可能是 Win32/PcClient 木马 的一个变种

泥鳅

密码：virus

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.Agent.twp   
病毒： Trojan.Win32.Agent.twp   
病毒： Trojan.Win32.Agent.twp   

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.16.12

泥鳅

F-Secure 报 W32/PCClient.DYR.dropper ， Kaspersky 竟没报……

欠妳緈諨

AVAST杀

欠妳緈諨

卡巴灭之

blue1984

  原来LS的斑竹同志 用的是AVK07 分开2个引擎杀呀 嘿嘿 难怪。。。刚看到还楞了一下。。。顺便说一下 红伞也杀了

残缺的唯美

deleted: Trojan program Backdoor.Win32.PcClient.yz        File: C:\Users\Administrator\Desktop\msiNFO\msiNFO\temparation.tmp
deleted: Trojan program Backdoor.Win32.PcClient.zs        File: C:\Users\Administrator\Desktop\msiNFO\msiNFO\zwatggzp.dll
deleted: Trojan program Backdoor.Win32.PcClient.zb        File: C:\Users\Administrator\Desktop\msiNFO\msiNFO\zwatggzp.drv
deleted: Trojan program Backdoor.Win32.PcClient.zb        File: C:\Users\Administrator\Desktop\msiNFO\msiNFO\zwatggzp.sys

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 736
Paranoia Database - 48287
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\msiNFO

C:\Documents and Settings\Uhthn\Desktop\msiNFO\zwatggzp.drv - Infected GENERIC.MALWARE.892.45F7 - Deleted
C:\Documents and Settings\Uhthn\Desktop\msiNFO\temparation.tmp - OK
C:\Documents and Settings\Uhthn\Desktop\msiNFO\zwatggzp.dll - Suspected TROJAN-DOWNLOADER.AGENT.1
C:\Documents and Settings\Uhthn\Desktop\msiNFO\zwatggzp.sys - Infected GENERIC.MALWARE.DCA.1E80 - Deleted

4 Files scanned
2 Infected files found
1 Suspected files found
0 Files disinfected
2 Files deleted

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\msiNFO'
C:\Users\morgan\Documents\msiNFO\
  temparation.tmp
      [DETECTION] Contains detection pattern of the dropper DR/PcClient.Gen
      [INFO]      The file was deleted!
  zwatggzp.dll
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Pcclient.ZB.23 Backdoor server programs
      [INFO]      The file was deleted!
  zwatggzp.drv
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Pcclient.ZB.22 Backdoor server programs
      [INFO]      The file was deleted!
  zwatggzp.sys
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Pcclient.ZB.24 Backdoor server programs
      [INFO]      The file was deleted!

啊弥陀佛

木马名称:Backdoor.Win32.PcClient.avw
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MSINFO\MSINFO\ZWATGGZP.DRV
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Backdoor.Win32.PcClient.aui
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MSINFO\MSINFO\TEMPARATION.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?


木马名称:Backdoor.Win32.PcClient.avx
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\MSINFO\MSINFO\ZWATGGZP.SYS
是木马程序!
已成功阻止其运行,是否要删除此文件?

微点砍掉