http://74.222.130.28/Images/Hide/*.exe

专家

http://74.222.130.28/Images/Hide/1.exe

...

http://74.222.130.28/Images/Hide/16.exe

微点卫士

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\MHDOOR0.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\16.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\CQDOOR0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\2.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\WODOOR0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\3.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\ZTFREE0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\4.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\CSDOOR0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\5.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\WLDOOR0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\6.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\WGDOOR0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\7.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\DADOOR0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\8.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\DH3OOR0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\9.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\QJDOOR0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\10.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\RXDOOR0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\11.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\WDDOOR0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\12.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\TLDOOR0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\13.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\ZXDOOR0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\14.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\MYDOOR0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\15.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\QHDOOR0.DLL
是否删除木马程序及其衍生物?

[ 本帖最后由 微点卫士 于 2007-10-4 13:59 编辑 ]

mofunzone

就这样的被全灭
Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\TDDOWNLOAD.rar'
C:\Users\morgan\Documents\
  TDDOWNLOAD.rar
    [0] Archive type: RAR
    --> 16.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 1.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 2.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 3.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 4.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 5.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 6.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 7.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 8.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 9.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 10.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 11.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 12.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 13.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 14.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 15.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年10月3日  22:56
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
     17 Files were scanned
     15 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
     17 Warnings
      0 Notes

flo

卡7扫描漏一个4.exe（运行后报释放文件，关了文件防护，PDM也可以拦）：
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.eam        URL: http://74.222.130.28/Images/Hide/1.exe//#
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.eae        URL: http://74.222.130.28/Images/Hide/2.exe//#
检测到：病毒 Heur.Invader (修改)        URL: http://74.222.130.28/Images/Hide/3.exe//PE_Patch.UPX
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.eaf        URL: http://74.222.130.28/Images/Hide/5.exe//#
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.eag        URL: http://74.222.130.28/Images/Hide/6.exe//#
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.ean        URL: http://74.222.130.28/Images/Hide/7.exe//#
检测到：病毒 Heur.Invader (修改)        URL: http://74.222.130.28/Images/Hide/8.exe
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.eaj        URL: http://74.222.130.28/Images/Hide/9.exe//#
检测到：木马程序 Trojan-Downloader.Win32.Agent.dsu        URL: http://74.222.130.28/Images/Hide/10.exe
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.ecu        URL: http://74.222.130.28/Images/Hide/11.exe
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.eda        URL: http://74.222.130.28/Images/Hide/12.exe
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.ecv        URL: http://74.222.130.28/Images/Hide/13.exe
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.ecw        URL: http://74.222.130.28/Images/Hide/14.exe//PE_Patch.UPX//UPX
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.ecx        URL: http://74.222.130.28/Images/Hide/15.exe
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.ecy        URL: http://74.222.130.28/Images/Hide/16.exe

[ 本帖最后由 flo 于 2007-10-4 14:01 编辑 ]

micetai

[ 本帖最后由 micetai 于 2007-10-4 14:00 编辑 ]

红心王子

2007-10-4        14:19:20        1191478760        Administrator        1152        Sign of "Win32:Onlinegames-BEZ [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\16.exe\[UPX]\[Embedded#1470]" file.  
2007-10-4        14:19:29        1191478769        Administrator        1152        Sign of "Win32:Agent-LUA [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\1.exe\[UPX]\[Embedded#1470]" file.  
2007-10-4        14:19:29        1191478769        Administrator        1152        Sign of "Win32:Agent-KGX [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\2.exe\[UPX]\[Embedded#1470]" file.  
2007-10-4        14:19:29        1191478769        Administrator        1152        Sign of "Win32:OnLineGames-FN [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\5.exe\[UPX]\[Embedded#1470]" file.  
2007-10-4        14:19:29        1191478769        Administrator        1152        Sign of "Win32:Onlinegames-ALM [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\6.exe\[UPX]\[Embedded#1470]" file.  
2007-10-4        14:19:29        1191478769        Administrator        1152        Sign of "Win32:Agent-INA [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\7.exe\[UPX]\[Embedded#1470]" file.  
2007-10-4        14:19:29        1191478769        Administrator        1152        Sign of "Win32:Agent-LTZ [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\8.exe\[UPX]\[Embedded#1470]" file.  
2007-10-4        14:19:29        1191478769        Administrator        1152        Sign of "Win32:Onlinegames-ARI [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\10.exe\[UPX]\[Embedded#1470]" file.  
2007-10-4        14:19:29        1191478769        Administrator        1152        Sign of "Win32:Nilage-JZ [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\11.exe\[UPX]\[Embedded#1470]" file.  
2007-10-4        14:19:29        1191478769        Administrator        1152        Sign of "Win32:Onlinegames-ALL [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\12.exe\[UPX]\[Embedded#1470]" file.  
2007-10-4        14:19:30        1191478770        Administrator        1152        Sign of "Win32:Agent-LTX [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\14.exe\[UPX]\[Embedded#1470]" file.  
2007-10-4        14:19:30        1191478770        Administrator        1152        Sign of "Win32:Agent-LUB [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar\15.exe\[UPX]\[Embedded#1470]" file.

king6808

已删除：木马程序 Trojan-PSW.Win32.OnLineGames.eam        文件: F:\10.4\1.exe//#
已隔离：病毒 Heur.Invader (修改)        文件: F:\10.4\3.exe//PE_Patch.UPX
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.eaf        文件: F:\10.4\5.exe//#
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.ean        文件: F:\10.4\7.exe//#
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.eag        文件: F:\10.4\6.exe//#
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.eae        文件: F:\10.4\2.exe//#
已隔离：病毒 Heur.Invader (修改)        文件: F:\10.4\8.exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.eaj        文件: F:\10.4\9.exe//#
已删除：木马程序 Trojan-Downloader.Win32.Agent.dsu        文件: F:\10.4\10.exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.ecv        文件: F:\10.4\13.exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.ecw        文件: F:\10.4\14.exe//PE_Patch.UPX//UPX
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.ecx        文件: F:\10.4\15.exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.ecy        文件: F:\10.4\16.exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.ecu        文件: F:\10.4\11.exe.jc!
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.eda        文件: F:\10.4\12.exe.jc!

1p1

原帖由 mofunzone 于 2007-10-4 13:56 发表
就这样的被全灭
Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\TDDOWNLOAD.rar'
C:\Users\morgan\Documents\
  TDDOWNLOAD.rar
    [0] Archive type: RAR
    --> 16. ...

扫描进行于：2007-10-4 16:35:35
扫描日志
NOD32版本 2570 (20071003) NT
命令行： C:\Documents and Settings\user\桌面\TDDOWNLOAD1.rar C:\Documents and Settings\user\桌面\TDDOWNLOAD2.rar
日期： 4.10.2007  时间：16:35:38
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\user\桌面\TDDOWNLOAD1.rar; C:\Documents and Settings\user\桌面\TDDOWNLOAD2.rar
C:\Documents and Settings\user\桌面\TDDOWNLOAD1.rar >>RAR >>7.exe - Win32/PSW.OnLineGames.NFN 木马的变种
C:\Documents and Settings\user\桌面\TDDOWNLOAD1.rar >>RAR >>8.exe - Win32/PSW.OnLineGames.NFN 木马的变种
C:\Documents and Settings\user\桌面\TDDOWNLOAD1.rar >>RAR >>10.exe - Win32/PSW.OnLineGames.NFN 木马的变种
C:\Documents and Settings\user\桌面\TDDOWNLOAD1.rar >>RAR >>11.exe - Win32/PSW.OnLineGames.NFN 木马的变种
C:\Documents and Settings\user\桌面\TDDOWNLOAD1.rar >>RAR >>12.exe - Win32/PSW.OnLineGames.NFN 木马的变种
C:\Documents and Settings\user\桌面\TDDOWNLOAD1.rar >>RAR >>13.exe - Win32/PSW.OnLineGames.NFN 木马的变种
C:\Documents and Settings\user\桌面\TDDOWNLOAD1.rar >>RAR >>14.exe - Win32/PSW.OnLineGames.NFN 木马的变种
C:\Documents and Settings\user\桌面\TDDOWNLOAD1.rar >>RAR >>15.exe - Win32/PSW.OnLineGames.NFN 木马的变种
C:\Documents and Settings\user\桌面\TDDOWNLOAD1.rar >>RAR >>9.exe - Win32/PSW.OnLineGames.NFN 木马的变种
C:\Documents and Settings\user\桌面\TDDOWNLOAD1.rar >>RAR >>16.exe - Win32/PSW.OnLineGames.NFN 木马的变种
C:\Documents and Settings\user\桌面\TDDOWNLOAD2.rar >>RAR >>6.exe - Win32/PSW.OnLineGames.NFN 木马的变种
C:\Documents and Settings\user\桌面\TDDOWNLOAD2.rar >>RAR >>2.exe - Win32/PSW.OnLineGames.NFN 木马
C:\Documents and Settings\user\桌面\TDDOWNLOAD2.rar >>RAR >>3.exe - Win32/PSW.OnLineGames.NFN 木马的变种
C:\Documents and Settings\user\桌面\TDDOWNLOAD2.rar >>RAR >>4.exe - Win32/PSW.OnLineGames.NFN 木马
C:\Documents and Settings\user\桌面\TDDOWNLOAD2.rar >>RAR >>5.exe - Win32/PSW.OnLineGames.NFN 木马的变种
C:\Documents and Settings\user\桌面\TDDOWNLOAD2.rar >>RAR >>1.exe - Win32/PSW.OnLineGames.NFN 木马
已扫描的文件数目：16
已发现的病毒数目：16
完成时间： 16:35:38 总扫描时间：0 秒 (00:00:00)
就这样的被全灭

Guanguancan

全都是访问EXPLORER？
Attempt to open process C:\WINDOWS\explorer.exe
DF真厉害

IllusionWing

全杀
UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.2.0
HC0.rlb = 2.8.9
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\1.exe 检测到 Packed.Generic.UPX.Modified.2
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\10.exe 检测到 Packed.Generic.UPX.Modified.2
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\11.exe 检测到 Packed.Generic.UPX.Modified.2
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\12.exe 检测到 Packed.Generic.UPX.Modified.2
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\13.exe 检测到 Packed.Generic.UPX.Modified.2
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\14.exe//UPX//Stream_02 检测到 Packed.Generic.S
[扫描] [Level 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\14.exe//UPX//Stream_02 检测到 Generic.OperationOfSEH
[扫描] [捆绑检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\14.exe//UPX 检测到 Generic.Binder
[扫描] [Level 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\14.exe//UPX 检测到 Generic.OperationOfSEH
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\15.exe 检测到 Packed.Generic.UPX.Modified.2
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\16.exe 检测到 Packed.Generic.UPX.Modified.2
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\2.exe 检测到 Packed.Generic.UPX.Modified.2
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\3.exe//UPX//Stream_02 检测到 Packed.Generic.S
[扫描] [Level 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\3.exe//UPX//Stream_02 检测到 Generic.OperationOfSEH
[扫描] [捆绑检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\3.exe//UPX 检测到 Generic.Binder
[扫描] [Level 2] 在 E:\Documents and Settings\Administrator\桌面\Vir\3.exe//UPX 检测到 Generic.OperationOfSEH
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\4.exe 检测到 Packed.Generic.UPX.Modified.2
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\5.exe 检测到 Packed.Generic.UPX.Modified.2
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\6.exe 检测到 Packed.Generic.UPX.Modified.2
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\7.exe 检测到 Packed.Generic.UPX.Modified.2
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\8.exe 检测到 Packed.Generic.UPX.Modified.2
[扫描] [变形壳检测] 在 E:\Documents and Settings\Administrator\桌面\Vir\9.exe 检测到 Packed.Generic.UPX.Modified.2
检测到了 22 个未知的恶意程序，请上报。
任务 扫描 完成。共耗费的时间：0-00-00 00:00:01:0234，共扫描的文件数量：22，共扫描到的威胁数量：22，威胁率：1