDB:daf Malware program - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\ad_2311.exe - Suspicious of Trojan-PSW.OnLineGames.3
C:\Documents and Settings\uhthn\Desktop\New Folder\menghuan1.exe - Infected with SDB:Trojan-Spy.Delf.2 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\menghuan.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\mminstall.exe - Suspicious of Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder\moon.exe - Infected with SDB:MalwareSpy.Trojan-Downloader.Agent.3 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\moyu.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\my.exe - Suspicious of Trojan-Downloader.Small.2
C:\Documents and Settings\uhthn\Desktop\New Folder\tempA.exe - Suspicious of Trojan-PSW.Game.3
C:\Documents and Settings\uhthn\Desktop\New Folder\tempG.exe - Suspicious of Trojan-PSW.OnLineGames.2
C:\Documents and Settings\uhthn\Desktop\New Folder\tempO.exe - Infected with SDB:Trojan-PSW.OnLineGames.39 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\tempP.exe - Infected with SDB:Trojan-PSW.OnLineGames.39 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\tempS.exe - Suspicious of Trojan-PSW.OnLineGames.3

35 Files scanned
18 Infected files found
17 Suspicious files found
0 Files cured
18 Files deleted

woai_jolin

Status          Quarantined
Target          G:\v\35.zip
                         Options
                                            , Requested action: Repair, Excluded extensions disabled,
                         Excluded objects disabled, Heuristics enabled, Sandbox enabled, Scan
                         archives

         Statistics          Details

                                             Files               Boot sectorsRegistry key

                         Scanned              37                       0                         0
                          Infected              13                       0                         0
                         Repaired               0                        0                         0
                        Renamed               0                         -                          -
                     Quarantined              1                         -                          -
                            Deleted              0                         -                         0