前面那个autorun下的30个盗号

显示全部楼层 · 发表于 2007-11-9 18:39:27

全灭
C:\ABC\30.rar:\avwgemn.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\30.rar:\avzxfmn.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\30.rar:\rarjdpi.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\30.rar:\avwldmn.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\30.rar:\kvdxsgma.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\30.rar:\ratbhpi.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\30.rar:\kawdczy.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\30.rar:\raqjdpi.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\30.rar:\sidjczy.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\30.rar:\kaqhizy.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\30.rar:\1.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\30.rar:\2.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\30.rar:\3.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\30.rar:\4.exe - 特征码 'Trojan-Spy.Win32.Delf.PD' 被发现
C:\ABC\30.rar:\5.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\30.rar:\7.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\30.rar:\8.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\30.rar:\9.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\30.rar:\upxdnd.dll - 特征码 'MalwareScope.Trojan-PWS.Game.12' 被发现
C:\ABC\30.rar:\10.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\30.rar:\11.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\30.rar:\12.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\30.rar:\13.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\30.rar:\14.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\30.rar:\15.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\30.rar:\16.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\30.rar:\17.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\30.rar:\rsmygpm.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\30.rar:\kvmxfma.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\30.rar:\kapjdzy.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现

显示全部楼层 · 发表于 2007-11-9 18:41:00

WU？
windows update？

显示全部楼层 · 发表于 2007-11-9 18:41:24

C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » avwgemn.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » avzxfmn.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » rarjdpi.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » avwldmn.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » kvdxsgma.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » ratbhpi.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » kawdczy.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » raqjdpi.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » sidjczy.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » kaqhizy.dll - Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » 1.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » 2.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » 3.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » 4.exe - probably a variant of Win32/PSW.OnLineGames.NGU trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » 5.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » 7.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » 8.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » 9.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » upxdnd.dll - probably a variant of Win32/PSW.OnLineGames.HCV trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » 10.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » 11.exe - probably a variant of Win32/PSW.OnLineGames.NGU trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » 12.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » 13.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » 14.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » 15.exe - Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » 16.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » 17.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » rsmygpm.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » kvmxfma.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar » RAR » kapjdzy.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\wangcheng\桌面\30.rar:Zone.Identifier - is OK

显示全部楼层 · 发表于 2007-11-9 18:43:10

信息 2007-11-09  18:44:27 您此次查毒清除了27个病毒
信息 2007-11-09  18:44:27 您此次查毒共查出27个病毒以及危险代码
信息 2007-11-09  18:44:27 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件32个
信息 2007-11-09  18:44:27 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\kapjdzy.dll Win32.Troj.OnLimeGamesT.zf.21080 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\kvmxfma.dll Win32.Troj.OnLimeGamesT.zf.21080 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\rsmygpm.dll Win32.Troj.OnlineGamesT.fd.19570 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\17.exe Win32.Troj.AgentT.fm.14452 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\16.exe Win32.Troj.AgentT.fm.14452 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\15.exe Win32.Troj.AgentT.fm.14452 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\14.exe Win32.Troj.AgentT.fm.14452 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\13.exe Win32.Troj.AgentT.fm.14452 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\12.exe Win32.Troj.AgentT.fm.14452 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\11.exe Win32.Troj.OnlineGamesT.eo.14868 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\10.exe Win32.Troj.AgentT.fm.14452 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\upxdnd.dll Win32.Troj.OnlineGames.fn.20480 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\9.exe Win32.Troj.AgentT.fm.14452 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\8.exe Win32.Troj.AgentT.fm.14452 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\7.exe Win32.Troj.AgentT.fm.14452 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\5.exe Win32.Troj.AgentT.fm.14452 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\3.exe Win32.Troj.OnLineGamesT.gr.2637 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\2.exe Win32.Troj.AgentT.fm.14452 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\1.exe Win32.Troj.AgentT.fm.14452 清除成功
病毒 2007-11-09  18:44:27 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\kaqhizy.dll Win32.Troj.OnlineGamesT.fd.19570 清除成功
病毒 2007-11-09  18:44:26 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\sidjczy.dll Win32.Troj.OnLimeGamesT.zf.21080 清除成功
病毒 2007-11-09  18:44:26 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\raqjdpi.dll Win32.Troj.OnLimeGamesT.zf.21080 清除成功
病毒 2007-11-09  18:44:26 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\kawdczy.dll Win32.Troj.OnLimeGamesT.zf.21080 清除成功
病毒 2007-11-09  18:44:26 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\kvdxsgma.dll Win32.Troj.OnlineGamesT.fh.23128 清除成功
病毒 2007-11-09  18:44:26 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\avwldmn.dll Win32.Troj.OnLimeGamesT.zf.21080 清除成功
病毒 2007-11-09  18:44:26 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\rarjdpi.dll Win32.Troj.OnlineGamesT.fd.19570 清除成功
病毒 2007-11-09  18:44:26 D:\Documents and Settings\Administrator.25374E8C0BE6478\桌面\30.rar\avwgemn.dll Win32.Troj.OnLimeGamesT.zf.21080 清除成功

显示全部楼层 · 发表于 2007-11-9 18:44:24

应该是
003F3B73 PUSH kvdxsgma.003F3DBC                   ASCII "xymain.bin"
003F3DBC ASCII "xymain.bin",0
003F3EA9 PUSH kvdxsgma.003F3FB8                   ASCII "CLSID\"
003F3EBF PUSH kvdxsgma.003F3FC0                   ASCII "\InprocServer32"
003F3EE0 PUSH kvdxsgma.003F3FD4                   ASCII "Apartment"
003F3EE5 MOV ECX,kvdxsgma.003F3FE0                ASCII "ThreadingModel"
003F3EF6 PUSH kvdxsgma.003F3FF0                   ASCII "Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks"
003F3F17 PUSH kvdxsgma.003F4038                   ASCII "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows"
003F3F27 MOV ECX,kvdxsgma.003F4070                ASCII "AppInit_DLLs"
003F3F38 PUSH kvdxsgma.003F4080                   ASCII "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
003F3F45 MOV ECX,kvdxsgma.003F40B8                ASCII "NoAutoUpdate"
003F3F58 MOV ECX,kvdxsgma.003F40C8                ASCII "AUOptions"
003F3F69 PUSH kvdxsgma.003F40D4                   ASCII "SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile"
003F3F74 PUSH kvdxsgma.003F4130                   ASCII "Enable"
003F3F86 PUSH kvdxsgma.003F4138                   ASCII "Firewall"

显示全部楼层 · 发表于 2007-11-9 18:57:12

漏了一个。
Begin scan in 'C:\Documents and Settings\Administrator\桌面\30.rar'
C:\Documents and Settings\Administrator\桌面\30.rar
  [0] Archive type: RAR
  --> avwgemn.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> avzxfmn.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> rarjdpi.dll
   [DETECTION] Is the Trojan horse TR/FWDisable.21848
  --> avwldmn.dll
   [DETECTION] Is the Trojan horse TR/FWDisable.23902
  --> kvdxsgma.dll
   [DETECTION] Is the Trojan horse TR/FWDisable.21896
  --> ratbhpi.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> kawdczy.dll
   [DETECTION] Is the Trojan horse TR/FWDisable.20836
  --> raqjdpi.dll
   [DETECTION] Is the Trojan horse TR/FWDisable.23436
  --> sidjczy.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> 1.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.h
  --> 2.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 3.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.gmr
  --> 4.exe
   [DETECTION] Is the Trojan horse TR/CrashSystem.C
  --> 5.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 7.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 8.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 9.exe
   [DETECTION] Is the Trojan horse TR/FWDisable.23902
  --> upxdnd.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 10.exe
   [DETECTION] Is the Trojan horse TR/FWDisable.21848
  --> 11.exe
   [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
  --> 12.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 13.exe
   [DETECTION] Is the Trojan horse TR/FWDisable.20836
  --> 14.exe
   [DETECTION] Is the Trojan horse TR/FWDisable.21896
  --> 15.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 16.exe
   [DETECTION] Is the Trojan horse TR/FWDisable.23436
  --> 17.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> rsmygpm.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> kvmxfma.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.h
  --> kapjdzy.dll
   [DETECTION] Contains suspicious code HEUR/Malware

End of the scan: 2007年11月9日  18:56
Used time: 00:03 min

The scan has been done completely.

   0 Scanning directories
   32 Files were scanned
   23 viruses and/or unwanted programs were found
   6 Files were classified as suspicious:

显示全部楼层 · 发表于 2007-11-9 19:09:32

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.GameOnline.wh
病毒： Trojan.PSW.Win32.GameOnline.vo
病毒： Trojan.PSW.Win32.GameOnline.vm
病毒： Trojan.PSW.Win32.XYOnline.rd
病毒： Trojan.PSW.Win32.QQHX.trt
病毒： Trojan.PSW.Win32.GameOnline.xv
病毒： Trojan.PSW.Win32.GameOnline.wk
病毒： Trojan.PSW.Win32.SunOnline.gf
病毒： Trojan.PSW.Win32.GameOnline.xu
病毒： Trojan.PSW.Win32.GameOnline.wh
病毒： Trojan.PSW.Win32.GameOnline.vk
病毒： Trojan.PSW.Win32.GameOnline.vj
病毒： Trojan.PSW.Win32.WoWar.aeq
病毒： Trojan.PSW.Win32.XYOnline.rd
病毒： Trojan.PSW.Win32.QQHX.trt
病毒： Trojan.PSW.Win32.TLOnline.jjh
病毒： Trojan.PSW.Win32.RocOnline.hk
病毒： Trojan.PSW.Win32.GameOnline.xu

用户来源：互联网

软件版本：20.17.41

显示全部楼层 · 发表于 2007-11-9 19:23:45

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GameOnline.wh
病毒： Trojan.PSW.Win32.GameOnline.vo
病毒： Trojan.PSW.Win32.GameOnline.vm
病毒： Trojan.PSW.Win32.XYOnline.rd
病毒： Trojan.PSW.Win32.QQHX.trt
病毒： Trojan.PSW.Win32.GameOnline.xv
病毒： Trojan.PSW.Win32.GameOnline.wk
病毒： Trojan.PSW.Win32.SunOnline.gf
病毒： Trojan.PSW.Win32.GameOnline.xu
病毒： Trojan.PSW.Win32.GameOnline.wh
病毒： Trojan.PSW.Win32.GameOnline.vk
病毒： Trojan.PSW.Win32.GameOnline.vj
病毒： Trojan.PSW.Win32.WoWar.aeq
病毒： Trojan.PSW.Win32.XYOnline.rd
病毒： Trojan.PSW.Win32.QQHX.trt
病毒： Trojan.PSW.Win32.TLOnline.jjh
病毒： Trojan.PSW.Win32.RocOnline.hk
病毒： Trojan.PSW.Win32.GameOnline.xu

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.17.41

显示全部楼层 · 发表于 2007-11-9 19:33:16

Result: 17 malware found
Trojan-PSW.Win32.OnLineGames.hcx (virus)
C:\Users\Administrator\Desktop\30.rar\avzxfmn.dll
Trojan-PSW.Win32.OnLineGames.hfo (virus)
C:\Users\Administrator\Desktop\30.rar\kvdxsgma.dll
C:\Users\Administrator\Desktop\30.rar\14.exe
Trojan-PSW.Win32.OnLineGames.gvw (virus)
C:\Users\Administrator\Desktop\30.rar\raqjdpi.dll
C:\Users\Administrator\Desktop\30.rar\16.exe
Trojan-PSW.Win32.OnLineGames.hfq (virus)
C:\Users\Administrator\Desktop\30.rar\kaqhizy.dll
C:\Users\Administrator\Desktop\30.rar\15.exe
Trojan-PSW.Win32.OnLineGames.hfs (virus)
C:\Users\Administrator\Desktop\30.rar\1.exe
C:\Users\Administrator\Desktop\30.rar\7.exe
C:\Users\Administrator\Desktop\30.rar\17.exe
Trojan-PSW.Win32.OnLineGames.hfw (virus)
C:\Users\Administrator\Desktop\30.rar\2.exe
Trojan-PSW.Win32.OnLineGames.gtf (virus)
C:\Users\Administrator\Desktop\30.rar\4.exe
Trojan-PSW.Win32.OnLineGames.hcr (virus)
C:\Users\Administrator\Desktop\30.rar\8.exe
Trojan-PSW.Win32.OnLineGames.gwy (virus)
C:\Users\Administrator\Desktop\30.rar\9.exe
Trojan-PSW.Win32.OnLineGames.gxd (virus)
C:\Users\Administrator\Desktop\30.rar\10.exe
Trojan-PSW.Win32.OnLineGames.eop (virus)
C:\Users\Administrator\Desktop\30.rar\11.exe
Trojan-PSW.Win32.OnLineGames.hdj (virus)
C:\Users\Administrator\Desktop\30.rar\rsmygpm.dll

显示全部楼层 · 发表于 2007-11-9 19:33:47

BDburangxia

[病毒样本] 前面那个autorun下的30个盗号

本帖子中包含更多资源

回复 2楼 jimmyleo 的帖子

47/19