6枚 CRC32值见帖内……

remind_me

主程序应该为 msutl.exe
所有exe被关联到 msutl.exe    牛×

The EQs

微点卫士

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\AVPSRV.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\AVPSRV.EXE
2) C:\WINDOWS.0\SYSTEM32\AVPSRV.DLL
是否删除木马程序及其衍生物?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\AVPSRV.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\GENPROTECT.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\GENPROTECT.EXE
2) C:\WINDOWS.0\SYSTEM32\GENPROTECT.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\KVSC3.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\KVSC3.EXE
2) C:\WINDOWS.0\SYSTEM32\KVSC3.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\UPXDND.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\UPXDND.EXE
2) C:\WINDOWS.0\SYSTEM32\UPXDND.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\MSUTL.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SVCHOST.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\WINFORM.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\WINFORM.EXE
2) C:\WINDOWS.0\SYSTEM32\WINFORM.DLL
是否删除木马程序及其衍生物?

残缺的唯美

已删除：木马程序 Trojan-PSW.Win32.OnLineGames.doj        文件　: C:\Users\Administrator\Desktop\virus.rar/AVPSrv.exe//PE_Patch.UPX//UPX
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.efl        文件　: C:\Users\Administrator\Desktop\virus.rar/GenProtect.exe//PE_Patch.UPX//UPX
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dxz        文件　: C:\Users\Administrator\Desktop\virus.rar/Kvsc3.exe
已删除：病毒 Heur.Trojan.Generic (修改)        文件　: C:\Users\Administrator\Desktop\virus.rar/msutl.exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dxx        文件　: C:\Users\Administrator\Desktop\virus.rar/upxdnd.exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.dxy        文件　: C:\Users\Administrator\Desktop\virus.rar/WinForm.exe//PE_Patch.UPX//UPX

taihuxian

TR/Dropper.Gen

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\virus.rar'
C:\Users\morgan\Documents\
  virus.rar
    [0] Archive type: RAR
    --> AVPSrv.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> GenProtect.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> Kvsc3.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.dxz.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> msutl.exe
        [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
        [WARNING]   Infected files in archives cannot be repaired!
    --> upxdnd.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.eat
        [WARNING]   Infected files in archives cannot be repaired!
    --> WinForm.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.dxy.2
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!


End of the scan: 2007年10月5日  17:31
Used time: 00:05 min

The scan has been done completely.

      0 Scanning directories
      7 Files were scanned
      6 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      6 Warnings
      0 Notes

woai_jolin

Kaspersky Internet Security 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=135944 is infected with Trojan-PSW.Win32.OnLineGames.doj virus

liunanyuan

[Scan path] C:\Documents and Settings\Administrator\桌面\virus.rar
>>C:\Documents and Settings\Administrator\桌面\virus.rar\AVPSrv.exe infected with Trojan.PWS.Wsgame.1430
>>C:\Documents and Settings\Administrator\桌面\virus.rar\GenProtect.exe infected with Trojan.PWS.Wsgame.1562
>>C:\Documents and Settings\Administrator\桌面\virus.rar\Kvsc3.exe infected with Trojan.PWS.Wsgame.1619
>>C:\Documents and Settings\Administrator\桌面\virus.rar\msutl.exe probably infected with MULDROP.Trojan
>C:\Documents and Settings\Administrator\桌面\virus.rar\upxdnd.exe infected with Trojan.PWS.Wsgame.1567
>>>C:\Documents and Settings\Administrator\桌面\virus.rar\WinForm.exe infected with Trojan.PWS.Wsgame.1581
C:\Documents and Settings\Administrator\桌面\virus.rar - archive contains infected objects

kkgh

瑞星08扫描1个，其余主动防御干掉

残缺的唯美

Result: 5 malware found
Trojan-PSW.Win32.OnLineGames.doj (virus)
C:\Users\Administrator\Desktop\virus.rar\AVPSrv.exe
Trojan-PSW.Win32.OnLineGames.efl (virus)
C:\Users\Administrator\Desktop\virus.rar\GenProtect.exe
Trojan-PSW.Win32.OnLineGames.dxz (virus)
C:\Users\Administrator\Desktop\virus.rar\Kvsc3.exe
Trojan-PSW.Win32.OnLineGames.dxx (virus)
C:\Users\Administrator\Desktop\virus.rar\upxdnd.exe
Trojan-PSW.Win32.OnLineGames.dxy (virus)
C:\Users\Administrator\Desktop\virus.rar\WinForm.exe