[MD5: 979704 F96E7B FFA76C 426AE7 D79A34 E5F815 A55278 AA888A D27791]

显示全部楼层 · 发表于 2007-11-2 08:41:10

显示全部楼层 · 发表于 2007-11-2 08:43:02

C:\Documents and Settings\Don johnson\桌面\桌面(1).rar » RAR » bak.css - a variant of Win32/Delf.NDV worm
C:\Documents and Settings\Don johnson\桌面\桌面(1).rar » RAR » 0.exe - a variant of Win32/PSW.OnLineGames.NFN trojan
C:\Documents and Settings\Don johnson\桌面\桌面(1).rar » RAR » 1.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\桌面(1).rar » RAR » 2.exe - probably a variant of Win32/PSW.OnLineGames.NGU trojan
C:\Documents and Settings\Don johnson\桌面\桌面(1).rar » RAR » 4.exe - probably a variant of Win32/PSW.OnLineGames.NGU trojan
C:\Documents and Settings\Don johnson\桌面\桌面(1).rar » RAR » 5.exe - probably a variant of Win32/PSW.OnLineGames.NGU trojan
C:\Documents and Settings\Don johnson\桌面\桌面(1).rar » RAR » pk.exe - a variant of Win32/Delf.NDV worm
C:\Documents and Settings\Don johnson\桌面\桌面(1).rar » RAR » Baidu.CAB » CAB » Baidu.exe - a variant of Win32/Delf.NDV worm

显示全部楼层 · 发表于 2007-11-2 08:54:39

Result: 9 malware found
Trojan-Downloader.Win32.Baser.aj (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\bak.css
Trojan-PSW.Win32.OnLineGames.fqp (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\0.exe
Trojan-PSW.Win32.OnLineGames.gov (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\1.exe
Trojan-PSW.Win32.OnLineGames.gbq (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\2.exe
Trojan-PSW.Win32.OnLineGames.gog (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\4.exe
Trojan-PSW.Win32.OnLineGames.gbs (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\5.exe
Trojan-PSW.Win32.Lmir.bnn (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\7.exe
Trojan-Dropper.Win32.Agent.cla (virus)
C:\Users\Administrator\Desktop\×ÀÃæ.rar\pk.exe
C:\Users\Administrator\Desktop\×ÀÃæ.rar\Baidu.CAB\Baidu.exe

显示全部楼层 · 发表于 2007-11-2 08:58:03

9个

Begin scan in 'C:\Documents and Settings\Administrator\桌面\桌面.rar'
C:\Documents and Settings\Administrator\桌面\桌面.rar
  [0] Archive type: RAR
  --> bak.css
   [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> 0.exe
   [DETECTION] Is the Trojan horse TR/PSW.Online.ddm.1
  --> 1.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 2.exe
   [DETECTION] Is the Trojan horse TR/PSW.Online.fmu.2
  --> 4.exe
   [DETECTION] Is the Trojan horse TR/Spw.OnlineGa.GJT
  --> 5.exe
   [DETECTION] Is the Trojan horse TR/Agent.5859
  --> 7.exe
   [DETECTION] Is the Trojan horse TR/Drop.Age.20889.B
  --> pk.exe
   [DETECTION] Is the Trojan horse TR/PSW.LdPinch.jm1
--> Baidu.CAB
   [1] Archive type: CAB (Microsoft)
   --> Baidu.exe
      [DETECTION] Is the Trojan horse TR/PSW.LdPinch.jm1

显示全部楼层 · 发表于 2007-11-2 09:34:33

9
detected: Trojan program Trojan-Downloader.Win32.Baser.aj File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ1.rar/bak.css
detected: Trojan program Trojan-PSW.Win32.OnLineGames.fqp File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ1.rar/0.exe//UPX
detected: Trojan program Trojan-PSW.Win32.OnLineGames.gov File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ1.rar/1.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.gbq File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ1.rar/2.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.gog File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ1.rar/4.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.gbs File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ1.rar/5.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.Lmir.bnn File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ1.rar/7.exe//UPX
detected: Trojan program Trojan-Dropper.Win32.Agent.cla File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ1.rar/pk.exe//PE_Patch
detected: Trojan program Trojan-Dropper.Win32.Agent.cla File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ1.rar/Baidu.CAB/Baidu.exe//PE_Patch

显示全部楼层 · 发表于 2007-11-2 09:49:25

小a 8个

2007-11-2 9:47:25 1193968045 Administrator 1568 Sign of "Win32:Delf-GFP [Trj]" has been found in "D:\Downloads\桌面.rar\bak.css" file.
2007-11-2 9:47:30 1193968050 Administrator 1568 Sign of "Win32:OnLineGames-BEY [Trj]" has been found in "D:\Downloads\桌面.rar\0.exe\[UPX]\[Embedded#1470]" file.
2007-11-2 9:47:30 1193968050 Administrator 1568 Sign of "Win32:Agent-MDY [Trj]" has been found in "D:\Downloads\桌面.rar\2.exe\[Upack]\[Embedded#7288]\[Upack]" file.
2007-11-2 9:47:30 1193968050 Administrator 1568 Sign of "Win32:OnLineGames-BEI [Trj]" has been found in "D:\Downloads\桌面.rar\4.exe\[Upack]\[Embedded#5090]\[Upack]" file.
2007-11-2 9:47:30 1193968050 Administrator 1568 Sign of "Win32:OnLineGames-BEG [Trj]" has been found in "D:\Downloads\桌面.rar\5.exe\[Upack]\[Embedded#5090]\[Upack]" file.
2007-11-2 9:47:30 1193968050 Administrator 1568 Sign of "Win32:Lmir-OJ [Trj]" has been found in "D:\Downloads\桌面.rar\7.exe\[UPX]" file.
2007-11-2 9:47:30 1193968050 Administrator 1568 Sign of "Win32:Joiner-H [Trj]" has been found in "D:\Downloads\桌面.rar\pk.exe" file.
2007-11-2 9:47:30 1193968050 Administrator 1568 Sign of "Win32:Joiner-H [Trj]" has been found in "D:\Downloads\桌面.rar\Baidu.CAB\Baidu.exe" file.

显示全部楼层 · 发表于 2007-11-2 11:37:06

木马名称:Trojan-Downloader.Win32.Baser.ag

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\BAK.CSS
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OnLineGames.rvl

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\0.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件木马名称:Trojan-PSW.Win32.OnLineGames.szg

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\5.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.Lmir.ckf

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\7.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan.Win32.Delf.cbd

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\PK.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\1.EXE
木马程序生成以下文件:
1) C:\WINDOWS\GENPROTECT.EXE
2) C:\WINDOWS\SYSTEM32\GENPROTECT.DLL
是否删除木马程序及其衍生物?

木马名称:Trojan-PSW.Win32.OnLineGames.svw

程序:
C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\TMP66.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\2.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\DELL\桌面\新建文件夹\4.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\QDSHM.DLL
是否删除木马程序及其衍生物?

木马名称:Trojan.Win32.Delf.cbd

程序:
C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\RAR$EX00.517\BAIDU.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2007-11-2 11:40:46

C:\Documents and Settings\Uhthn\Desktop\桌面\bak.css : infected MalwareScope.Trojan-PSW.Game.14
C:\Documents and Settings\Uhthn\Desktop\桌面\0.exe : infected Trojan-PSW.Win32.OnLineGames.fqp
C:\Documents and Settings\Uhthn\Desktop\桌面\1.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\Uhthn\Desktop\桌面\2.exe : infected Trojan-PSW.Win32.OnLineGames.eop
C:\Documents and Settings\Uhthn\Desktop\桌面\4.exe : is suspected of Backdoor.XiaoBird.25 (paranoid heuristics)
C:\Documents and Settings\Uhthn\Desktop\桌面\4.exe : backup copy created
C:\Documents and Settings\Uhthn\Desktop\桌面\5.exe : infected Trojan-PSW.Win32.OnLineGames.eop
C:\Documents and Settings\Uhthn\Desktop\桌面\7.exe : infected Trojan-PSW.Win32.Lmir.bnn
C:\Documents and Settings\Uhthn\Desktop\桌面\pk.exe : infected MalwareScope.Trojan-PSW.Pinch.21
C:\Documents and Settings\Uhthn\Desktop\桌面\Baidu.CAB:<CAB>\Baidu.exe : infected MalwareScope.Trojan-PSW.Pinch.21
C:\Documents and Settings\Uhthn\Desktop\桌面\Baidu.CAB : backup copy created

Directories    : 0    Files in archives:    Files on disks:
Archives:                - total    : 1    - total    : 9
- scanned       : 1    -  scanned : 1    - scanned    : 9
- contain viruses : 1    -  infected : 1    - infected : 8
- deleted       : 0    -  suspicious : 0    - suspicious  : 1

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 786
Paranoia Database - 48413
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\桌面

C:\Documents and Settings\Uhthn\Desktop\桌面\bak.css - Infected MaliciousScope:TROJAN-DOWNLOADER.AGENT.3 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\0.exe - Suspected MaliciousScope:GENERIC.MALWARE.1
C:\Documents and Settings\Uhthn\Desktop\桌面\1.exe - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\桌面\2.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\4.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\5.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\7.exe - Suspected MaliciousScope:GENERIC.MALWARE.1
C:\Documents and Settings\Uhthn\Desktop\桌面\pk.exe - Infected TROJAN-DROPPER.AGENT.7 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\Baidu.CAB - OK

9 Files scanned
5 Infected files found
3 Suspected files found
0 Files disinfected
5 Files deleted

显示全部楼层 · 发表于 2007-11-2 14:22:22

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.XYOnline.nu
病毒： Trojan.PSW.Win32.GameOnline.rc
病毒： Trojan.PSW.Win32.GameOnline.ip
病毒： Trojan.PSW.Win32.GameOnline.pz
病毒： Trojan.PSW.Win32.DJOnline.ae
病毒： Trojan.PSW.Win32.GameOnline.ho
病毒： Trojan.Win32.Mnless.stm

用户来源：互联网

显示全部楼层 · 发表于 2007-11-2 14:29:41

红伞报9个全部删除

[病毒样本] [MD5: 979704 F96E7B FFA76C 426AE7 D79A34 E5F815 A55278 AA888A D27791]

本帖子中包含更多资源

8个

全灭