又是木马群，某贴挖的

平淡

kkgh

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.GameOnline.aaf
病毒： Trojan.PSW.Win32.GameOnline.aae
病毒： Trojan.PSW.Win32.GameOnline.zy
病毒： Trojan.PSW.Win32.GameOnline.zk
病毒： Trojan.PSW.Win32.GameOnline.zq
病毒： Trojan.PSW.Win32.SunOnline.gl
病毒： Trojan.PSW.Win32.XYOnline.rl
病毒： Trojan.PSW.Win32.GameOnline.zy
病毒： Trojan.PSW.Win32.GameOnline.zz

用户来源：互联网

软件版本：20.17.62

redvoilin

ess

纽约的麻雀

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.rar'
C:\Documents and Settings\Administrator\桌面\样本.rar
  [0] Archive type: RAR
  --> qj.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> zhengtu.exe
      [DETECTION] Is the Trojan horse TR/FWDisable.23904
  --> rxjh.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> zhuxian.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> avzxfmn.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> igqjsjdd1.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> kvdxhma.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> rarjdpi.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> rsztfpm.dll
      [DETECTION] Is the Trojan horse TR/FWDisable.23904
      [INFO]      The file was deleted!

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 850
Paranoia Database - 48663
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder (2)

C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\qj.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\1.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\zhengtu.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\rxjh.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\zhuxian.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\avzxfmn.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\igqjsjdd1.dll - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\kvdxhma.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\rarjdpi.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\rsztfpm.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\verclsid.exe - KNOWN CLEAN

11 Files scanned
4 Infected files found
6 Suspected files found
0 Files disinfected
4 Files deleted

sam.to

已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hkm    檔案: C:\Documents and Settings\kato9096\桌面\样本.rar/qj.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hkj    檔案: C:\Documents and Settings\kato9096\桌面\样本.rar/1.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hkg    檔案: C:\Documents and Settings\kato9096\桌面\样本.rar/zhengtu.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hit    檔案: C:\Documents and Settings\kato9096\桌面\样本.rar/rxjh.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hhh    檔案: C:\Documents and Settings\kato9096\桌面\样本.rar/zhuxian.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hhf    檔案: C:\Documents and Settings\kato9096\桌面\样本.rar/avzxfmn.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hkm    檔案: C:\Documents and Settings\kato9096\桌面\样本.rar/igqjsjdd1.dll//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hkj    檔案: C:\Documents and Settings\kato9096\桌面\样本.rar/kvdxhma.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hit    檔案: C:\Documents and Settings\kato9096\桌面\样本.rar/rarjdpi.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hkh    檔案: C:\Documents and Settings\kato9096\桌面\样本.rar/rsztfpm.dll

杀了十个，一个没杀，没杀的已经传给卡巴

[ 本帖最后由 kato9096 于 2007-11-12 12:53 编辑 ]

sam.to

原帖由 kato9096 于 2007-11-12 12:51 发表
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hkm    檔案: C:\Documents and Settings\kato9096\桌面\样本.rar/qj.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hkj    檔案: C:\Doc ...

Hello,

verclsid.exe_

No malicious code was found in this file.

Please quote all when answering.

--
Best regards, Alexander Romanenko
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.




杀不到的不是病毒