18只

promised

Nerazzurri

扫描进行于：2007-10-13 20:32:43
扫描日志
NOD32版本 2590 (20071012) NT
命令行： C:\Documents and Settings\Crusade\桌面\样本7.rar

日期： 13.10.2007  时间：20:32:46
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Crusade\桌面\样本7.rar
C:\Documents and Settings\Crusade\桌面\样本7.rar >>RAR >>5DDF407CB734.dll - Win32/PSW.OnLineGames.NFF 木马的变种
C:\Documents and Settings\Crusade\桌面\样本7.rar >>RAR >>kvdxcis.exe - 可能是 Win32/Genetik 木马 的一个变种
C:\Documents and Settings\Crusade\桌面\样本7.rar >>RAR >>kvmxeis.exe - 可能是 Win32/Genetik 木马 的一个变种
C:\Documents and Settings\Crusade\桌面\样本7.rar >>RAR >>rsmyepm.dll - 可能是 Win32/Genetik 木马 的一个变种
C:\Documents and Settings\Crusade\桌面\样本7.rar >>RAR >>rsmyesp.exe - 可能是 Win32/Genetik 木马 的一个变种
C:\Documents and Settings\Crusade\桌面\样本7.rar >>RAR >>host2.exe - 可能是 Win32/AutoRun.Q 蠕虫 的一个变种
C:\Documents and Settings\Crusade\桌面\样本7.rar >>RAR >>host8.exe - Win32/TrojanDropper.Small.APR 木马
C:\Documents and Settings\Crusade\桌面\样本7.rar >>RAR >>host9.exe - Win32/PSW.OnLineGames.NFF 木马的变种
C:\Documents and Settings\Crusade\桌面\样本7.rar >>RAR >>SysWin64.Sys - Win32/AutoRun.Q 蠕虫的变种
已扫描的文件数目：18
已发现的病毒数目：9
完成时间： 20:32:52 总扫描时间：6 秒 (00:00:06)

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.QMOnline.dg
病毒： Trojan.PSW.Win32.LMir.yxa
病毒： Trojan.PSW.Win32.WoWar.abu
病毒： Trojan.PSW.Win32.ZhengTu.ylc
病毒： Trojan.PSW.Win32.XYOnline.mp
病毒： Trojan.PSW.Win32.XYOnline.mo
病毒： Trojan.PSW.Win32.XYOnline.ms
病毒： Trojan.PSW.Win32.XYOnline.ms
病毒： Trojan.PSW.Win32.OnlineGames.zxh
病毒： Trojan.PSW.Win32.RocOnline.gf
病毒： Trojan.PSW.Win32.RocOnline.gf
病毒： Worm.Win32.PaBug.am      
病毒： Trojan.PSW.Win32.ZhengTu.ylc
病毒： Trojan.PSW.Win32.LMir.yxa
病毒： Trojan.PSW.Win32.WoWar.abu
病毒： Dropper.Agent.dgx        
病毒： Trojan.PSW.Win32.QMOnline.dg
病毒： Worm.Win32.PaBug.am      

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.44.52

nosferatu

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本7.rar'
C:\Documents and Settings\Administrator\桌面\样本7.rar
  [0] Archive type: RAR
  --> addrgjhelp.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> addrmshelp.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> addrzthelp.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> kvdxcis.exe
      [DETECTION] Is the Trojan horse TR/FWDisable.20509
  --> kvdxcma.dll
      [DETECTION] Is the Trojan horse TR/FWDisable.20509
  --> kvmxeis.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> kvmxema.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> qdshm.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> rsmyepm.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> rsmyesp.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> host2.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> host3.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> host6.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> host7.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> host9.exe
      [DETECTION] Is the Trojan horse TR/Spy.Hacko.3
  --> SysWin64.Sys
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!


End of the scan: 星期六 2007年10月13日  20:43
Used time: 00:27 min

The scan has been done completely.

      0 Scanning directories
     20 Files were scanned
      8 viruses and/or unwanted programs were found
      8 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     12 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

wangfeng66

D:\opr02FWM.rar\5DDF407CB734.dll - infected with Trojan.PWS.Lineage.origin
D:\\opr02FWM.rar\addrzthelp.dll - infected with Trojan.PWS.Gamania.5176
D:\opr02FWM.rar\kvdxcis.exe - infected with Trojan.PWS.Gamania.5161
D:\opr02FWM.rar\kvdxcma.dll - infected with Trojan.PWS.Gamania.5161
D:\opr02FWM.rar\kvmxeis.exe - infected with Trojan.PWS.Gamania.origin
D:\\opr02FWM.rar\kvmxema.dll - infected with Trojan.PWS.Gamania.origin
D:\opr02FWM.rar\qdshm.dll - infected with Trojan.PWS.Gamania.5176
D:\opr02FWM.rar\rsmyepm.dll - infected with Trojan.PWS.Gamania.5180
D:\opr02FWM.rar\rsmyesp.exe - infected with Trojan.PWS.Gamania.5180
D:\opr02FWM.rar\host2.exe - infected with Trojan.PWS.Qqpass.origin
D:\opr02FWM.rar\host3.exe - infected with Trojan.PWS.Gamania.5176
D:\opr02FWM.rar\host8.exe - infected with Trojan.PWS.Bonque
D:\opr02FWM.rar\host9.exe - infected with Trojan.PWS.Lineage.origin
D:\opr02FWM.rar\SysWin64.Sys - infected with Trojan.PWS.Lineage.origin

Archive contains 14 infected items

DRWEB 4.44  Kill 14

xemacs

红伞发现8个 怀疑6个

timhas266

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\樣本\欴掛7.rar'
C:\Documents and Settings\tim\桌面\樣本\欴掛7.rar
  [0] Archive type: RAR
  --> addrgjhelp.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> addrmshelp.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> addrzthelp.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> kvdxcis.exe
      [DETECTION] Is the Trojan horse TR/FWDisable.20509
  --> kvdxcma.dll
      [DETECTION] Is the Trojan horse TR/FWDisable.20509
  --> kvmxeis.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> kvmxema.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> qdshm.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> rsmyepm.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> rsmyesp.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> host2.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> host3.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> host6.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> host7.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> host9.exe
      [DETECTION] Is the Trojan horse TR/Spy.Hacko.3
  --> SysWin64.Sys
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      A backup was created as '474823b7.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: Saturday, 13 October, 2007  20:54
Used time: 00:02 min

The scan has been done completely.

      0 Scanning directories
     20 Files were scanned
      8 viruses and/or unwanted programs were found
      8 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     12 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

sbbdms

江民杀9只

wangjay1980

8
detected: Trojan program Trojan-PSW.Win32.Magania.ann        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾7.rar/5DDF407CB734.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fat        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾7.rar/kvdxcis.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fat        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾7.rar/kvdxcma.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fbi        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾7.rar/kvmxeis.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fbs        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾7.rar/rsmyepm.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fbs        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾7.rar/rsmyesp.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fai        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾7.rar/host6.exe//PE_Patch//UPack//#
detected: Trojan program Trojan-PSW.Win32.Magania.anm        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾7.rar/host9.exe//FSG//PE_Patch.MaskPE

woai_jolin

Scan completed.
Start date: 2007-10-13 22:07:08
End date: 2007-10-13 22:07:45
Total files scanned: 14
Total files detected: 8
Total files quarantined : 8