破影子系统的东东

The EQs

C:\Documents and Settings\Don johnson\桌面\golden.rar » RAR » userinit.exe - Win32/TrojanDownloader.Agent.NRU trojan

运指如飞

大蜘蛛报了
能破坏影子系统？

a256886572008

下載了21隻

裡面有一隻是機器狗







[ 本帖最后由 a256886572008 于 2007-11-1 09:04 编辑 ]

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\dload1'
C:\Users\morgan\Documents\dload1\
  111.tmp
  112.tmp
      [DETECTION] Is the Trojan horse TR/Agent.43569
      [INFO]      The file was deleted!
  113.tmp
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!
  114.tmp
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
      [INFO]      The file was deleted!
  115.tmp
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!
  116.tmp
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [INFO]      The file was deleted!
  117.tmp
      [DETECTION] Contains detection pattern of the worm WORM/AutoRun.FF.6
      [INFO]      The file was deleted!
  118.tmp
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
      [INFO]      The file was deleted!
  119.tmp
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gjw
      [INFO]      The file was deleted!
  11A.tmp
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gnb
      [INFO]      The file was deleted!
  11B.tmp
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fzw.3
      [INFO]      The file was deleted!
  11C.tmp
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gie
      [INFO]      The file was deleted!
  11D.tmp
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!
  11E.tmp
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!
  11F.tmp
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.giy
      [INFO]      The file was deleted!
  120.tmp
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!
  121.tmp
      [DETECTION] Is the Trojan horse TR/FWDisable.20042.2
      [INFO]      The file was deleted!
  122.tmp
      [DETECTION] Is the Trojan horse TR/CrashSystem.C
      [INFO]      The file was deleted!
  123.tmp
      [DETECTION] Is the Trojan horse TR/Agent.19576
      [INFO]      The file was deleted!
  124.tmp
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!
  125.tmp
  126.tmp
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gis
      [INFO]      The file was deleted!
  127.tmp
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gmo
      [INFO]      The file was deleted!
  a10[1].exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fzw.3
      [INFO]      The file was deleted!
  a11[1].exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gie
      [INFO]      The file was deleted!
  a12[1].exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!
  a13[1].exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!
  a14[1].exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.giy
      [INFO]      The file was deleted!
  a15[1].exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!
  a16[1].exe
      [DETECTION] Is the Trojan horse TR/FWDisable.20042.2
      [INFO]      The file was deleted!
  a17[1].exe
      [DETECTION] Is the Trojan horse TR/CrashSystem.C
      [INFO]      The file was deleted!
  a18[1].exe
      [DETECTION] Is the Trojan horse TR/Agent.19576
      [INFO]      The file was deleted!
  a19[1].exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!
  a1[1].exe
      [DETECTION] Is the Trojan horse TR/Agent.43569
      [INFO]      The file was deleted!
  a21[1].exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gis
      [INFO]      The file was deleted!
  a22[1].exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gmo
      [INFO]      The file was deleted!
  a2[1].exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!
  a3[1].exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
      [INFO]      The file was deleted!
  a4[1].exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!
  a5[1].exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [INFO]      The file was deleted!
  a6[1].exe
      [DETECTION] Contains detection pattern of the worm WORM/AutoRun.FF.6
      [INFO]      The file was deleted!
  a7[1].exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
      [INFO]      The file was deleted!
  a8[1].exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gjw
      [INFO]      The file was deleted!
  a9[1].exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gnb
      [INFO]      The file was deleted!
  test[1].htm
  userinit.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.8
      [INFO]      The file was deleted!


End of the scan: 2007年10月31日  18:05
Used time: 00:06 min

The scan has been done completely.

      1 Scanning directories
     46 Files were scanned
     43 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     43 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes

mofunzone

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\a4.exe'
C:\TDDOWNLOAD\
  a4.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a5.exe'
C:\TDDOWNLOAD\
  a5.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a6.exe'
C:\TDDOWNLOAD\
  a6.exe
      [DETECTION] Contains detection pattern of the worm WORM/AutoRun.FF.6
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a7.exe'
C:\TDDOWNLOAD\
  a7.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a8.exe'
C:\TDDOWNLOAD\
  a8.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gjw
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a9.exe'
C:\TDDOWNLOAD\
  a9.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gnb
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a10.exe'
C:\TDDOWNLOAD\
  a10.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.fzw.3
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a11.exe'
C:\TDDOWNLOAD\
  a11.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gie
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a12.exe'
C:\TDDOWNLOAD\
  a12.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a13.exe'
C:\TDDOWNLOAD\
  a13.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a14.exe'
C:\TDDOWNLOAD\
  a14.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.giy
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a15.exe'
C:\TDDOWNLOAD\
  a15.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.giz
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a16.exe'
C:\TDDOWNLOAD\
  a16.exe
      [DETECTION] Is the Trojan horse TR/FWDisable.20042.2
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a17.exe'
C:\TDDOWNLOAD\
  a17.exe
      [DETECTION] Is the Trojan horse TR/CrashSystem.C
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a18.exe'
C:\TDDOWNLOAD\
  a18.exe
      [DETECTION] Is the Trojan horse TR/Agent.19576
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a19.exe'
C:\TDDOWNLOAD\
  a19.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a20.exe'
C:\TDDOWNLOAD\
  a20.exe
      [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a21.exe'
C:\TDDOWNLOAD\
  a21.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gis
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a22.exe'
C:\TDDOWNLOAD\
  a22.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gmo
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a1.exe'
C:\TDDOWNLOAD\
  a1.exe
      [DETECTION] Is the Trojan horse TR/Agent.43569
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a2.exe'
C:\TDDOWNLOAD\
  a2.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\a3.exe'
C:\TDDOWNLOAD\
  a3.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
      [INFO]      The file was deleted!


End of the scan: 2007年10月31日  18:07
Used time: 00:05 min

The scan has been done completely.

      0 Scanning directories
     22 Files were scanned
     22 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     22 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      0 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes

啊弥陀佛

木马名称:Trojan-Downloader.Win32.Agent.lip
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\GOLDEN\USERINIT.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-Downloader.Win32.Delf.hmu
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\115.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-Downloader.Win32.Agent.liq
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\118.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-Downloader.Win32.Delf.hmu
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A4[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-Downloader.Win32.Agent.liq
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A7[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-Downloader.Win32.Agent.lip
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\USERINIT.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A1[1].EXE
是可疑程序!
试图修改系统时间!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A2[1].EXE
木马程序生成以下文件:
1) C:\WINDOWS\GENPROTECT.EXE
2) C:\WINDOWS\SYSTEM32\GENPROTECT.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A3[1].EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYLOADER.EXE
2) C:\WINDOWS\SYSTEM32\LYLOADER.EXE
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYMANGR.DLL
4) C:\WINDOWS\SYSTEM32\LYMANGR.DLL5) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\MSDEG32.DLL
6) C:\WINDOWS\SYSTEM32\MSDEG32.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A5[1].EXE
木马程序生成以下文件:
1) C:\WINDOWS\UPXDND.EXE
2) C:\WINDOWS\SYSTEM32\UPXDND.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A6[1].EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSWIN6K.JMP
2) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\WINSYS8X.SYS
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A8[1].EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\XGOWJQWDKR.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A9[1].EXE
1) C:\DFD4392250.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A10[1].EXE
木马程序生成以下文件:
1) C:\WINDOWS\CMDBCS.EXE
2) C:\WINDOWS\SYSTEM32\CMDBCS.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A11[1].EXE
1) C:\DFD4423640.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A12[1].EXE
木马程序生成以下文件:
1) C:\WINDOWS\DBGHLP32.EXE
2) C:\WINDOWS\SYSTEM32\DBGHLP32.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A13[1].EXE
木马程序生成以下文件:
1) C:\WINDOWS\IGM.EXE
2) C:\WINDOWS\391231MM.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A14[1].EXE
1) C:\DFD4629296.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A15[1].EXE
1) C:\DFD4640468.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A16[1].EXE
1) C:\DFD4654171.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A17[1].EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\SQMAPI32.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A18[1].EXE
1) C:\DFD4681359.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A19[1].EXE
1) C:\DFD4786046.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A21[1].EXE
木马程序生成以下文件:
1) C:\WINDOWS\391231WL.DLL
2) C:\WINDOWS\SWCHOST.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\A22[1].EXE
可疑程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\QXGNAHOUCIPV.DLL
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\11A.TMP.EXE
1) C:\DFD4867375.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\11B.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\11E.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\11D.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\113.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\116.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\117.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?


木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\119.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\122.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?


木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\126.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\11C.TMP.EXE
1) C:\DFD5034343.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\11F.TMP.EXE
1) C:\DFD5048453.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\114.TMP.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\LYLOADER.EXE
2) C:\WINDOWS\SYSTEM32\LYLOADER.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\DLOAD1[1]\121.TMP.EXE
1) C:\DFD5179156.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

微点砍掉

黄金马甲出租

机器狗过不了影子的

九邪

我解压后，里面是空目录，哈哈

googlehack

影子系统本身就不太成熟吧！换个虚拟机试试。

PlayWill