继续挖木马群

promised

http://www.3ehaolihai.cn/ad.exe
--〉http://www.3ehaolihai.cn/down/1.exe
。。。。
http://www.3ehaolihai.cn/down/9.exe

promised

C:\ABC\样本1.rar:\ad.exe - 特征码 'Trojan-Downloader.Win32.Delf.bny' 被发现
C:\ABC\样本1.rar:\1.exe - 特征码 'Virus.Win32.AutoRun.bs' 被发现
C:\ABC\样本1.rar:\3.exe - 特征码 'Trojan-Dropper.Win32.Agent.ane' 被发现
C:\ABC\样本1.rar:\4.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本1.rar:\5.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本1.rar:\6.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本1.rar:\7.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本1.rar:\8.exe - 特征码 'Virus.Win32.Agent.MYD' 被发现
C:\ABC\样本1.rar:\9.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\样本1.rar:\2.exe - 特征码 'Backdoor.Win32.Delf.awy' 被发现
C:\ABC\样本1.rar:\WinSys8x.Sys - 特征码 'Trojan-Proxy.Win32.Delf.AN' 被发现
C:\ABC\样本1.rar:\video.dll - 特征码 'Generic.PWStealer' 被发现
C:\ABC\样本1.rar:\scvhost.exe - 特征码 'Backdoor.Win32.Delf.awy' 被发现
C:\ABC\样本1.rar:\kapjezy.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\样本1.rar:\kaqhizy.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\样本1.rar:\kvdxhma.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\样本1.rar:\kvmxgma.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\样本1.rar:\ratbhpi.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\样本1.rar:\rsmygpm.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\样本1.rar

woai_jolin

Scan Log
Version of virus signature database: 2651 (20071110)
Date: 2007-11-11  Time: 0:25:33
Scanned disks, folders and files: G:\V\样本1.rar
Number of scanned objects: 20
Number of threats found: 18
Time of completion: 00:25:36  Total scanning time: 3 sec (00:00:03)

无尽藏海

Begin scan in 'C:\Documents and Settings\无尽藏海\桌面\样本1.rar'
C:\Documents and Settings\无尽藏海\桌面\
  样本1.rar
    [0] Archive type: RAR
    --> ad.exe
        [DETECTION] Is the Trojan horse TR/Dldr.Delf.BR.3
        [WARNING]   Infected files in archives cannot be repaired!
    --> 1.exe
        [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 3.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 4.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 5.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 6.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 7.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 8.exe
        [DETECTION] Is the Trojan horse TR/Drop.Agen.26778.A
        [WARNING]   Infected files in archives cannot be repaired!
    --> 9.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hfq.4
        [WARNING]   Infected files in archives cannot be repaired!
    --> 2.exe
        [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> WinSys8x.Sys
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> video.dll
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> scvhost.exe
        [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> kapjezy.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> kaqhizy.dll
    --> kvdxhma.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvmxgma.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> ratbhpi.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> rsmygpm.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was moved to '476742bf.qua'!


End of the scan: 2007年11月11日  00:25
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
     20 Files were scanned
     12 viruses and/or unwanted programs were found
      6 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      8 Files not concerned
      1 Archives were scanned
     18 Warnings
      0 Notes

欠妳緈諨

AVAST18

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Worm.Win32.Agent.zbi     
病毒： Worm.Win32.PaBug.df      
病毒： Trojan.PSW.Win32.GameOnline.xv
病毒： Trojan.PSW.Win32.GameOnline.zj
病毒： Trojan.PSW.Win32.OnlineGames.zoi
病毒： Trojan.PSW.Win32.QQHX.trt
病毒： Trojan.Mnless.lpi        
病毒： Worm.Win32.PaBug.df      
病毒： Trojan.PSW.Win32.OnlineGames.zoi
病毒： Backdoor.Win32.Agent.yff
病毒： Trojan.PSW.Win32.QQHX.trt
病毒： Trojan.PSW.Win32.TLOnline.jjl
病毒： Trojan.PSW.Win32.RocOnline.hk

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.17.60

yitp

Start of the scan: 2007年11月11日  17:46

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本1.rar'
C:\Documents and Settings\Administrator\桌面\样本1.rar
  [0] Archive type: RAR
  --> ad.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Delf.BR.3
  --> 1.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> 3.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 4.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 5.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 6.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 7.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 8.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agen.26778.A
  --> 9.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hfq.4
  --> 2.exe
      [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
  --> WinSys8x.Sys
      [DETECTION] Contains suspicious code HEUR/Malware
  --> video.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> scvhost.exe
      [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
  --> kapjezy.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> kvmxgma.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> ratbhpi.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> rsmygpm.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!

tonguewiz

EAV抓出18只，说NOD32对木马无能为力的人应该改改口了。。。

C:\Documents and Settings\David\Desktop\1.rar » RAR » ad.exe - a variant of Win32/AutoRun.K worm
C:\Documents and Settings\David\Desktop\1.rar » RAR » 1.exe - Win32/AutoRun.Q worm
C:\Documents and Settings\David\Desktop\1.rar » RAR » 3.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\David\Desktop\1.rar » RAR » 4.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\David\Desktop\1.rar » RAR » 5.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\David\Desktop\1.rar » RAR » 6.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\David\Desktop\1.rar » RAR » 7.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\David\Desktop\1.rar » RAR » 8.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\David\Desktop\1.rar » RAR » 9.exe - Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\David\Desktop\1.rar » RAR » 2.exe - Win32/Delf.NFD trojan
C:\Documents and Settings\David\Desktop\1.rar » RAR » WinSys8x.Sys - Win32/AutoRun.Q worm
C:\Documents and Settings\David\Desktop\1.rar » RAR » scvhost.exe - Win32/Delf.AWY trojan
C:\Documents and Settings\David\Desktop\1.rar » RAR » kapjezy.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\David\Desktop\1.rar » RAR » kaqhizy.dll - Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\David\Desktop\1.rar » RAR » kvdxhma.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\David\Desktop\1.rar » RAR » kvmxgma.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\David\Desktop\1.rar » RAR » ratbhpi.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\David\Desktop\1.rar » RAR » rsmygpm.dll - a variant of Win32/PSW.OnLineGames.FDY trojan

yunhan123

手动杀毒（按时间降序排列）
信息        2007-11-11 18:11:07        金山毒霸主程序 启动                       
信息        2007-11-11 18:10:58        金山毒霸主程序 退出                       
信息        2007-11-11 18:10:53        您此次查毒清除了15个病毒                       
信息        2007-11-11 18:10:53        您此次查毒共查出15个病毒以及危险代码                       
信息        2007-11-11 18:10:53        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件24个                       
信息        2007-11-11 18:10:53        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2007-11-11 18:10:53        C:\Documents and Settings\Administrator\桌面\样本1.rar\rsmygpm.dll        Win32.Troj.OnlineGamesT.fd.19570        清除成功       
病毒        2007-11-11 18:10:53        C:\Documents and Settings\Administrator\桌面\样本1.rar\kvdxhma.dll        Win32.Troj.OnLimeGamesT.zf.21080        清除成功       
病毒        2007-11-11 18:10:53        C:\Documents and Settings\Administrator\桌面\样本1.rar\kaqhizy.dll        Win32.Troj.DelfT.lm.21580        清除成功       
病毒        2007-11-11 18:10:53        C:\Documents and Settings\Administrator\桌面\样本1.rar\scvhost.exe        Win32.Troj.Delf.11081        清除成功       
病毒        2007-11-11 18:10:53        C:\Documents and Settings\Administrator\桌面\样本1.rar\WinSys8x.Sys        Win32.Troj.QQThiefT.ty.48263        清除成功       
病毒        2007-11-11 18:10:53        C:\Documents and Settings\Administrator\桌面\样本1.rar\2.exe        Win32.Hack.Delf.196608        清除成功       
病毒        2007-11-11 18:10:53        C:\Documents and Settings\Administrator\桌面\样本1.rar\9.exe        Win32.Troj.AgentT.fm.14452        清除成功       
病毒        2007-11-11 18:10:53        C:\Documents and Settings\Administrator\桌面\样本1.rar\8.exe        Win32.PSWTroj.OnLineGames.155648        清除成功       
病毒        2007-11-11 18:10:53        C:\Documents and Settings\Administrator\桌面\样本1.rar\7.exe        Win32.Troj.AgentT.fm.14452        清除成功       
病毒        2007-11-11 18:10:53        C:\Documents and Settings\Administrator\桌面\样本1.rar\6.exe        Win32.Troj.AgentT.fm.14452        清除成功       
病毒        2007-11-11 18:10:53        C:\Documents and Settings\Administrator\桌面\样本1.rar\5.exe        Win32.Troj.AgentT.fm.14452        清除成功       
病毒        2007-11-11 18:10:53        C:\Documents and Settings\Administrator\桌面\样本1.rar\4.exe        Win32.Troj.AgentT.fm.14452        清除成功       
病毒        2007-11-11 18:10:53        C:\Documents and Settings\Administrator\桌面\样本1.rar\3.exe        Win32.Troj.AgentT.fm.14452        清除成功       
病毒        2007-11-11 18:10:53        C:\Documents and Settings\Administrator\桌面\样本1.rar\1.exe        Win32.PSWTroj.OnLineGames.110705        清除成功       
病毒        2007-11-11 18:10:52        C:\Documents and Settings\Administrator\桌面\样本1.rar\ad.exe        Win32.Troj.Agent.94208        清除成功

平淡