11支

显示全部楼层 · 发表于 2007-10-31 19:10:09

[MD5: 63283F AE11C3 8BDC0C 206E48 D0522C 2546D9 771A45 01FAC1 D15FF0 F37335 368BDA]

显示全部楼层 · 发表于 2007-10-31 19:10:51

deleted: Trojan program Trojan-PSW.Win32.QQPass.ajm File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/NvSys74.Sys
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.gmh File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/rsmygpm.dll
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.gme File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/kvdxgma.dll
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.gmh File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/rsmygsp.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.gmd File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/kvdxgis.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.gmi File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/addrcqhelp.dll//UPack
deleted: Trojan program Trojan-PSW.Win32.WOW.acl File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/qdshm.dll//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.fsd File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/host9.exe//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.gmi File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/host6.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.gnt File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/host7.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.QQPass.ajl File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/host2.exe//UPX

显示全部楼层 · 发表于 2007-10-31 19:11:34

C:\Documents and Settings\Don johnson\桌面\样本(1).rar » RAR » NvSys74.Sys - Win32/AutoRun.CE worm
C:\Documents and Settings\Don johnson\桌面\样本(1).rar » RAR » rsmygpm.dll - Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\Don johnson\桌面\样本(1).rar » RAR » kvdxgma.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\Don johnson\桌面\样本(1).rar » RAR » rsmygsp.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\Don johnson\桌面\样本(1).rar » RAR » kvdxgis.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\Don johnson\桌面\样本(1).rar » RAR » addrcqhelp.dll - a variant of Win32/PSW.OnLineGames.DMQ trojan
C:\Documents and Settings\Don johnson\桌面\样本(1).rar » RAR » qdshm.dll - a variant of Win32/PSW.OnLineGames.NHF trojan
C:\Documents and Settings\Don johnson\桌面\样本(1).rar » RAR » host9.exe - a variant of Win32/PSW.OnLineGames.NFN trojan
C:\Documents and Settings\Don johnson\桌面\样本(1).rar » RAR » host6.exe - probably a variant of Win32/PSW.OnLineGames.NGU trojan
C:\Documents and Settings\Don johnson\桌面\样本(1).rar » RAR » host7.exe - probably a variant of Win32/PSW.OnLineGames.NGU trojan
C:\Documents and Settings\Don johnson\桌面\样本(1).rar » RAR » host2.exe - probably a variant of Win32/AutoRun.Q worm

显示全部楼层 · 发表于 2007-10-31 19:15:56

Begin scan in 'C:\Documents and Settings\dell\桌面\样本.rar'
C:\Documents and Settings\dell\桌面\样本.rar
  [0] Archive type: RAR
  --> NvSys74.Sys
   [DETECTION] Contains suspicious code HEUR/Malware
  --> rsmygpm.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> kvdxgma.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> rsmygsp.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> kvdxgis.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> addrcqhelp.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> qdshm.dll
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
  --> host9.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fsd.2
  --> host6.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> host7.exe
   [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
  --> host2.exe
   [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
   [WARNING] The file was ignored!

[ 本帖最后由 scottxzt 于 2007-10-31 19:17 编辑 ]

显示全部楼层 · 发表于 2007-10-31 19:20:51

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 736
Paranoia Database - 48287
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder (3)

C:\Documents and Settings\Uhthn\Desktop\New Folder (3)\NvSys74.Sys - Infected WIN32.TROJAN-PSW.QQPASS.A - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (3)\rsmygpm.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (3)\kvdxgma.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (3)\rsmygsp.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (3)\kvdxgis.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (3)\addrcqhelp.dll - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (3)\qdshm.dll - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (3)\host9.exe - Infected GENERIC.MALWARE.D0E.3600 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (3)\host6.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (3)\host7.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (3)\host2.exe - Infected WIN32.TROJAN-PSW.QQPASS.A - Deleted

11 Files scanned
7 Infected files found
4 Suspected files found
0 Files disinfected
7 Files deleted

显示全部楼层 · 发表于 2007-10-31 19:34:10

小a 8个

2007-10-31 19:33:54 1193830434 Administrator 2760 Sign of "Win32:Delf-FZG [Trj]" has been found in "D:\Downloads\样本.rar\NvSys74.Sys" file.
2007-10-31 19:33:56 1193830436 Administrator 2760 Sign of "Win32:OnLineGames-BGD [Trj]" has been found in "D:\Downloads\样本.rar\rsmygpm.dll" file.
2007-10-31 19:33:56 1193830436 Administrator 2760 Sign of "Win32:OnLineGames-BGD [Trj]" has been found in "D:\Downloads\样本.rar\kvdxgma.dll" file.
2007-10-31 19:33:56 1193830436 Administrator 2760 Sign of "Win32:OnLineGames-BGD [Trj]" has been found in "D:\Downloads\样本.rar\rsmygsp.exe\[Upack]\[Embedded#MUSIC]" file.
2007-10-31 19:33:56 1193830436 Administrator 2760 Sign of "Win32:OnLineGames-BGD [Trj]" has been found in "D:\Downloads\样本.rar\kvdxgis.exe\[Upack]\[Embedded#MUSIC]" file.
2007-10-31 19:33:56 1193830436 Administrator 2760 Sign of "Win32:OnLineGames-ALL [Trj]" has been found in "D:\Downloads\样本.rar\host9.exe\[UPX]\[Embedded#1670]" file.
2007-10-31 19:33:56 1193830436 Administrator 2760 Sign of "Win32:OnLineGames-BBH [Trj]" has been found in "D:\Downloads\样本.rar\host7.exe\[Upack]\[Embedded#5090]\[Upack]" file.
2007-10-31 19:33:56 1193830436 Administrator 2760 Sign of "Win32:Delf-FZG [Trj]" has been found in "D:\Downloads\样本.rar\host2.exe\[UPX]\[Embedded#4cf8]" file.

显示全部楼层 · 发表于 2007-10-31 20:20:20

Result: 11 malware found
Trojan-PSW.Win32.QQPass.ajm (virus)
C:\Users\Administrator\Desktop\Ñù±¾.rar\NvSys74.Sys
Trojan-PSW.Win32.OnLineGames.gmh (virus)
C:\Users\Administrator\Desktop\Ñù±¾.rar\rsmygpm.dll
C:\Users\Administrator\Desktop\Ñù±¾.rar\rsmygsp.exe
Trojan-PSW.Win32.OnLineGames.gme (virus)
C:\Users\Administrator\Desktop\Ñù±¾.rar\kvdxgma.dll
Trojan-PSW.Win32.OnLineGames.gmd (virus)
C:\Users\Administrator\Desktop\Ñù±¾.rar\kvdxgis.exe
Trojan-PSW.Win32.OnLineGames.gmi (virus)
C:\Users\Administrator\Desktop\Ñù±¾.rar\addrcqhelp.dll
C:\Users\Administrator\Desktop\Ñù±¾.rar\host6.exe
Trojan-PSW.Win32.WOW.acl (virus)
C:\Users\Administrator\Desktop\Ñù±¾.rar\qdshm.dll
Trojan-PSW.Win32.OnLineGames.fsd (virus)
C:\Users\Administrator\Desktop\Ñù±¾.rar\host9.exe
Trojan-PSW.Win32.OnLineGames.gnt (virus)
C:\Users\Administrator\Desktop\Ñù±¾.rar\host7.exe
Trojan-PSW.Win32.QQPass.ajl (virus)
C:\Users\Administrator\Desktop\Ñù±¾.rar\host2.exe

显示全部楼层 · 发表于 2007-11-1 13:50:03

还有pabug，就是“怕虫”病毒吧？

显示全部楼层 · 发表于 2007-11-1 15:09:21

毒霸10只,瑞星11只,AVG11只,发过的不发了.

显示全部楼层 · 发表于 2007-11-1 15:19:54

使用 AntiVirusKit 进行病毒扫描
版本
病毒签名 11/1/2007
开始时间: 11/1/2007 15:18
引擎: KAV 引擎 (AVK 18.79), AVAST 引擎 (AVKB 18.3)
高启发: 开启
文件: 开启
系统区域: 开启

扫描系统区域...
扫描选中目录和文件...
项目: NvSys74.Sys
路径: C:\Documents and Settings\Administrator\桌面\新建文件夹
状态: 发现病毒
病毒: Trojan-PSW.Win32.QQPass.ajm (KAV 引擎)
项目: rsmygpm.dll
路径: C:\Documents and Settings\Administrator\桌面\新建文件夹
状态: 发现病毒
病毒: Trojan-PSW.Win32.OnLineGames.gmh (KAV 引擎)
项目: kvdxgma.dll
路径: C:\Documents and Settings\Administrator\桌面\新建文件夹
状态: 发现病毒
病毒: Trojan-PSW.Win32.OnLineGames.gme (KAV 引擎)
项目: rsmygsp.exe
路径: C:\Documents and Settings\Administrator\桌面\新建文件夹
状态: 病毒,文件删除
病毒: Trojan-PSW.Win32.OnLineGames.gmh (KAV 引擎)
项目: kvdxgis.exe
路径: C:\Documents and Settings\Administrator\桌面\新建文件夹
状态: 未知
病毒: Trojan-PSW.Win32.OnLineGames.gmd (KAV 引擎)
项目: addrcqhelp.dll
路径: C:\Documents and Settings\Administrator\桌面\新建文件夹
状态: 未知
病毒: Trojan-PSW.Win32.OnLineGames.gmi (KAV 引擎)
项目: qdshm.dll
路径: C:\Documents and Settings\Administrator\桌面\新建文件夹
状态: 未知
病毒: Trojan-PSW.Win32.WOW.acl (KAV 引擎)
项目: host9.exe
路径: C:\Documents and Settings\Administrator\桌面\新建文件夹
状态: 未知
病毒: Trojan-PSW.Win32.OnLineGames.fsd (KAV 引擎)
项目: host6.exe
路径: C:\Documents and Settings\Administrator\桌面\新建文件夹
状态: 未知
病毒: Trojan-PSW.Win32.OnLineGames.gmi (KAV 引擎)
项目: host2.exe
路径: C:\Documents and Settings\Administrator\桌面\新建文件夹
状态: 病毒,文件删除
病毒: Trojan-PSW.Win32.QQPass.ajl (KAV 引擎)
病毒分析完成: 11/1/2007 15:18
11 文件被检查
10 感染文件发现
0 发现可疑文件

[病毒样本] 11支

本帖子中包含更多资源

11

全灭

11个