8个[MD5: F8E444 3E51DF 99498A AF1D38 5B9CB0 B3D378 D3DB0B 6DADA1]

promised

liunanyuan

Start of the scan: 2007年10月20日  09:02

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\Desktop\样本1.rar'
C:\Documents and Settings\Administrator\Desktop\样本1.rar
  [0] Archive type: RAR
  --> ysy15.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.cvv.2
  --> host5.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> mir.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> zhjtrx.dll
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
  --> qdshm.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> kvmxfma.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> addrcqhelp.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      A backup was created as '474abae4.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

promised

C:\ABC\样本1.rar:\ysy15.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.czg' 被发现
C:\ABC\样本1.rar:\host5.exe - 特征码 'Trojan-Spy.Win32.Bancos.ha' 被发现
C:\ABC\样本1.rar:\19.exe - 特征码 'Trojan-PWS.Win32.Small.br' 被发现
C:\ABC\样本1.rar:\mir.exe - 特征码 'Trojan-Spy.Win32.Delf.PD' 被发现
C:\ABC\样本1.rar:\zhjtrx.dll - 特征码 'Trojan-PWS.Win32.Small.br' 被发现
C:\ABC\样本1.rar:\qdshm.dll - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本1.rar:\kvmxfma.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\样本1.rar:\addrcqhelp.dll - 特征码 'Trojan-PWS.Win32.Small.br' 被发现
C:\ABC\样本1.rar

        9 文件被扫描
          (1 压缩档 8 文件)
        8 特征码被侦测
        0 可疑代码段被发现
        耗时: 0:00.110

平淡

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\样本1.rar'
C:\Users\morgan\Documents\
  样本1.rar
    [0] Archive type: RAR
    --> ysy15.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.cvv.2
        [WARNING]   Infected files in archives cannot be repaired!
    --> host5.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 19.exe
        [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
        [WARNING]   Infected files in archives cannot be repaired!
    --> mir.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
        [WARNING]   Infected files in archives cannot be repaired!
    --> zhjtrx.dll
        [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> qdshm.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvmxfma.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> addrcqhelp.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年10月19日  18:11
Used time: 00:05 min

The scan has been done completely.

      0 Scanning directories
      9 Files were scanned
      6 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      1 Archives were scanned
      9 Warnings
      0 Notes

timhas266

Start of the scan: Saturday, 20 October, 2007  09:27

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\樣本'
C:\Documents and Settings\tim\桌面\樣本\欴掛1.rar
  [0] Archive type: RAR
  --> ysy15.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.cvv.2
  --> host5.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 19.exe
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
  --> mir.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> zhjtrx.dll
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
  --> qdshm.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.dmj
  --> kvmxfma.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> addrcqhelp.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      A backup was created as '474abd20.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: Saturday, 20 October, 2007  09:27
Used time: 00:02 min

The scan has been done completely.

      1 Scanning directories
     10 Files were scanned
      6 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

xlang

扫描进行于：2007-10-20 10:24:20
扫描日志
NOD32版本 2604 (20071019) NT
命令行： C:\Documents and Settings\Administrator\桌面\样本1.rar


日期： 20.10.2007  时间：10:24:21
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\Administrator\桌面\样本1.rar
C:\Documents and Settings\Administrator\桌面\样本1.rar >>RAR >>ysy15.exe - Win32/PSW.Legendmir.NEP 木马
C:\Documents and Settings\Administrator\桌面\样本1.rar >>RAR >>host5.exe - Win32/PSW.OnLineGames.FDY 木马
C:\Documents and Settings\Administrator\桌面\样本1.rar >>RAR >>mir.exe - 可能是 Win32/PSW.OnLineGames.NGU 木马 的一个变种
C:\Documents and Settings\Administrator\桌面\样本1.rar >>RAR >>qdshm.dll - Win32/PSW.OnLineGames.NHF 木马的变种
C:\Documents and Settings\Administrator\桌面\样本1.rar >>RAR >>kvmxfma.dll - Win32/PSW.OnLineGames.FDY 木马
C:\Documents and Settings\Administrator\桌面\样本1.rar >>RAR >>addrcqhelp.dll - 可能是 Win32/PSW.OnLineGames.NHF 木马 的一个变种
已扫描的文件数目：8
已发现的病毒数目：6
完成时间： 10:24:22 总扫描时间：1 秒 (00:00:01)

qq890

C:\Documents and Settings\admin\桌面\样本1.rar>>ysy15.exe>>aspack212r
Trojan.PSW.Win32.Shanda.w

瑞星报一个

残缺的唯美

Result: 4 malware found
Trojan-PSW.Win32.OnLineGames.czg (virus)
C:\Users\Administrator\Desktop\Ñù±¾1.rar\ysy15.exe
Trojan-PSW.Win32.OnLineGames.fls (virus)
C:\Users\Administrator\Desktop\Ñù±¾1.rar\19.exe
Trojan-PSW.Win32.OnLineGames.fnq (virus)
C:\Users\Administrator\Desktop\Ñù±¾1.rar\zhjtrx.dll
Trojan-PSW.Win32.OnLineGames.fht (virus)
C:\Users\Administrator\Desktop\Ñù±¾1.rar\qdshm.dll

wangjay1980

detected: Trojan program Trojan-PSW.Win32.OnLineGames.czg        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/ysy15.exe//ASPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fls        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/19.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fht        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/mir.exe//PE_Patch//UPack//#//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fnq        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/zhjtrx.dll//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fht        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/qdshm.dll//UPack