一大堆

zane_xzz

[MD5: D8AE31 C49C79 EFA10A E7C372 38E56F 74FF0C 0017E0 96B735 4B1BDA 7F3442 4F94FB 96BC5A 373B36 3A3E98]

The EQs

C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » qj0617.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » qqsg.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » tl0619.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » wd0618.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » wl0618.exe - Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » wow0617.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » zt0616.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » cq0619.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » dh0616.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » dh3.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » e47e57844ef30ab4.exe - a variant of Win32/TrojanDownloader.Flux trojan
C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » jh0619.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » mh0618.exe - a variant of Win32/PSW.Agent.NEC trojan
C:\Documents and Settings\Don johnson\桌面\桌面.rar » RAR » my0616.exe - a variant of Win32/PSW.OnLineGames.YA trojan

残缺的唯美

Result: 12 malware found
Trojan-PSW.Win32.OnLineGames.gpi (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\qj0617.exe
Trojan-PSW.Win32.OnLineGames.gos (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\tl0619.exe
Trojan-PSW.Win32.OnLineGames.got (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\wd0618.exe
Trojan-PSW.Win32.OnLineGames.ghi (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\wl0618.exe
Trojan-PSW.Win32.OnLineGames.gpd (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\wow0617.exe
Trojan-PSW.Win32.Lmir.boq (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\cq0619.exe
Trojan-PSW.Win32.OnLineGames.gaa (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\dh0616.exe
Trojan-PSW.Win32.OnLineGames.gpo (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\dh3.exe
Virus.Win32.AutoRun.zn (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\e47e57844ef30ab4.exe
Trojan-PSW.Win32.OnLineGames.gox (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\jh0619.exe
Trojan-PSW.Win32.OnLineGames.gpc (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\mh0618.exe
Trojan-PSW.Win32.OnLineGames.gov (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\my0616.exe

hahacomcn

全部已知：
Begin scan in 'C:\Documents and Settings\Administrator\桌面\桌面.rar'
C:\Documents and Settings\Administrator\桌面\桌面.rar
  [0] Archive type: RAR
  --> qj0617.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> qqsg.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> tl0619.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> wd0618.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> wl0618.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> wow0617.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> zt0616.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> cq0619.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> dh0616.exe
      [DETECTION] Is the Trojan horse TR/Agent.18944.63
  --> dh3.exe
      [DETECTION] Is the Trojan horse TR/Agent.18944.113
  --> e47e57844ef30ab4.exe
      [DETECTION] Is the Trojan horse TR/Agent.12556.1
  --> jh0619.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.goy
  --> mh0618.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
  --> my0616.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen


End of the scan: 2007年11月2日  08:54
Used time: 00:07 min

The scan has been done completely.

      0 Scanning directories
     16 Files were scanned
     14 viruses and/or unwanted programs were found

wangjay1980

14
detected: Trojan program Trojan-PSW.Win32.OnLineGames.gpi        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/qj0617.exe//PE_Patch.UPX//UPX//PE_Patch
detected: virus Heur.Test        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/qqsg.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.gos        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/tl0619.exe//PE_Patch//UPack//PE_Patch
detected: Trojan program Trojan-PSW.Win32.OnLineGames.got        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/wd0618.exe//PE_Patch.UPX//UPX//PE_Patch
detected: Trojan program Trojan-PSW.Win32.OnLineGames.ghi        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/wl0618.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-PSW.Win32.OnLineGames.gpd        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/wow0617.exe
detected: virus Heur.Test        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/zt0616.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.Lmir.boq        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/cq0619.exe//ASPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.gaa        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/dh0616.exe//PE_Patch.UPX//UPX//PE_Patch
detected: Trojan program Trojan-PSW.Win32.OnLineGames.gpo        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/dh3.exe//PE_Patch.UPX//UPX
detected: virus Virus.Win32.AutoRun.zn        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/e47e57844ef30ab4.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.gox        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/jh0619.exe//PE_Patch.UPX//UPX//PE_Patch
detected: Trojan program Trojan-PSW.Win32.OnLineGames.gpc        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/mh0618.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.gov        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/my0616.exe//PE_Patch//UPack

红心王子

2007-11-2        9:58:07        1193968687        Administrator        2828        Sign of "Win32:Nilage-JY [Trj]" has been found in "D:\Downloads\1.rar\qj0617.exe\[UPX]\[Embedded#1c60]" file.  
2007-11-2        9:58:10        1193968690        Administrator        2828        Sign of "Win32:OnLineGames-BCD [Trj]" has been found in "D:\Downloads\1.rar\qqsg.exe\[Upack]" file.  
2007-11-2        9:58:10        1193968690        Administrator        2828        Sign of "Win32:Nilage-JY [Trj]" has been found in "D:\Downloads\1.rar\tl0619.exe\[Upack]\[Embedded#4060]" file.  
2007-11-2        9:58:10        1193968690        Administrator        2828        Sign of "Win32:Nilage-JY [Trj]" has been found in "D:\Downloads\1.rar\wd0618.exe\[UPX]\[Embedded#1c60]" file.  
2007-11-2        9:58:10        1193968690        Administrator        2828        Sign of "Win32:Nilage-JY [Trj]" has been found in "D:\Downloads\1.rar\wl0618.exe\[UPX]\[Embedded#1c60]" file.  
2007-11-2        9:58:10        1193968690        Administrator        2828        Sign of "Win32:Nilage-JY [Trj]" has been found in "D:\Downloads\1.rar\wow0617.exe\[Embedded#1a60]" file.  
2007-11-2        9:58:10        1193968690        Administrator        2828        Sign of "Win32:Nilage-JY [Trj]" has been found in "D:\Downloads\1.rar\wow0617.exe" file.  
2007-11-2        9:58:10        1193968690        Administrator        2828        Sign of "Win32:Lmir-OK [Trj]" has been found in "D:\Downloads\1.rar\cq0619.exe\[ASPack]\[Embedded#J999666]" file.  
2007-11-2        9:58:10        1193968690        Administrator        2828        Sign of "Win32:OnLineGames-BCD [Trj]" has been found in "D:\Downloads\1.rar\dh3.exe\[UPX]" file.  
2007-11-2        9:58:10        1193968690        Administrator        2828        Sign of "Win32:Nilage-JY [Trj]" has been found in "D:\Downloads\1.rar\jh0619.exe\[UPX]\[Embedded#1c60]" file.  
2007-11-2        9:58:10        1193968690        Administrator        2828        Sign of "Win32:OnLineGames-ST [Trj]" has been found in "D:\Downloads\1.rar\mh0618.exe\[Embedded#0c80]\[Upack]\[Embedded#5158]\[Upack]" file.  
2007-11-2        9:58:11        1193968691        Administrator        2828        Sign of "Win32:OnLineGames-SR [Trj]" has been found in "D:\Downloads\1.rar\mh0618.exe" file.

dyw1021

C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » qj0617.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » qqsg.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » tl0619.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » wd0618.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » wl0618.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » wow0617.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » zt0616.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » cq0619.exe - probably unknown NewHeur_PE virus
C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » dh0616.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » dh3.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » e47e57844ef30ab4.exe - a variant of Win32/TrojanDownloader.Flux trojan
C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » jh0619.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » mh0618.exe - a variant of Win32/PSW.Agent.NEC trojan
C:\Documents and Settings\Administrator\桌面\桌面.rar » RAR » my0616.exe - a variant of Win32/PSW.OnLineGames.YA trojan

capsshift

全部已知，红伞真强

uhthn2002

C:\Documents and Settings\Uhthn\Desktop\桌面\qj0617.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\Uhthn\Desktop\桌面\qqsg.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\Uhthn\Desktop\桌面\tl0619.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\Uhthn\Desktop\桌面\wd0618.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\Uhthn\Desktop\桌面\wl0618.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\Uhthn\Desktop\桌面\wow0617.exe : infected MalwareScope.Trojan-PSW.Game.1
C:\Documents and Settings\Uhthn\Desktop\桌面\zt0616.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\Uhthn\Desktop\桌面\cq0619.exe : infected MalwareScope.Trojan-PSW.Game.16
C:\Documents and Settings\Uhthn\Desktop\桌面\dh0616.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\Uhthn\Desktop\桌面\dh3.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\Uhthn\Desktop\桌面\e47e57844ef30ab4.exe : is suspected of Trojan-PSW.Game.63 (paranoid heuristics)
C:\Documents and Settings\Uhthn\Desktop\桌面\e47e57844ef30ab4.exe : backup copy created
C:\Documents and Settings\Uhthn\Desktop\桌面\jh0619.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\Uhthn\Desktop\桌面\mh0618.exe : is suspected of Malware.Agent.108 (paranoid heuristics)
C:\Documents and Settings\Uhthn\Desktop\桌面\mh0618.exe : backup copy created
C:\Documents and Settings\Uhthn\Desktop\桌面\my0616.exe : infected MalwareScope.Trojan-PSW.Game.3


Directories       : 0       Files in archives:      Files on disks:
Archives:                   - total       : 0       - total       : 14   
- scanned         : 0       -  scanned    : 0       - scanned     : 14   
- contain viruses : 0       -  infected   : 0       - infected    : 12   
- deleted         : 0       -  suspicious : 0       - suspicious  : 2     


Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 786
Paranoia Database - 48413
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\桌面

C:\Documents and Settings\Uhthn\Desktop\桌面\qj0617.exe - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\qqsg.exe - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\桌面\tl0619.exe - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\桌面\wd0618.exe - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\wl0618.exe - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\wow0617.exe - Infected TROJAN-PSW.ONLINEGAMES.12 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\zt0616.exe - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\桌面\cq0619.exe - Suspected MaliciousScope:WIN32.GENERIC.MALWARE.8
C:\Documents and Settings\Uhthn\Desktop\桌面\dh0616.exe - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\dh3.exe - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\e47e57844ef30ab4.exe - Infected BACKDOOR.AGENT.9 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\jh0619.exe - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\mh0618.exe - Infected TROJAN-PSW.ONLINEGAMES.U - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\my0616.exe - Suspected TROJAN-PSW.ONLINEGAMES.2

14 Files scanned
9 Infected files found
5 Suspected files found
0 Files disinfected
9 Files deleted

scottxzt

木马名称:Trojan-PSW.Win32.OnLineGames.szj

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\DH0616.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\CQ0619.EXE
木马程序生成以下文件:
1) C:\WINDOWS\IGM.EXE
2) C:\WINDOWS\684745MM.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\DH3.EXE
木马程序生成以下文件:
1) C:\WINDOWS\DBGHLP32.EXE
2) C:\WINDOWS\SYSTEM32\DBGHLP32.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\E47E57844EF30AB4.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\EB3FC60C.EXE
2) C:\WINDOWS\SYSTEM32\E5046A58.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\JH0619.EXE
木马程序生成以下文件:
1) C:\WINDOWS\CMDBCS.EXE
2) C:\WINDOWS\SYSTEM32\CMDBCS.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\MH0618.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\LYLOADER.EXE
2) C:\WINDOWS\SYSTEM32\LYLOADER.EXE
3) C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\LYMANGR.DLL
4) C:\WINDOWS\SYSTEM32\LYMANGR.DLL
5) C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\MSDEG32.DLL
6) C:\WINDOWS\SYSTEM32\MSDEG32.DLL
程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\MY0616.EXE
木马程序生成以下文件:
1) C:\WINDOWS\GENPROTECT.EXE
2) C:\WINDOWS\SYSTEM32\GENPROTECT.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\QJ0617.EXE
木马程序生成以下文件:
1) C:\WINDOWS\KVSC3.EXE
2) C:\WINDOWS\SYSTEM32\KVSC3.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\QQSG.EXE
木马程序生成以下文件:
1) C:\WINDOWS\MSPRINT32D.EXE
2) C:\WINDOWS\SYSTEM32\MSPRINT32D.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\TL0619.EXE
木马程序生成以下文件:
1) C:\WINDOWS\AVPSRV.EXE
2) C:\WINDOWS\SYSTEM32\AVPSRV.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\WD0618.EXE
木马程序生成以下文件:
1) C:\WINDOWS\MSIMMS32.EXE
2) C:\WINDOWS\SYSTEM32\MSIMMS32.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\WL0618.EXE
木马程序生成以下文件:
1) C:\WINDOWS\MSCCRT.EXE
2) C:\WINDOWS\SYSTEM32\MSCCRT.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\WOW0617.EXE
木马程序生成以下文件:
1) C:\WINDOWS\MPPDS.EXE
2) C:\WINDOWS\SYSTEM32\MPPDS.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\ZT0616.EXE
木马程序生成以下文件:
1) C:\WINDOWS\UPXDND.EXE
2) C:\WINDOWS\SYSTEM32\UPXDND.DLL
是否删除木马程序及其衍生物?