3ge[MD5: 696C84 AECC88 812E44]

显示全部楼层 · 发表于 2007-10-2 13:17:12

对象: Relive.dll
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\样本1.rar
Status: 已发现病毒
病毒: Trojan.PWS.Onlinegames.AYU (BD 引擎)
对象: msvcrt.bak
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\样本1.rar
Status: 已发现病毒
病毒: Trojan.PWS.Onlinegames.AYU (BD 引擎)

显示全部楼层 · 发表于 2007-10-2 13:20:59

全杀

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.1.1
HC0.rlb = 2.8.9
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹\样本1.rar>>msvcrt.bak 检测到 Generic.nFile
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹\样本1.rar>>msvcrt.bak 检测到 Trojan.OnLineGames.afp
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹\样本1.rar>>Relive.dll 检测到 Generic.nFile
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹\样本1.rar>>Relive.dll 检测到 Risk.HookTool.b
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\新建文件夹\样本1.rar>>zzm.exe 检测到 Packed.Generic.Modified
检测到了 3 个未知的恶意程序，请上报。
任务扫描完成。共耗费的时间：0-00-00 00:00:01:0125，共扫描的文件数量：4，共扫描到的威胁数量：5，威胁率：1.25

显示全部楼层 · 发表于 2007-10-2 15:55:20

zzm.exek - Backdoor.Win32.Hupigon.pzt

显示全部楼层 · 发表于 2007-10-2 16:16:51

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.
http://www.bitdefender.com/vfind/?q=Trojan.PWS.Onlinegames.AYU

显示全部楼层 · 发表于 2007-10-2 19:33:52

已删除：木马程序 Trojan-Downloader.Win32.Agent.bmo 文件: F:\10.2\样本1.rar/Relive.dll//PE_Patch.UPX//UPX
已删除：病毒 Virus.Win32.AutoRun.ji 文件: F:\10.2\样本1.rar/msvcrt.bak
已删除：木马程序 Backdoor.Win32.Hupigon.pzt 文件: F:\10.2\样本1.rar/zzm.exe

显示全部楼层 · 发表于 2007-10-3 01:12:19

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 282
Paranoia Database - 6353
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\zzm.exe - Infected with SDB:Win32.Trojan-Downloader.Agent.3 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder\Relive.dll - Suspicious of Win32.Trojan-PSW.Game.1
C:\Documents and Settings\uhthn\Desktop\New Folder\msvcrt.bak - Infected with SDB:Win32.Virus.autorun.2 - Deleted

3 Files scanned
2 Infected files found
1 Suspicious files found
0 Files cured
2 Files deleted

[病毒样本] 3ge[MD5: 696C84 AECC88 812E44]