又是木马群，某贴挖的

promised

http://bbs.kafan.cn/viewthread.php?tid=155003&extra=page%3D1
00408DE8   ASCII "              ",0
00408E00   ASCII "http://www.ip127"
00408E10   ASCII ".cn/xzz/123.txt "
00408E20   ASCII "             ",0
txt－－
http://www.ip127.cn/xzz/zhengtu.exe
http://www.ip127.cn/xzz/qj.exe
http://www.ip127.cn/xzz/dh3.exe
http://www.ip127.cn/xzz/1.exe
http://www.ip127.cn/xzz/rxjh.exe
http://www.ip127.cn/xzz/zhuxian.exe

无尽藏海

Begin scan in 'C:\Documents and Settings\无尽藏海\桌面\样本.rar'
C:\Documents and Settings\无尽藏海\桌面\
  样本.rar
    [0] Archive type: RAR
    --> qj.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 1.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> zhengtu.exe
        [DETECTION] Is the Trojan horse TR/FWDisable.23904
        [WARNING]   Infected files in archives cannot be repaired!
    --> rxjh.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> zhuxian.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> avzxfmn.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> igqjsjdd1.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvdxhma.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> rarjdpi.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> rsztfpm.dll
        [DETECTION] Is the Trojan horse TR/FWDisable.23904
        [WARNING]   Infected files in archives cannot be repaired!
    --> verclsid.exe
        [INFO]      The file was moved to '47643e90.qua'!


End of the scan: 2007年11月11日  00:08
Used time: 00:07 min

The scan has been done completely.

      0 Scanning directories
     12 Files were scanned
      5 viruses and/or unwanted programs were found
      5 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      7 Files not concerned
      1 Archives were scanned
     10 Warnings
      0 Notes

bluestocking

nod32

Version of virus signature database: 2651 (20071110)
Date: 2007-11-11  Time: 0:13:56
Scanned disks, folders and files: C:\Documents and Settings\Administrator\桌面\样本.rar
C:\Documents and Settings\Administrator\桌面\样本.rar » RAR » qj.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\Administrator\桌面\样本.rar » RAR » 1.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\Administrator\桌面\样本.rar » RAR » zhengtu.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\Administrator\桌面\样本.rar » RAR » rxjh.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\Administrator\桌面\样本.rar » RAR » zhuxian.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\Administrator\桌面\样本.rar » RAR » avzxfmn.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\Administrator\桌面\样本.rar » RAR » kvdxhma.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\Administrator\桌面\样本.rar » RAR » rarjdpi.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\Administrator\桌面\样本.rar » RAR » rsztfpm.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
Number of scanned objects: 11
Number of threats found: 9
Time of completion: 00:14:01  Total scanning time: 5 sec (00:00:05)
Notes:
[7] Object is probably infected with an unknown virus.

woai_jolin

Scan Log
Version of virus signature database: 2651 (20071110)
Date: 2007-11-11  Time: 0:15:18
Scanned disks, folders and files: G:\V\样本.rar
G:\V\样本.rar » RAR » qj.exe - probably unknown NewHeur_PE virus [7] - was a part of the deleted object
G:\V\样本.rar » RAR » 1.exe - a variant of Win32/PSW.OnLineGames.FDY trojan - was a part of the deleted object
G:\V\样本.rar » RAR » zhengtu.exe - a variant of Win32/PSW.OnLineGames.FDY trojan - was a part of the deleted object
G:\V\样本.rar » RAR » rxjh.exe - a variant of Win32/PSW.OnLineGames.FDY trojan - was a part of the deleted object
G:\V\样本.rar » RAR » zhuxian.exe - a variant of Win32/PSW.OnLineGames.FDY trojan - was a part of the deleted object
G:\V\样本.rar » RAR » avzxfmn.dll - a variant of Win32/PSW.OnLineGames.FDY trojan - was a part of the deleted object
G:\V\样本.rar » RAR » igqjsjdd1.dll - is OK
G:\V\样本.rar » RAR » kvdxhma.dll - a variant of Win32/PSW.OnLineGames.FDY trojan - was a part of the deleted object
G:\V\样本.rar » RAR » rarjdpi.dll - a variant of Win32/PSW.OnLineGames.FDY trojan - was a part of the deleted object
G:\V\样本.rar » RAR » rsztfpm.dll - a variant of Win32/PSW.OnLineGames.FDY trojan - was a part of the deleted object
G:\V\样本.rar » RAR » verclsid.exe - is OK
Number of scanned objects: 12
Number of threats found: 9
Time of completion: 00:15:21  Total scanning time: 3 sec (00:00:03)
Notes:
[7] Object is probably infected with an unknown virus.

promised

C:\ABC\样本.rar:\qj.exe - 特征码 'Win32.HLLW.Wace' 被发现
C:\ABC\样本.rar:\1.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本.rar:\zhengtu.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本.rar:\rxjh.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本.rar:\zhuxian.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本.rar:\avzxfmn.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\样本.rar:\igqjsjdd1.dll - 特征码 'Win32.HLLW.Wace' 被发现
C:\ABC\样本.rar:\kvdxhma.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\样本.rar:\rarjdpi.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\样本.rar:\rsztfpm.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\样本.rar:\verclsid.exe
C:\ABC\样本.rar

欠妳緈諨

avast6

PC0amera

检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hkm        URL: http://bbs.kafan.cn/attachment.php?aid=151930//qj.exe//UPack

Nerazzurri

deleted: Trojan program Trojan-PSW.Win32.OnLineGames.hkm        File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/qj.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.hkj        File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/1.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.hkg        File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/zhengtu.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.hit        File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/rxjh.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.hhh        File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/zhuxian.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.hhf        File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/avzxfmn.dll
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.hkm        File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/igqjsjdd1.dll//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.hkj        File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/kvdxhma.dll
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.hit        File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/rarjdpi.dll
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.hkh        File: C:\Users\Jack Jones\Desktop\Ñù±¾.rar/rsztfpm.dll

20051001909

趋势还是比较牛的，测试包才下载了一半就给我给隔离了。不管用什么下载软件都不能下下来。看来趋势的网络监控还是相当好的。

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GameOnline.zy
病毒： Trojan.PSW.Win32.GameOnline.zk
病毒： Trojan.PSW.Win32.GameOnline.zq
病毒： Trojan.PSW.Win32.GameOnline.zy
病毒： Trojan.PSW.Win32.GameOnline.zz

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.17.60