今天找到的 bb8ca79b b25b5397

ask5

麻烦各位看下，今天无意中找到的

[ 本帖最后由 ask5 于 2007-11-3 00:22 编辑 ]

sb

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.XYOnline.qe

MAC 地址：00:04:61:A9:F2:37

用户来源：互联网

软件版本：20.16.42

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\wmiprvse.rar'
C:\Documents and Settings\Administrator\桌面\wmiprvse.rar
  [0] Archive type: RAR
  --> kawdcaz.exe
      [DETECTION] Is the Trojan horse TR/FWDisable.20842
  --> kawdczy.dll
      [DETECTION] Is the Trojan horse TR/FWDisable.20842
      [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\桌面\ratbgtl.rar'
C:\Documents and Settings\Administrator\桌面\ratbgtl.rar
  [0] Archive type: RAR
  --> ratbgtl.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      The file was deleted!

dikex

wmiprvse.exe是系统文件（过数字签名认证）

[ 本帖最后由 dikex 于 2007-11-3 00:31 编辑 ]

ask5

多谢指教！

傻猪猪米走鸡

F:\virus\ratbgtl.rar » RAR » ratbgtl.exe - Win32/PSW.OnLineGames.FDY trojan
F:\virus\wmiprvse.rar » RAR » kawdcaz.exe - Win32/PSW.OnLineGames.FDY trojan
F:\virus\wmiprvse.rar » RAR » kawdczy.dll - Win32/PSW.OnLineGames.FDY trojan

kkgh

已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\zh\桌面\ratbgtl.rar; C:\Documents and Settings\zh\桌面\wmiprvse.rar
C:\Documents and Settings\zh\桌面\ratbgtl.rar >>RAR >>ratbgtl.exe - Win32/PSW.OnLineGames.FDY 木马
C:\Documents and Settings\zh\桌面\ratbgtl.rar - Win32/PSW.OnLineGames.FDY 木马 - 已删除
C:\Documents and Settings\zh\桌面\wmiprvse.rar >>RAR >>kawdcaz.exe - Win32/PSW.OnLineGames.FDY 木马
C:\Documents and Settings\zh\桌面\wmiprvse.rar >>RAR >>kawdczy.dll - Win32/PSW.OnLineGames.FDY 木马
C:\Documents and Settings\zh\桌面\wmiprvse.rar >>RAR >>wmiprvse.exe - 是正常的
C:\Documents and Settings\zh\桌面\wmiprvse.rar - Win32/PSW.OnLineGames.FDY 木马 - 已删除
已扫描的文件数目：6
已发现的病毒数目：3
已清除病毒的文件数目：2
完成时间： 09:57:24 总扫描时间：1 秒 (00:00:01)

欠妳緈諨

AVK07的2个引擎都全灭

碧水寒潭

Start of the scan: 2007年11月3日  10:10

Starting the file scan:

Begin scan in 'H:\AV-TEST'
H:\AV-TEST\wmiprvse.rar
  [0] Archive type: RAR
  --> kawdcaz.exe
      [DETECTION] Is the Trojan horse TR/FWDisable.20842
  --> kawdczy.dll
      [DETECTION] Is the Trojan horse TR/FWDisable.20842
      [INFO]      The file was deleted!
H:\AV-TEST\ratbgtl.rar
  [0] Archive type: RAR
  --> ratbgtl.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gqn
      [INFO]      The file was deleted!


End of the scan: 2007年11月3日  10:11
Used time: 00:21 min

The scan has been done completely.

      1 Scanning directories
      6 Files were scanned
      3 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      2 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      2 Archives were scanned
      0 Warnings
      0 Notes

wangjay1980

detected: Trojan program Trojan-PSW.Win32.OnLineGames.gpx        File: C:\Documents and Settings\Owner\×ÀÃæ\wmiprvse.rar/kawdcaz.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.gql        File: C:\Documents and Settings\Owner\×ÀÃæ\wmiprvse.rar/kawdczy.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.gqn        File: C:\Documents and Settings\Owner\×ÀÃæ\ratbgtl.rar/ratbgtl.exe//UPack