DLLX10

promised

C:\ABC\样本7.rar:\ravmsmon.dll - 特征码 'Trojan-PWS.Win32.Small.br' 被发现
C:\ABC\样本7.rar:\msrav.dll - 特征码 'BehavesLikeWin32.ExplorerHijack' 被发现
C:\ABC\样本7.rar:\ratbepi.dll - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本7.rar:\xyupri0.dll - 特征码 'Generic.PWS.Games.1' 被发现
C:\ABC\样本7.rar:\rarjbpi.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\样本7.rar:\rsmycpm.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\样本7.rar:\avwlbmn.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\样本7.rar:\qiji.dll - 特征码 'Trojan-Spy.Win32.Delf.uh' 被发现
C:\ABC\样本7.rar:\WinSys84.Sys - 特征码 'Trojan-PWS.Win32.Nilage.bga' 被发现
C:\ABC\样本7.rar:\ravzxmon.dll - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本7.rar
11 文件被扫描
   (1 压缩档 10 文件)
10 特征码被侦测
0 可疑代码段被发现
耗时: 0:00.079

FBAV

MicroVita AntiSpyware 100 C
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……


正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\dll\dll\avwlbmn.dll]
                    …………发现Spy！报告: [4]
文件信息:  大小:23124  MD5:33a710155aac8b92a66e75eed6f18b51


[C:\Documents and Settings\Administrator\桌面\Virus\dll\dll\msrav.dll]
                    …………发现Spy！报告: [4]
文件信息:  大小:9310  MD5:c727370e315c8cef9327f67771d2477a


[C:\Documents and Settings\Administrator\桌面\Virus\dll\dll\rarjbpi.dll]
                    …………发现Spy！报告: [4]
文件信息:  大小:21084  MD5:db01ece9056891f6b9a727b7dfddb830


[C:\Documents and Settings\Administrator\桌面\Virus\dll\dll\ratbepi.dll]
                    …………发现Spy！报告: [4]
文件信息:  大小:16986  MD5:468282e5b3fe8aa91acb60a2473f65cc


[C:\Documents and Settings\Administrator\桌面\Virus\dll\dll\ravmsmon.dll]
                    …………发现Spy！报告: [4] [1]
文件信息:  大小:8455  MD5:488c3b20a38de8524168b8b469cd7ff6


[C:\Documents and Settings\Administrator\桌面\Virus\dll\dll\ravzxmon.dll]
                    …………发现Spy！报告: [4] [1]
文件信息:  大小:6538  MD5:5033b9a451a8bde299270854b1137334


[C:\Documents and Settings\Administrator\桌面\Virus\dll\dll\rsmycpm.dll]
                    …………发现Spy！报告: [4]
文件信息:  大小:21606  MD5:6c57ef1be69e2fc49cf649bb904386fb


[C:\Documents and Settings\Administrator\桌面\Virus\dll\dll\WinSys84.Sys]
                    …………发现Spy！报告: [4]
文件信息:  大小:45180  MD5:cdfe68b76bc8d4d76b3dc36756da388c


文件数:10   病毒数:8  比重:0.8
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎   
[2] 文件特征码引擎
[1] 文件启发式引擎

[ 本帖最后由 FBAV 于 2007-10-3 13:00 编辑 ]

The EQs

Scan performed at: 2007-10-3 12:56:03
Scanning Log
NOD32 version 2567 (20071002) NT
Command line: C:\Documents and Settings\Don johnson\桌面\dll.rar
Operating memory - is OK

Date: 3.10.2007  Time: 12:56:06
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\dll.rar
C:\Documents and Settings\Don johnson\桌面\dll.rar ?RAR ?dll\avwlbmn.dll - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\dll.rar ?RAR ?dll\rarjbpi.dll - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\dll.rar ?RAR ?dll\ratbepi.dll - a variant of Win32/PSW.OnLineGames.NEN trojan
C:\Documents and Settings\Don johnson\桌面\dll.rar ?RAR ?dll\WinSys84.Sys - probably a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\Don johnson\桌面\dll.rar ?RAR ?dll\xyupri0.dll - probably a variant of Win32/PSW.OnLineGames.NFN trojan
Number of scanned files: 11
Number of threats found: 5
Number of files cleaned: 1
Time of completion: 12:56:07 Total scanning time: 1 sec (00:00:01)

moonsilver

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.OnlineGames.yyf
病毒： Trojan.PSW.Win32.TLOnline.bh
病毒： Trojan.PSW.Win32.OnlineGames.zcb

3个

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\dll.rar'
C:\Users\morgan\Documents\
  dll.rar
    [0] Archive type: RAR
    --> dll\avwlbmn.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.dtw.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> dll\msrav.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
        [WARNING]   Infected files in archives cannot be repaired!
    --> dll\qiji.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> dll\rarjbpi.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.dxl
        [WARNING]   Infected files in archives cannot be repaired!
    --> dll\ratbepi.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.cwf.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> dll\ravmsmon.dll
        [DETECTION] Is the Trojan horse TR/PSW.Lmir.bmw
        [WARNING]   Infected files in archives cannot be repaired!
    --> dll\ravzxmon.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.dua
        [WARNING]   Infected files in archives cannot be repaired!
    --> dll\rsmycpm.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.duc
        [WARNING]   Infected files in archives cannot be repaired!
    --> dll\WinSys84.Sys
        [DETECTION] Is the Trojan horse TR/PSW.QQGame.AI.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> dll\xyupri0.dll
        [DETECTION] Is the Trojan horse TR/PSW.Online.dtx.2
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!


End of the scan: 2007年10月2日  21:57
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
     11 Files were scanned
      9 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
     10 Warnings
      0 Notes

flo

kav7:
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dtw        文件　: C:\Users\user\Desktop\dll.rar/dll\avwlbmn.dll
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dua        文件　: C:\Users\user\Desktop\dll.rar/dll\msrav.dll
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dzr        文件　: C:\Users\user\Desktop\dll.rar/dll\qiji.dll
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dxl        文件　: C:\Users\user\Desktop\dll.rar/dll\rarjbpi.dll
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.cwf        文件　: C:\Users\user\Desktop\dll.rar/dll\ratbepi.dll
已删除：木马程序 Trojan-PSW.Win32.Lmir.bmw        文件　: C:\Users\user\Desktop\dll.rar/dll\ravmsmon.dll//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dua        文件　: C:\Users\user\Desktop\dll.rar/dll\ravzxmon.dll//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.duc        文件　: C:\Users\user\Desktop\dll.rar/dll\rsmycpm.dll
已删除：木马程序 Trojan-PSW.Win32.QQGame.ai        文件　: C:\Users\user\Desktop\dll.rar/dll\WinSys84.Sys
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dtx        文件　: C:\Users\user\Desktop\dll.rar/dll\xyupri0.dll

IllusionWing

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.1.1
HC0.rlb = 2.8.9
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [nFile Detect 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\dll\dll\avwlbmn.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\dll\dll\msrav.dll 检测到 Generic.nFile
[扫描] [Level 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\dll\dll\qiji.dll 检测到 Risk.HookTool
[扫描] [nFile Detect 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\dll\dll\rarjbpi.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\dll\dll\ratbepi.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\dll\dll\ravmsmon.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\dll\dll\ravzxmon.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\dll\dll\rsmycpm.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\dll\dll\WinSys84.Sys 检测到 Generic.nFile
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\dll\dll\xyupri0.dll 检测到 Packed.Generic.S
检测到了 9 个未知的恶意程序，请上报。
任务 扫描 完成。共耗费的时间：0-00-00 00:00:00:0313，共扫描的文件数量：10，共扫描到的威胁数量：10，威胁率：1

ivan_t

2007-10-3        17:45:51        已删除        
D:\INTERNET\TEMP\6BIOIWHZ.RAR        PWS-OnlineGames.a.dll (特洛伊)
2007-10-3        17:45:56        删除失败（清除失败）         D:\Internet\Temp\6bioiwhz.rar\AVWLBMN.DLL        PWS-OnlineGames.a.dll (特洛伊)

king6808

已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dtw        文件: F:\10.3\dll.rar/dll\avwlbmn.dll
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dua        文件: F:\10.3\dll.rar/dll\msrav.dll
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dzr        文件: F:\10.3\dll.rar/dll\qiji.dll
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dxl        文件: F:\10.3\dll.rar/dll\rarjbpi.dll
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.cwf        文件: F:\10.3\dll.rar/dll\ratbepi.dll
已删除：木马程序 Trojan-PSW.Win32.Lmir.bmw        文件: F:\10.3\dll.rar/dll\ravmsmon.dll//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dua        文件: F:\10.3\dll.rar/dll\ravzxmon.dll//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.duc        文件: F:\10.3\dll.rar/dll\rsmycpm.dll
已删除：木马程序 Trojan-PSW.Win32.QQGame.ai        文件: F:\10.3\dll.rar/dll\WinSys84.Sys
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dtx        文件: F:\10.3\dll.rar/dll\xyupri0.dll

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 289
Paranoia Database - 6697
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\dll

C:\Documents and Settings\uhthn\Desktop\dll\avwlbmn.dll - Infected with Win32.Trojan-PSW.OnLineGames.af
C:\Documents and Settings\uhthn\Desktop\dll\msrav.dll - Infected Trojan-Spy.Delf.2
C:\Documents and Settings\uhthn\Desktop\dll\qiji.dll - Infected Win32.Trojan-PSW.QQPass.2
C:\Documents and Settings\uhthn\Desktop\dll\rarjbpi.dll - Infected with Win32.Trojan-PSW.OnLineGames.af
C:\Documents and Settings\uhthn\Desktop\dll\ratbepi.dll - Infected with Win32.Trojan-PSW.OnLineGames.af
C:\Documents and Settings\uhthn\Desktop\dll\ravmsmon.dll - Suspected MalwareDetector:Generic.PSW.3
C:\Documents and Settings\uhthn\Desktop\dll\ravzxmon.dll - Suspected MalwareDetector:Generic.PSW.3
C:\Documents and Settings\uhthn\Desktop\dll\rsmycpm.dll - Infected with Win32.Trojan-PSW.OnLineGames.af
C:\Documents and Settings\uhthn\Desktop\dll\WinSys84.Sys - Infected with Win32.Trojan-PSW.QQPass.a
C:\Documents and Settings\uhthn\Desktop\dll\xyupri0.dll - Infected Trojan-PSW.Small.1

10 Files scanned
8 Infected files found
2 Suspected files found
0 Files cured
8 Files deleted