打了一趟水，收获一包毒

残缺的唯美

Result: 9 malware found
Trojan-PSW.Win32.OnLineGames.drc (virus)
C:\Users\Administrator\Desktop\Temp.rar\7.exe
Trojan-PSW.Win32.OnLineGames.eck (virus)
C:\Users\Administrator\Desktop\Temp.rar\jh.exe
Trojan-PSW.Win32.OnLineGames.dwh (virus)
C:\Users\Administrator\Desktop\Temp.rar\my.exe
Trojan-PSW.Win32.OnLineGames.dzs (virus)
C:\Users\Administrator\Desktop\Temp.rar\tl.exe
Trojan-PSW.Win32.OnLineGames.ecs (virus)
C:\Users\Administrator\Desktop\Temp.rar\wl.exe
Trojan-PSW.Win32.OnLineGames.ecl (virus)
C:\Users\Administrator\Desktop\Temp.rar\zt.exe
Trojan-PSW.Win32.OnLineGames.ebf (virus)
C:\Users\Administrator\Desktop\Temp.rar\zx.exe
Trojan-PSW.Win32.OnLineGames.drs (virus)
C:\Users\Administrator\Desktop\Temp.rar\3.exe
Trojan-PSW.Win32.OnLineGames.eax (virus)
C:\Users\Administrator\Desktop\Temp.rar\5.exe

浪滔天

卡巴 7.0.0.125
9个

已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.drc        文件: F:\病毒样本\Temp.rar/7.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.drs        文件: F:\病毒样本\Temp.rar/3.exe//UPX
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.dwh        文件: F:\病毒样本\Temp.rar/my.exe//UPX
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.dzs        文件: F:\病毒样本\Temp.rar/tl.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.eax        文件: F:\病毒样本\Temp.rar/5.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.ebf        文件: F:\病毒样本\Temp.rar/zx.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.eck        文件: F:\病毒样本\Temp.rar/jh.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.ecl        文件: F:\病毒样本\Temp.rar/zt.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.ecs        文件: F:\病毒样本\Temp.rar/wl.exe//UPack

woai_jolin

[tr][td]Protokol o skenováníDatum: 4. ?jna 2007 19:00:19Cíl:
G:\V\Temp.rar
Možnosti:

Skenovací metoda	Všechny soubory
Heuristika	Povoleno
Použít virtuální počítač	Ano
Skenovat archívy	Ano
Použít vyřazené přípony	Ne
Vyřazené přípony	Není definováno
Použít vyřazené objekty	Ne
Vyřazené objekty	Není definováno

Verze antiviru:
TrustPort Workstation Antivirus 2.7.0.1419
Výsledky:
Soubory:

Cesta	Výsledek skenování	Jméno viru	Provedená akce
G:\V\Temp.rar:\7.exe	Infikováno!	Generic8.CQB	Do karantény
G:\V\Temp.rar:\mh.exe	Infikováno!	PSW.OnlineGames	Do karantény
G:\V\Temp.rar:\my.exe	Infikováno!	PSW.OnlineGames.LQF	Do karantény
G:\V\Temp.rar:\tl.exe	Infikováno!	Generic8.ERM	Do karantény
G:\V\Temp.rar:\zt.exe	Infikováno!	Generic8.FMU	Do karantény
G:\V\Temp.rar:\zx.exe	Infikováno!	Generic8.FBN	Do karantény
G:\V\Temp.rar:\3.exe	Infikováno!	PSW.OnlineGames	Do karantény
G:\V\Temp.rar:\4.exe	Infikováno!	Generic8.FMV	Do karantény
G:\V\Temp.rar	Infikováno!	Generic8.CQB	Karanténa

Statistika
Zaváděcí sektory:

Oskenováno:	0
Infikováno:	0
Opraveno:	0

Soubory:

Oskenováno:	15
Infikováno:	8
Opraveno:	0
Přejmenováno:	0
Přesunuto do karantény:	1
Smazáno:	0

Registry:

Oskenováno:	0
Infikováno:	0
Opraveno:	0
Smazáno:	0

Vygenerováno
TrustPort Antivirus, Copyright (c) 2004-2007
AEC, spol. s r.o.
[/td][/tr]

微点卫士

木马名称:Trojan-PSW.Win32.OnLineGames.oen

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\3.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\4.EXE
1) C:\DFD314437.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\5.EXE
1) C:\DFD322953.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\7.EXE
1) C:\DFD330171.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\9.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\INFO_MS.SYS
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\JH.EXE
1) C:\DFD346265.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\MH.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\XYUPRI0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\MY.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\MYPERN0.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\TL.EXE
1) C:\DFD370859.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\WD.EXE
1) C:\DFD377828.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\WL.EXE
1) C:\DFD384906.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\ZT.EXE
1) C:\DFD395343.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\ZX.EXE
1) C:\DFD401875.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

timhas266

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\Temp.rar'
C:\Documents and Settings\tim\桌面\Temp.rar
  [0] Archive type: RAR
  --> 7.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.drc.4
  --> 9.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> jh.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> mh.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.dtx.2
  --> my.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.ddm.1
  --> tl.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> wd.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> wl.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> zt.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.eco
  --> zx.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 3.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.ddm.1
  --> 4.exe
      [DETECTION] Is the Trojan horse TR/FWDisable.20068
  --> 5.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      A backup was created as '4771d1e9.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: Thursday, 4 October, 2007  19:41
Used time: 00:02 min

The scan has been done completely.

      0 Scanning directories
     15 Files were scanned
      7 viruses and/or unwanted programs were found
      6 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      8 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

tcgg1983

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.OnlineGames.zan

用户来源：局域网

软件版本：20.12.30

king6808

已删除：木马程序 Trojan-PSW.Win32.OnLineGames.drc        文件　: G:\10.4\Temp.rar/7.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.eck        文件　: G:\10.4\Temp.rar/jh.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.eej        文件　: G:\10.4\Temp.rar/mh.exe//UPX
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dwh        文件　: G:\10.4\Temp.rar/my.exe//UPX
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dzs        文件　: G:\10.4\Temp.rar/tl.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.eeh        文件　: G:\10.4\Temp.rar/wd.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.ecs        文件　: G:\10.4\Temp.rar/wl.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.ecl        文件　: G:\10.4\Temp.rar/zt.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.ebf        文件　: G:\10.4\Temp.rar/zx.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.drs        文件　: G:\10.4\Temp.rar/3.exe//UPX
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.eei        文件　: G:\10.4\Temp.rar/4.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.eax        文件　: G:\10.4\Temp.rar/5.exe//UPack

Nblock

kafyezy.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks  {5B681598-AD5F-BC8C-77DC-748FAC8D3FB5}

[ 本帖最后由 Nblock 于 2007-10-4 22:39 编辑 ]

風中Dè殘雲

卡7KAV报12个



[ 本帖最后由 風中Dè殘雲 于 2007-10-4 22:47 编辑 ]

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 305
Paranoia Database - 6796
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder

C:\Documents and Settings\uhthn\Desktop\New Folder\7.exe - Suspected MalwareDetector:Generic.PSW.3
C:\Documents and Settings\uhthn\Desktop\New Folder\9.exe - Suspected MalwareDetector:Win32.Generic.PSW.1
C:\Documents and Settings\uhthn\Desktop\New Folder\jh.exe - Suspected MalwareDetector:Generic.PSW.3
C:\Documents and Settings\uhthn\Desktop\New Folder\mh.exe - Suspected MalwareDetector:Generic.PSW.1
C:\Documents and Settings\uhthn\Desktop\New Folder\my.exe - Suspected Trojan-Downloader.Small.2
C:\Documents and Settings\uhthn\Desktop\New Folder\tl.exe - Suspected MalwareDetector:Generic.PSW.3
C:\Documents and Settings\uhthn\Desktop\New Folder\wd.exe - Suspected MalwareDetector:Generic.PSW.3
C:\Documents and Settings\uhthn\Desktop\New Folder\wl.exe - Suspected MalwareDetector:Generic.PSW.3
C:\Documents and Settings\uhthn\Desktop\New Folder\zt.exe - Suspected MalwareDetector:Generic.PSW.3
C:\Documents and Settings\uhthn\Desktop\New Folder\zx.exe - Suspected MalwareDetector:Generic.PSW.3
C:\Documents and Settings\uhthn\Desktop\New Folder\3.exe - Infected Generic.Malware.2d3
C:\Documents and Settings\uhthn\Desktop\New Folder\4.exe - Suspected MalwareDetector:Generic.PSW.3
C:\Documents and Settings\uhthn\Desktop\New Folder\5.exe - Suspected MalwareDetector:Generic.PSW.3

13 Files scanned
1 Infected files found
12 Suspected files found
0 Files cured
1 Files deleted