18只

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 516
Paranoia Database - 10427
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder (2)

C:\Documents and Settings\uhthn\Desktop\New Folder (2)\5DDF407CB734.dll - Infected Win32.Trojan-PSW.OnLineGames.28
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\addrgjhelp.dll - Suspected MalwareDetector:Generic.PSW.3
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\addrmshelp.dll - Suspected MalwareDetector:Generic.PSW.3
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\addrzthelp.dll - Suspected MalwareDetector:Generic.PSW.3
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\kvdxcis.exe - Suspected MalwareDetector:Generic.PSW.3
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\kvdxcma.dll - Infected Win32.Trojan-PSW.OnLineGames.af
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\kvmxeis.exe - Suspected MalwareDetector:Generic.PSW.3
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\kvmxema.dll - Infected Win32.Trojan-PSW.OnLineGames.af
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\qdshm.dll - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\rsmyepm.dll - Infected Win32.Trojan-PSW.OnLineGames.af
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\rsmyesp.exe - Suspected MalwareDetector:Generic.PSW.3
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\host2.exe - Infected Win32.Trojan-PSW.OnLineGames.b
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\host3.exe - Infected Trojan-PSW.OnLineGames.48
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\host6.exe - Infected Trojan-PSW.OnLineGames.48
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\host7.exe - Infected Trojan-PSW.OnLineGames.48
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\host8.exe - OK
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\host9.exe - Suspected MalwareDetector:Generic.PSW.2
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\SysWin64.Sys - Infected Win32.Trojan-PSW.QQPass.a

18 Files scanned
9 Infected files found
7 Suspected files found
0 Files cured
9 Files deleted

woai_jolin

Scanning Log
Version of virus signature database: 2590 (20071012)
Date: 14.10.2007  Time: 11:21:45
Scanned disks, folders and files: G:\V\样本7.rar
G:\V\样本7.rar » RAR » 5DDF407CB734.dll - a variant of Win32/PSW.OnLineGames.NFF trojan
G:\V\样本7.rar » RAR » addrgjhelp.dll - is OK
G:\V\样本7.rar » RAR » addrmshelp.dll - is OK
G:\V\样本7.rar » RAR » addrzthelp.dll - is OK
G:\V\样本7.rar » RAR » kvdxcis.exe - probably a variant of Win32/Genetik trojan
G:\V\样本7.rar » RAR » kvdxcma.dll - is OK
G:\V\样本7.rar » RAR » kvmxeis.exe - probably a variant of Win32/Genetik trojan
G:\V\样本7.rar » RAR » kvmxema.dll - is OK
G:\V\样本7.rar » RAR » qdshm.dll - is OK
G:\V\样本7.rar » RAR » rsmyepm.dll - probably a variant of Win32/Genetik trojan
G:\V\样本7.rar » RAR » rsmyesp.exe - probably a variant of Win32/Genetik trojan
G:\V\样本7.rar » RAR » host2.exe - probably a variant of Win32/AutoRun.Q worm
G:\V\样本7.rar » RAR » host3.exe - is OK
G:\V\样本7.rar » RAR » host6.exe - is OK
G:\V\样本7.rar » RAR » host7.exe - is OK
G:\V\样本7.rar » RAR » host8.exe - Win32/TrojanDropper.Small.APR trojan
G:\V\样本7.rar » RAR » host9.exe - a variant of Win32/PSW.OnLineGames.NFF trojan
G:\V\样本7.rar » RAR » SysWin64.Sys - a variant of Win32/AutoRun.Q worm

yitp

金山这个是什么。。。。壳吗？

微点卫士

木马名称:Trojan-PSW.Win32.Delf.fqv

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本7\ADDRZTHELP.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan.Win32.Genetik.dbn

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本7\RSMYESP.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本7\HOST2.EXE
由
E:\AUTORUN.INF
自启动运行!
并生成以下文件:
1) E:\AUTORUN.EXE
2) E:\AUTORUN.INF
以及可由此INF文件引导自启的文件:
E:\AUTORUN.EXE

是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本7\HOST3.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\QDSHM.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本7\HOST6.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\QDSHM.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本7\HOST7.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\QDSHM.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本7\HOST8.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\XXXD.TMP
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\WINMOI.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本7\HOST9.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\DEBUG\5DDF407CB734.DLL
是否删除木马程序及其衍生物
?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本7\KVDXCIS.EXE
1) C:\DFD888015.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本7\KVDXCMA.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本7\KVMXEIS.EXE
1) C:\DFD911406.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本7\KVMXEIS.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\KVMXEMA.DLL
2) C:\WINDOWS.0\SYSTEM32\KVMXEIS.EXE
是否删除木马程序及其衍生物?木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本7\KVMXEMA.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?