昨天帮朋友杀毒，抓了一包，应该一般杀软都能查到！

jpzy

看样子是个下载者，中招了以后先是在IE缓存里面发作，然后改了系统时间（改成了05年，卡巴废废了），然后开始往Documents and settings，windows，system32里面扔东西，加载开机启动项，感染磁盘根目录（auto.exe，autorun.inf，pegefiles.pif——这三个忘了保存了，样本里面没有）

PS：谁知道Hijackthis扫描出来的App_init这一项什么意思？昨天有个dll在这个项目上加载，删又删不掉，unlocker查看，这家伙插入了所有系统关键进程了，一删它就重启，后来是在PE下面搞掉的！

joyo

哇哦,开着小A一个病毒都没有下载!都是半道就被截了!

capsshift

红伞，下载system32了，其他拦截。下载后扫描，多数已知。有启发。

googlehack

上面发的很多病毒其实是一个病毒，仅仅是名称不一样而已。

无敌敏敏

Starting the file scan:

Begin scan in 'E:\backup.rar'
E:\backup.rar
  [0] Archive type: RAR
  --> uihmln.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gtw
  --> upxdnd.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.gmr
      [INFO]      The file was deleted!
Begin scan in 'E:\system32.rar'
E:\system32.rar
  [0] Archive type: RAR
  --> sqmapi32.dll
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
  --> upxdnd.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> ratbgtl.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gqn
  --> kawdcaz.exe
      [DETECTION] Is the Trojan horse TR/FWDisable.20842
  --> GenProtect.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> DbgHlp32.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gte.1
  --> tyekqvafkq.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.adm
  --> sidjcaz.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> iouajpuaglqv.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gwh
  --> cmdbcs.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> avwgest.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> kvdxhis.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gwy
  --> rbcrps.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> tyejsyejpuyf.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gwh
  --> dinsyeinty.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.adm
  --> qwcirwbglqva.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gwh
  --> vkytvy.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gte.1
  --> ymxpsi.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> qwwtcj.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> sidjbaz.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> rwciotydjo.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.adm
  --> k106810983112.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> k10681098236.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> k106810982911.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> k106810983314.exe
      [DETECTION] Is the Trojan horse TR/Spy.Agent.AJB.3
  --> k10681098279.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> qwcirxchmrwc.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gwh
  --> ampvstqj32.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gwh
      [INFO]      The file was deleted!
Begin scan in 'E:\virus1.rar'
E:\virus1.rar
  [0] Archive type: RAR
  --> cmdbcs.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> DbgHlp32.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gte.1
  --> GenProtect.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> iouajpuaglqv.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gwh
  --> LYMANGR.DLL
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
  --> MSDEG32.DLL
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
  --> qqsgatl.dll
      [DETECTION] Is the Trojan horse TR/CrashSystem.C
  --> SHQ.DLL
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
  --> SHQMANGR.DLL
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
  --> tyekqvafkq.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.adm
  --> wlatl.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> zxatl.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> Delete.tmp
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [INFO]      The file was deleted!
Begin scan in 'E:\virus2.rar'
E:\virus2.rar
  [0] Archive type: RAR
  --> 215366WL.DLL
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gqp
  --> ~tmp1278.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> ~tmp3566.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> ~tmp4583.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> ~tmp5177.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> ~tmp6646.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> ~tmp693.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> ~tmp7060.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> ~tmp7310.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> swchost.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gqp
      [INFO]      The file was deleted!
Begin scan in 'E:\virus.rar'
E:\virus.rar
  [0] Archive type: RAR
  --> A2B99182.DLL
      [DETECTION] Contains detection pattern of the worm WORM/Winko.I.36
  --> AVPSrv.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> Kvsc3.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> mppds.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> msccrt.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> MsIMMs32.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> MsPrint32D.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gtw
  --> mswmp32.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.adm
  --> NavCOM01.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gtx
  --> NVDispDrv.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.grr.1
  --> pubhquagmrva.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gwh
  --> rxdjpuafkp.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.adm
  --> sxdhotydio.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.adm
  --> urjkve.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gth
  --> zamjdll.DLL
      [DETECTION] Is the Trojan horse TR/PSW.Gamer.D.2
  --> zamjhook.DLL
      [DETECTION] Is the Trojan horse TR/Spy.Agent.AJB.3
  --> 3A4798E0.EXE
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> k97350359411.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> k97350359714.exe
      [DETECTION] Is the Trojan horse TR/Spy.Agent.AJB.3
  --> svchostzamj.exe
      [DETECTION] Is the Trojan horse TR/Spy.Agent.AJB.3
      [INFO]      The file was deleted!
Begin scan in 'E:\WINDOWS.rar'
E:\WINDOWS.rar
  [0] Archive type: RAR
  --> ofreob.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.grr.1
  --> opfnpt.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.grr.1
  --> cmdbcs.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> DbgHlp32.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gte.1
  --> GenProtect.exE
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> hbpuwu.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.grr.1
  --> IGM.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> ingnzj.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> itzoxm.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gtw
  --> jrjlnr.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gtw
  --> Kvsc3.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> lbzvuo.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> mfwvsi.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> mppds.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> msccrt.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> MsIMMs32.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [INFO]      The file was deleted!

jpzy

原帖由 googlehack 于 2007-11-7 10:28 发表
上面发的很多病毒其实是一个病毒，仅仅是名称不一样而已。

是啊，这瘪独子玩意，光msconfig里面看得到的加载项就20几个~~~~名称都不同，但是估计都是一个下载者搞出来的~~~~

scottxzt

C:\Documents and Settings\dell\桌面\新建文件夹\backup.rar » RAR » uihmln.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\backup.rar » RAR » upxdnd.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » sqmapi32.dll - a variant of Win32/PSW.OnLineGames.NHF trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » upxdnd.dll - Win32/PSW.OnLineGames.GTQ trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » ratbgtl.exe - Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » kawdcaz.exe - Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » GenProtect.dll - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » DbgHlp32.dll - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » tyekqvafkq.dll - Win32/PSW.OnLineGames.GJV trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » sidjcaz.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » iouajpuaglqv.dll - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » cmdbcs.dll - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » avwgest.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » kvdxhis.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » rbcrps.dll - Win32/PSW.OnLineGames.GTQ trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » tyejsyejpuyf.dll - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » dinsyeinty.dll - Win32/PSW.OnLineGames.GJV trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » qwcirwbglqva.dll - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » vkytvy.dll - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » ymxpsi.dll - Win32/PSW.OnLineGames.GTQ trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » qwwtcj.dll - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » sidjbaz.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » rwciotydjo.dll - Win32/PSW.OnLineGames.GJV trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » k106810983314.exe - Win32/PSW.Gamer.NAB trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » qwcirxchmrwc.dll - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\dell\桌面\新建文件夹\system32.rar » RAR » ampvstqj32.dll - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » A2B99182.DLL - Win32/TrojanDownloader.Flux trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » AVPSrv.dll - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » Kvsc3.dll - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » mppds.dll - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » msccrt.dll - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » MsIMMs32.dll - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » MsPrint32D.dll - Win32/PSW.OnLineGames.GTW trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » mswmp32.dll - Win32/PSW.OnLineGames.GJV trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » NavCOM01.dll - Win32/PSW.OnLineGames.GTX trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » NVDispDrv.dll - Win32/PSW.OnLineGames.GRR trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » pubhquagmrva.dll - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » rxdjpuafkp.dll - Win32/PSW.OnLineGames.GJV trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » sxdhotydio.dll - Win32/PSW.OnLineGames.GJV trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » urjkve.dll - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » zamjdll.DLL - Win32/PSW.Gamer.F trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » zamjhook.DLL - Win32/PSW.Gamer.NAB trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » 3A4798E0.EXE - Win32/TrojanDownloader.Flux trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » k97350359714.exe - Win32/PSW.Gamer.NAB trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus.rar » RAR » svchostzamj.exe - Win32/PSW.Gamer.NAB trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus1.rar » RAR » cmdbcs.dll - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus1.rar » RAR » DbgHlp32.dll - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus1.rar » RAR » GenProtect.dll - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus1.rar » RAR » iouajpuaglqv.dll - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus1.rar » RAR » LYMANGR.DLL - a variant of Win32/PSW.OnLineGames.DTR trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus1.rar » RAR » MSDEG32.DLL - a variant of Win32/PSW.OnLineGames.DVV trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus1.rar » RAR » qqsgatl.dll - a variant of Win32/PSW.OnLineGames.NHF trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus1.rar » RAR » tyekqvafkq.dll - Win32/PSW.OnLineGames.GJV trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus1.rar » RAR » wlatl.dll - a variant of Win32/PSW.OnLineGames.NHF trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus1.rar » RAR » zxatl.dll - a variant of Win32/PSW.OnLineGames.NHF trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus1.rar » RAR » Delete.tmp - Win32/PSW.OnLineGames.GTQ trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus2.rar » RAR » 215366WL.DLL - Win32/PSW.OnLineGames.NHU trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus2.rar » RAR » ~tmp1278.exe - probably a variant of Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus2.rar » RAR » ~tmp3566.exe - probably a variant of Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus2.rar » RAR » ~tmp4583.exe - probably a variant of Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus2.rar » RAR » ~tmp5177.exe - probably a variant of Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus2.rar » RAR » ~tmp6646.exe - probably a variant of Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus2.rar » RAR » ~tmp693.exe - probably a variant of Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus2.rar » RAR » ~tmp7060.exe - probably a variant of Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus2.rar » RAR » ~tmp7310.exe - probably a variant of Win32/PSW.Delf.NHI trojan
C:\Documents and Settings\dell\桌面\新建文件夹\virus2.rar » RAR » swchost.exe - Win32/PSW.WOW.WU trojan
C:\Documents and Settings\dell\桌面\新建文件夹\WINDOWS.rar » RAR » ofreob.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\WINDOWS.rar » RAR » opfnpt.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\WINDOWS.rar » RAR » cmdbcs.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\dell\桌面\新建文件夹\WINDOWS.rar » RAR » DbgHlp32.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\WINDOWS.rar » RAR » GenProtect.exE - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\dell\桌面\新建文件夹\WINDOWS.rar » RAR » hbpuwu.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\WINDOWS.rar » RAR » IGM.exe - Win32/PSW.Legendmir.BOQ trojan
C:\Documents and Settings\dell\桌面\新建文件夹\WINDOWS.rar » RAR » ingnzj.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\dell\桌面\新建文件夹\WINDOWS.rar » RAR » itzoxm.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\WINDOWS.rar » RAR » jrjlnr.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\WINDOWS.rar » RAR » Kvsc3.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\WINDOWS.rar » RAR » lbzvuo.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\dell\桌面\新建文件夹\WINDOWS.rar » RAR » mfwvsi.exe - Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\dell\桌面\新建文件夹\WINDOWS.rar » RAR » mppds.exe - Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\dell\桌面\新建文件夹\WINDOWS.rar » RAR » msccrt.exe - Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\dell\桌面\新建文件夹\WINDOWS.rar » RAR » MsIMMs32.exe - Win32/PSW.OnLineGames.NFL trojan

rasis

Begin scan in 'system32.rar'
system32.rar
  [0] Archive type: RAR
  --> sqmapi32.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.adu.2
  --> upxdnd.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> ratbgtl.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gqn
  --> kawdcaz.exe
      [DETECTION] Is the Trojan horse TR/FWDisable.20842
  --> GenProtect.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> DbgHlp32.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gte.1
  --> tyekqvafkq.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.adm
  --> sidjcaz.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> iouajpuaglqv.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gwh
  --> cmdbcs.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> avwgest.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> kvdxhis.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gwy
  --> rbcrps.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> tyejsyejpuyf.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gwh
  --> dinsyeinty.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.adm
  --> qwcirwbglqva.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gwh
  --> vkytvy.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gte.1
  --> ymxpsi.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> qwwtcj.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> sidjbaz.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> rwciotydjo.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.adm
  --> k106810983112.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> k10681098236.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> k106810982911.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> k106810983314.exe
      [DETECTION] Is the Trojan horse TR/Spy.Agent.AJB.3
  --> k10681098279.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> qwcirxchmrwc.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gwh
  --> ampvstqj32.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gwh
      [WARNING]   The file was ignored!
Begin scan in 'virus.rar'
virus.rar
  [0] Archive type: RAR
  --> A2B99182.DLL
      [DETECTION] Contains detection pattern of the worm WORM/Winko.I.36
  --> AVPSrv.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> Kvsc3.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> mppds.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> msccrt.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> MsIMMs32.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> MsPrint32D.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gtw
  --> mswmp32.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.adm
  --> NavCOM01.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gtx
  --> NVDispDrv.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.grr.1
  --> pubhquagmrva.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gwh
  --> rxdjpuafkp.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.adm
  --> sxdhotydio.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.adm
  --> urjkve.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gth
  --> zamjdll.DLL
      [DETECTION] Is the Trojan horse TR/PSW.Gamer.D.2
  --> zamjhook.DLL
      [DETECTION] Is the Trojan horse TR/Spy.Agent.AJB.3
  --> 3A4798E0.EXE
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> k97350359310.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gtq
  --> k97350359411.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> k97350359714.exe
      [DETECTION] Is the Trojan horse TR/Spy.Agent.AJB.3
  --> svchostzamj.exe
      [DETECTION] Is the Trojan horse TR/Spy.Agent.AJB.3
      [WARNING]   The file was ignored!
Begin scan in 'virus1.rar'
virus1.rar
  [0] Archive type: RAR
  --> cmdbcs.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> DbgHlp32.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gte.1
  --> GenProtect.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> iouajpuaglqv.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gwh
  --> LYMANGR.DLL
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
  --> MSDEG32.DLL
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
  --> qqsgatl.dll
      [DETECTION] Is the Trojan horse TR/CrashSystem.C
  --> SHQ.DLL
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
  --> SHQMANGR.DLL
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
  --> tyekqvafkq.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.adm
  --> wlatl.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> zxatl.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> Delete.tmp
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [WARNING]   The file was ignored!
Begin scan in 'virus2.rar'
virus2.rar
  [0] Archive type: RAR
  --> 215366WL.DLL
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gqp
  --> ~tmp1278.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> ~tmp3566.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> ~tmp4583.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> ~tmp5177.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> ~tmp6646.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> ~tmp693.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> ~tmp7060.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> ~tmp7310.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> swchost.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gqp
      [WARNING]   The file was ignored!
Begin scan in 'WINDOWS.rar'
WINDOWS.rar
  [0] Archive type: RAR
  --> ofreob.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.grr.1
  --> opfnpt.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.grr.1
  --> cmdbcs.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> DbgHlp32.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gte.1
  --> GenProtect.exE
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> hbpuwu.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.grr.1
  --> IGM.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> ingnzj.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> itzoxm.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gtw
  --> jrjlnr.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gtw
  --> Kvsc3.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> lbzvuo.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> mfwvsi.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> mppds.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> msccrt.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> MsIMMs32.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [WARNING]   The file was ignored!
Begin scan in 'backup.rar'
backup.rar
  [0] Archive type: RAR
  --> uihmln.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.gtw
  --> upxdnd.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.gmr
      [WARNING]   The file was ignored!


End of the scan: 2007年11月7日  16:04
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
    110 Files were scanned
     78 viruses and/or unwanted programs were found
     12 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     32 Files not concerned
      6 Archives were scanned
      6 Warnings
      0 Notes

kkgh

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.Shanda.aq
病毒： Trojan.PSW.Win32.Shanda.aq
病毒： Trojan.PSW.Win32.GameOnline.se
病毒： Trojan.PSW.Win32.RBLand.bq
病毒： Trojan.PSW.Win32.GameOnline.sd
病毒： Trojan.PSW.Win32.LMir.yyf
病毒： Trojan.PSW.Win32.GameOnline.tx
病毒： Trojan.PSW.Win32.RBLand.bp
病毒： Trojan.PSW.Win32.GameOnline.ux
病毒： Trojan.PSW.Win32.SO2Online.j
病毒： Trojan.PSW.Win32.SO2Online.i
病毒： Trojan.PSW.Win32.GameOnline.sf
病毒： Trojan.PSW.Win32.GameOnline.ty
病毒： Trojan.PSW.Win32.GameOnline.ty
病毒： Trojan.PSW.Win32.TLOnline.jjh
病毒： Trojan.PSW.Win32.XYOnline.qe
病毒： Trojan.PSW.Win32.RBLand.bq
病毒： Trojan.PSW.Win32.WoWar.aea
病毒： Trojan.PSW.Win32.GameOnline.pt
病毒： Worm.Win32.Agent.zax     
病毒： Trojan.PSW.Win32.SO2Game.a
病毒： Trojan.PSW.Win32.SunOnline.fx
病毒： Trojan.PSW.Win32.SO2Online.j
病毒： Trojan.PSW.Win32.SO2Online.i
病毒： Trojan.PSW.Win32.GameOnline.va
病毒： Trojan.PSW.Win32.GameOnline.tx
病毒： Trojan.PSW.Win32.WoWar.aea
病毒： Trojan.PSW.Win32.GameOnline.uk
病毒： Trojan.PSW.Win32.GameOnline.se
病毒： Trojan.PSW.Win32.GameOnline.y
病毒： Trojan.PSW.Win32.Agent.vpb
病毒： Worm.Win32.Agent.zaw     
病毒： Trojan.PSW.Win32.PirateKing.y
病毒： Trojan.PSW.Win32.PirateKing.x

用户来源：互联网

软件版本：20.17.20

浪滔天

删除重复后共78个文件，卡巴 125 杀62

已删除: 病毒 Virus.Win32.AutoRun.aas        文件: F:\病毒样本\system32\A2B99182.DLL
已删除: 病毒 Virus.Win32.AutoRun.aas        文件: F:\病毒样本\system32\3A4798E0.EXE
已删除: 病毒 Worm.Win32.QQPass.at        文件: F:\病毒样本\system32\~tmp1278.exe//UPX//PEPatch
已删除: 木马程序 Trojan-PSW.Win32.Gamer.d        文件: F:\病毒样本\system32\zamjdll.DLL
已删除: 木马程序 Trojan-PSW.Win32.Gamer.h        文件: F:\病毒样本\system32\k106810983314.exe
已删除: 木马程序 Trojan-PSW.Win32.Lmir.boq        文件: F:\病毒样本\system32\IGM.exe//ASPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.fxk        文件: F:\病毒样本\system32\swchost.exe//ASPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gos        文件: F:\病毒样本\system32\AVPSrv.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gpx        文件: F:\病毒样本\system32\kawdcaz.exe
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gqp        文件: F:\病毒样本\system32\215366WL.DLL
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.grr        文件: F:\病毒样本\system32\NVDispDrv.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.grr        文件: F:\病毒样本\system32\hbpuwu.exe//PE_Patch//UPack//PE_Patch
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gte        文件: F:\病毒样本\system32\DbgHlp32.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gth        文件: F:\病毒样本\system32\urjkve.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gth        文件: F:\病毒样本\system32\GenProtect.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gth        文件: F:\病毒样本\system32\GenProtect.exE//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gth        文件: F:\病毒样本\system32\mfwvsi.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gti        文件: F:\病毒样本\system32\k10681098279.exe//PE_Patch//UPack//PE_Patch
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gti        文件: F:\病毒样本\system32\Kvsc3.exe//PE_Patch//UPack//PE_Patch
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gtq        文件: F:\病毒样本\system32\Delete.tmp
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gtq        文件: F:\病毒样本\system32\k97350359310.exe//PE_Patch//UPack//PE_Patch
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gtq        文件: F:\病毒样本\system32\upxdnd.exe//PE_Patch//UPack//PE_Patch
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gtr        文件: F:\病毒样本\system32\mppds.exe
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gtr        文件: F:\病毒样本\system32\mppds.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gts        文件: F:\病毒样本\system32\k106810982911.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gts        文件: F:\病毒样本\system32\msccrt.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gts        文件: F:\病毒样本\system32\msccrt.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gts        文件: F:\病毒样本\system32\k97350359411.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gtu        文件: F:\病毒样本\system32\MsIMMs32.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gtu        文件: F:\病毒样本\system32\MsIMMs32.exe//PE_Patch//UPack//PE_Patch
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gtw        文件: F:\病毒样本\system32\k10681098268.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gtw        文件: F:\病毒样本\system32\MsPrint32D.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gtw        文件: F:\病毒样本\system32\itzoxm.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gtx        文件: F:\病毒样本\system32\NavCOM01.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.guj        文件: F:\病毒样本\system32\lbzvuo.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.guq        文件: F:\病毒样本\system32\k10681098236.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.guq        文件: F:\病毒样本\system32\DbgHlp32.exe//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gvw        文件: F:\病毒样本\system32\ratbgtl.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gwh        文件: F:\病毒样本\system32\qwcirxchmrwc.dll//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gwh        文件: F:\病毒样本\system32\tyejsyejpuyf.dll//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gwh        文件: F:\病毒样本\system32\qwcirwbglqva.dll//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gwh        文件: F:\病毒样本\system32\pubhquagmrva.dll//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gwh        文件: F:\病毒样本\system32\iouajpuaglqv.dll//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gwo        文件: F:\病毒样本\system32\cmdbcs.dll
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gwo        文件: F:\病毒样本\system32\cmdbcs.exe//PE_Patch//UPack//PE_Patch
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gwt        文件: F:\病毒样本\system32\SHQMANGR.DLL//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gwy        文件: F:\病毒样本\system32\kvdxhis.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gwy        文件: F:\病毒样本\system32\avwgest.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gxh        文件: F:\病毒样本\system32\sidjbaz.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gxj        文件: F:\病毒样本\system32\qqsgatl.dll//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gxj        文件: F:\病毒样本\system32\sqmapi32.dll//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gxk        文件: F:\病毒样本\system32\ampvstqj32.dll//FSG
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gyn        文件: F:\病毒样本\system32\LYMANGR.DLL//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gyo        文件: F:\病毒样本\system32\MSDEG32.DLL//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.gyz        文件: F:\病毒样本\system32\sidjcaz.exe//UPack
已删除: 木马程序 Trojan-PSW.Win32.WOW.adm        文件: F:\病毒样本\system32\sxdhotydio.dll//UPack//PE_Patch.MaskPE
已删除: 木马程序 Trojan-PSW.Win32.WOW.adm        文件: F:\病毒样本\system32\mswmp32.dll//FSG
已删除: 木马程序 Trojan-PSW.Win32.WOW.adm        文件: F:\病毒样本\system32\rwciotydjo.dll//UPack//PE_Patch.MaskPE
已删除: 木马程序 Trojan-PSW.Win32.WOW.adm        文件: F:\病毒样本\system32\rxdjpuafkp.dll//UPack//PE_Patch.MaskPE
已删除: 木马程序 Trojan-PSW.Win32.WOW.adm        文件: F:\病毒样本\system32\tyekqvafkq.dll//UPack//PE_Patch.MaskPE
已删除: 木马程序 Trojan-PSW.Win32.WOW.adm        文件: F:\病毒样本\system32\dinsyeinty.dll//UPack//PE_Patch.MaskPE
已删除: 木马程序 Trojan-Spy.Win32.Agent.ajb        文件: F:\病毒样本\system32\zamjhook.DLL