swchost 等几个毒 ae7dac4cee9 49faa916b40

ask5

抛毒包拉！

[ 本帖最后由 ask5 于 2007-11-3 13:57 编辑 ]

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\upwjgs.rar'
C:\Users\morgan\Documents\
  upwjgs.rar
    [0] Archive type: RAR
    --> usiwjw.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> GenProtect.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> upwjgs.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!
Begin scan in 'C:\Users\morgan\Documents\swchost.rar'
C:\Users\morgan\Documents\
  swchost.rar
    [0] Archive type: RAR
    --> kawdczy.dll
        [DETECTION] Is the Trojan horse TR/FWDisable.20842
        [WARNING]   Infected files in archives cannot be repaired!
    --> xgnpfb.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> nfhuer.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> swchost.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gis
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年11月2日  22:55
Used time: 00:06 min

The scan has been done completely.

      0 Scanning directories
      9 Files were scanned
      7 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      2 Archives were scanned
      9 Warnings
      0 Notes

scottxzt

木马名称:Trojan-PSW.Win32.OnLineGames.tnc

程序:
C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\RAR$EX00.766\GENPROTECT.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\RAR$EX02.769\UPWJGS.EXE
木马程序生成以下文件:
1) C:\WINDOWS\CMDBCS.EXE
2) C:\WINDOWS\SYSTEM32\CMDBCS.DLL
是否删除木马程序及其衍生物?
木马名称:Trojan-PSW.Win32.OnLineGames.tnc

程序:
C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\RAR$EX05.994\GENPROTECT.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\DELL\LOCAL SETTINGS\TEMP\RAR$EX05.994\USIWJW.EXE
木马程序生成以下文件:
1) C:\WINDOWS\AVPSRV.EXE
2) C:\WINDOWS\SYSTEM32\AVPSRV.DLL
是否删除木马程序及其衍生物?

promised

2007-11-3 14:05	Windows Live OneCare found potentially harmful or unwanted software on your computer Threat Name: PWS:Win32/Frethog.gen!D Detection Date and Time: 2007-11-3 14:05 File Name: C:\ABC\ABC\upwjgs.exe->(Upack) Threat Severity: Severe Threat Category: Password Stealer Contained Object: (Upack) Virus and spyware monitoring found potentially unwanted software: (ANTIVIRUS_ONACCESS_INFECTED) Threat Status: Detected
2007-11-3 14:05	Windows Live OneCare found potentially harmful or unwanted software on your computer Threat Name: PWS:Win32/Frethog.gen!D Detection Date and Time: 2007-11-3 14:05 File Name: C:\ABC\ABC\GenProtect.exe->(UPX) Threat Severity: Severe Threat Category: Password Stealer Contained Object: (UPX) Virus and spyware monitoring found potentially unwanted software: (ANTIVIRUS_ONACCESS_INFECTED) Threat Status: Detected
2007-11-3 14:05	Windows Live OneCare found potentially harmful or unwanted software on your computer Threat Name: PWS:Win32/Frethog.gen!D Detection Date and Time: 2007-11-3 14:05 File Name: C:\ABC\ABC\usiwjw.exe->(Upack) Threat Severity: Severe Threat Category: Password Stealer Contained Object: (Upack) Virus and spyware monitoring found potentially unwanted software: (ANTIVIRUS_ONACCESS_INFECTED) Threat Status: Detected
2007-11-3 14:05	Windows Live OneCare found potentially harmful or unwanted software on your computer Threat Name: PWS:Win32/Lmir.BMP Detection Date and Time: 2007-11-3 14:05 File Name: C:\ABC\ABC\swchost.exe->(Aspack v2.12) Threat Severity: Severe Threat Category: Password Stealer Contained Object: (Aspack v2.12) Virus and spyware monitoring found potentially unwanted software: (ANTIVIRUS_ONACCESS_INFECTED) Threat Status: Detected
2007-11-3 14:05	Windows Live OneCare found potentially harmful or unwanted software on your computer Threat Name: PWS:Win32/Frethog.gen!H Detection Date and Time: 2007-11-3 14:05 File Name: C:\ABC\ABC\nfhuer.exe->(Upack) Threat Severity: Severe Threat Category: Password Stealer Contained Object: (Upack) Virus and spyware monitoring found potentially unwanted software: (ANTIVIRUS_ONACCESS_INFECTED) Threat Status: Detected
2007-11-3 14:05	Windows Live OneCare found potentially harmful or unwanted software on your computer Threat Name: PWS:Win32/Frethog.gen!D Detection Date and Time: 2007-11-3 14:05 File Name: C:\ABC\ABC\xgnpfb.exe->(Upack) Threat Severity: Severe Threat Category: Password Stealer Contained Object: (Upack) Virus and spyware monitoring found potentially unwanted software: (ANTIVIRUS_ONACCESS_INFECTED) Threat Status: Detected
2007-11-3 14:05	Windows Live OneCare found potentially harmful or unwanted software on your computer Threat Name: Trojan:Win32/Delf.AT!dll Detection Date and Time: 2007-11-3 14:05 File Name: C:\ABC\ABC\kawdczy.dll Threat Severity: Severe Threat Category: Trojan Virus and spyware monitoring found potentially unwanted software: (ANTIVIRUS_ONACCESS_INFECTED) Threat Status: Detected

Joker

deleted: Trojan program Trojan-PSW.Win32.OnLineGames.gql        File: C:\Documents and Settings\Administrator\×ÀÃæ\swchost.rar/kawdczy.dll
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.grr        File: C:\Documents and Settings\Administrator\×ÀÃæ\swchost.rar/xgnpfb.exe//PE_Patch//UPack//PE_Patch
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.grp        File: C:\Documents and Settings\Administrator\×ÀÃæ\swchost.rar/nfhuer.exe//PE_Patch//UPack//PE_Patch
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.fxk        File: C:\Documents and Settings\Administrator\×ÀÃæ\swchost.rar/swchost.exe//ASPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.gro        File: C:\Documents and Settings\Administrator\×ÀÃæ\upwjgs.rar/usiwjw.exe//PE_Patch//UPack//PE_Patch
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.gmm        File: C:\Documents and Settings\Administrator\×ÀÃæ\upwjgs.rar/GenProtect.exe//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.gti        File: C:\Documents and Settings\Administrator\×ÀÃæ\upwjgs.rar/upwjgs.exe//PE_Patch//UPack//PE_Patch

kkgh

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.GameOnline.nm
病毒： Trojan.PSW.Win32.GameOnline.px

用户来源：互联网

软件版本：20.16.50

日期： 3.11.2007  时间：14:25:18
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\upwjgs.rar; C:\swchost.rar
C:\upwjgs.rar >>RAR >>usiwjw.exe - Win32/PSW.OnLineGames.NFL 木马的变种
C:\upwjgs.rar >>RAR >>GenProtect.exe - Win32/PSW.OnLineGames.YA 木马的变种
C:\upwjgs.rar >>RAR >>upwjgs.exe - Win32/PSW.OnLineGames.NFL 木马的变种
C:\upwjgs.rar - 多重感染 - 已删除
C:\swchost.rar >>RAR >>kawdczy.dll - Win32/PSW.OnLineGames.FDY 木马
C:\swchost.rar >>RAR >>xgnpfb.exe - Win32/PSW.OnLineGames.NFL 木马的变种
C:\swchost.rar >>RAR >>nfhuer.exe - 可能是 Win32/PSW.OnLineGames.NFL 木马 的一个变种
C:\swchost.rar >>RAR >>swchost.exe - Win32/PSW.WOW.WU 木马
C:\swchost.rar - 多重感染 - 已删除
已扫描的文件数目：9
已发现的病毒数目：7
已清除病毒的文件数目：2
完成时间： 14:25:20 总扫描时间：2 秒 (00:00:02)

IllusionWing

全杀

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.5.0
HC0.rlb = 3.0.0
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [捆绑检测] 在 F:\Users\Administrator\Desktop\新建文件夹\GenProtect.exe//UPX 检测到 Generic.Binder
[扫描] [nFile Detect 2] 在 F:\Users\Administrator\Desktop\新建文件夹\kawdczy.dll 检测到 Generic.nFile
[扫描] [变形壳检测] 在 F:\Users\Administrator\Desktop\新建文件夹\nfhuer.exe 检测到 Packed.Generic.Modified
[扫描] [nFile Detect 2] 在 F:\Users\Administrator\Desktop\新建文件夹\swchost.exe 检测到 Generic.nFile
[扫描] [变形壳检测] 在 F:\Users\Administrator\Desktop\新建文件夹\upwjgs.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 F:\Users\Administrator\Desktop\新建文件夹\usiwjw.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 F:\Users\Administrator\Desktop\新建文件夹\xgnpfb.exe 检测到 Packed.Generic.Modified
检测到了 7 个未知的恶意程序，请上报。
任务 扫描 完成。共耗费的时间：0-00-00 00:00:00:0187，共扫描的文件数量：8，共扫描到的威胁数量：7，威胁率：87.5%，扫描速率： 42.78 文件/秒，扫描速度： 982.8 千字节/秒，共扫描了 183.78 千字节。

kp2006

瑞星只有一个不杀

uhthn2002

C:\Documents and Settings\Uhthn\Desktop\New Folder\usiwjw.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\GenProtect.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\upwjgs.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\xgnpfb.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\nfhuer.exe : infected MalwareScope.Trojan-PSW.Game.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\swchost.exe : infected MalwareScope.Trojan-PSW.Game.16


Directories       : 0       Files in archives:      Files on disks:
Archives:                   - total       : 0       - total       : 7     
- scanned         : 0       -  scanned    : 0       - scanned     : 7     
- contain viruses : 0       -  infected   : 0       - infected    : 6     
- deleted         : 0       -  suspicious : 0       - suspicious  : 0

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 803
Paranoia Database - 48490
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder

C:\Documents and Settings\Uhthn\Desktop\New Folder\usiwjw.exe - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\New Folder\GenProtect.exe - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\upwjgs.exe - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\New Folder\kawdczy.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\xgnpfb.exe - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\New Folder\nfhuer.exe - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\New Folder\swchost.exe - Infected WIN32.TROJAN-PSW.ONLINEGAMES.G - Deleted

7 Files scanned
3 Infected files found
4 Suspected files found
0 Files disinfected
3 Files deleted