logogogo.exe下的35个

显示全部楼层 · 发表于 2007-11-17 12:41:06

木马名称:Trojan-PSW.Win32.OnLineGames.wnb

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\RAQJDTL.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.wmu

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\KVMXHIS.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.wmz

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\KVDXSIIS.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.wna

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\AVZXFST.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.wim

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\AVWLDST.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.wmy

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\AVWGEST.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.wkt

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\17.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.wnc

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\12.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.urd

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\4.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.wmw

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\2.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\3.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\KVBATCH01.DLL
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\10.EXE
1) C:\DFD16865562.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
木马名称:Trojan-PSW.Win32.OnLineGames.wbk

程序:
C:\WINDOWS\SYSTEM32\QDSHM.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\11.EXE
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\13.EXE
可疑程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\KAWDCZY.DLL
2) C:\WINDOWS\SYSTEM32\WINSOCK32.DLL
3) C:\DFD16890906.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\13.EXE
可疑程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\KAWDCZY.DLL
2) C:\WINDOWS\SYSTEM32\WINSOCK32.DLL
3) C:\DFD16890906.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\19.EXE
1) C:\DFD16903984.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\KVBATCH01.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\20.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSWIN7K.JMP
2) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\WN_SYS8X.SYS
是否删除木马程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\KAPJEAZ.EXE
1) C:\DFD16923890.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\KAPJEAZ.EXE
1) C:\DFD16923890.BAT
是否删除可疑程序?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\KAQHIAZ.EXE
1) C:\DFD16934750.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?
木马名称:未知间谍软件

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\样本\WN_SYS8X.SYS
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2007-11-17 12:44:40

瑞星26

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.XYOnline.sf
病毒： Trojan.PSW.Win32.XYOnline.sg
病毒： Trojan.PSW.Win32.XYOnline.sg
病毒： Trojan.PSW.Win32.XYOnline.sf
病毒： Trojan.PSW.Win32.GameOnline.aem
病毒： Trojan.PSW.Win32.GameOnline.yv
病毒： Trojan.PSW.Win32.GameOnline.aam
病毒： Trojan.PSW.Win32.GameOnline.aam
病毒： Trojan.PSW.Win32.GameOnline.aax
病毒： Trojan.PSW.Win32.GameOnline.aaz
病毒： Trojan.PSW.Win32.GameOnline.adm
病毒： Trojan.PSW.Win32.OnlineGame.yme
病毒： Worm.Win32.PaBug.dq
病毒： Trojan.PSW.Win32.GameOnline.aak
病毒： Trojan.PSW.Win32.FYOnline.dq
病毒： Trojan.PSW.Win32.LMir.yyr
病毒： Trojan.PSW.Win32.WoWar.afb
病毒： Trojan.PSW.Win32.SunOnline.gf
病毒： Trojan.PSW.Win32.GameOnline.aen
病毒： Worm.Win32.PaBug.dn
病毒： Trojan.PSW.Win32.FYOnline.dq
病毒： Trojan.PSW.Win32.GameOnline.aak
病毒： Trojan.PSW.Win32.RocOnline.hv
病毒： Trojan.PSW.Win32.GameOnline.agd

显示全部楼层 · 发表于 2007-11-17 12:47:26

Starting the file scan:

Begin scan in 'E:\样本.rar'
E:\样本.rar
  [0] Archive type: RAR
  --> rarjepi.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> raqjdtl.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> raqjdpi.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> kvmxhma.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.htv
  --> kvmxhis.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.htv
  --> kvdxsima.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> kvdxsiis.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> KVBatch01.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> kawdczy.dll
   [DETECTION] Is the Trojan horse TR/FWDisable.20836
  --> kaqhiaz.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> kapjezy.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> kapjeaz.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> avzxfst.exe
   [DETECTION] Is the Trojan horse TR/FWDisable.26446
  --> avzxfmn.dll
   [DETECTION] Is the Trojan horse TR/FWDisable.26446
  --> avwldst.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hlr
  --> avwldmn.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hlr
  --> avwgest.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hsj
  --> avwgemn.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hsj
  --> 20.exe
   [DETECTION] Is the Trojan horse TR/PSW.QQpass.als
  --> 19.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 17.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hmp
  --> 13.exe
   [DETECTION] Is the Trojan horse TR/FWDisable.20836
  --> 12.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 11.exe
   [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
  --> 10.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 4.exe
   [DETECTION] Is the Trojan horse TR/CrashSystem.C
  --> 3.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hxi.1
  --> 2.exe
   [DETECTION] Is the Trojan horse TR/FWDisable.23372
  --> Wn_Sys8x.Sys
   [DETECTION] Is the Trojan horse TR/PSW.QQpass.als
  --> winsock32.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> swjqbzc.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> sidjczy.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hmp
  --> rsmyhpm.dll
   [DETECTION] Is the Trojan horse TR/FWDisable.23372
  --> ratbjpi.dll
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was deleted!

End of the scan: 2007年11月17日  12:47
Used time: 00:18 min

The scan has been done completely.

   0 Scanning directories
   36 Files were scanned
   26 viruses and/or unwanted programs were found
   8 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   10 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-11-17 12:48:54

avast! 33个

显示全部楼层 · 发表于 2007-11-17 12:52:38

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.rar'
C:\Documents and Settings\Administrator\桌面\样本.rar
  [0] Archive type: RAR
  --> rarjepi.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> raqjdtl.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> raqjdpi.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> kvmxhma.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.htv
  --> kvmxhis.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.htv
  --> kvdxsima.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> kvdxsiis.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> KVBatch01.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> kawdczy.dll
   [DETECTION] Is the Trojan horse TR/FWDisable.20836
  --> kaqhiaz.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> kapjezy.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> kapjeaz.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> avzxfst.exe
   [DETECTION] Is the Trojan horse TR/FWDisable.26446
  --> avzxfmn.dll
   [DETECTION] Is the Trojan horse TR/FWDisable.26446
  --> avwldst.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hlr
  --> avwldmn.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hlr
  --> avwgest.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hsj
  --> avwgemn.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hsj
  --> 20.exe
   [DETECTION] Is the Trojan horse TR/PSW.QQpass.als
  --> 19.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 17.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hmp
  --> 13.exe
   [DETECTION] Is the Trojan horse TR/FWDisable.20836
  --> 12.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 11.exe
   [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
  --> 10.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 4.exe
   [DETECTION] Is the Trojan horse TR/CrashSystem.C
  --> 3.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hxi.1
  --> 2.exe
   [DETECTION] Is the Trojan horse TR/FWDisable.23372
  --> Wn_Sys8x.Sys
   [DETECTION] Is the Trojan horse TR/PSW.QQpass.als
  --> winsock32.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> swjqbzc.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> sidjczy.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hmp
  --> rsmyhpm.dll
   [DETECTION] Is the Trojan horse TR/FWDisable.23372
  --> ratbjpi.dll
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was deleted!

End of the scan: 2007年11月17日  12:53
Used time: 00:13 min

The scan has been done completely.

   0 Scanning directories
   36 Files were scanned
   26 viruses and/or unwanted programs were found
   8 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   10 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-11-17 12:55:56

MicroVita AntiSpyware 100 C
_____________________________________________

         风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\3533\rarjepi.dll]
                  …………发现Spy！报告: [4] [6] 注入者[8] HOOK者
文件信息:  大小:23894  MD5:9c39a010a30dcf66adcacd0059b0a795

[C:\Documents and Settings\Administrator\桌面\Virus\3533\raqjdtl.exe]
                  …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:15488  MD5:7a45a50d948c7411641ad7c4018eb828

[C:\Documents and Settings\Administrator\桌面\Virus\3533\raqjdpi.dll]
                  …………发现Spy！报告: [4] [6] 注入者[8] HOOK者
文件信息:  大小:23436  MD5:9ac81eb3471d7790aa46df9f8488fd92

[C:\Documents and Settings\Administrator\桌面\Virus\3533\kvmxhma.dll]
                  …………发现Spy！报告: [4] [6] 注入者[8] HOOK者
文件信息:  大小:24902  MD5:672103f02f3190231c5d7da9c2582e83

[C:\Documents and Settings\Administrator\桌面\Virus\3533\kvmxhis.exe]
                  …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:16119  MD5:552386f90669f97f9b10764af53f9370

[C:\Documents and Settings\Administrator\桌面\Virus\3533\kvdxsima.dll]
                  …………发现Spy！报告: [4] [6] 注入者[8] HOOK者
文件信息:  大小:23944  MD5:b9cd29e56d1decb5b787b60fcbc3c375

[C:\Documents and Settings\Administrator\桌面\Virus\3533\kvdxsiis.exe]
                  …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:15074  MD5:0d81210a625645b365a198fb863d9b3d

[C:\Documents and Settings\Administrator\桌面\Virus\3533\KVBatch01.dll]
                  …………发现Spy！报告: [4] [8] HOOK者
文件信息:  大小:23040  MD5:13a65cc8c040cb5fb856eda9a84643eb

[C:\Documents and Settings\Administrator\桌面\Virus\3533\kawdczy.dll]
                  …………发现Spy！报告:[6] 注入者[8] HOOK者
文件信息:  大小:20810  MD5:c84d733adc894afb3c7b8495f42ceb2e

[C:\Documents and Settings\Administrator\桌面\Virus\3533\kaqhizy.dll]
                  …………发现Spy！报告: [4]
文件信息:  大小:2117462  MD5:f2569a030e72788f576cb4e841dd0873

[C:\Documents and Settings\Administrator\桌面\Virus\3533\kaqhiaz.exe]
                  …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:14804  MD5:6bd52f42ecdc3f655ed03a0eea06f597

[C:\Documents and Settings\Administrator\桌面\Virus\3533\kapjezy.dll]
                  …………发现Spy！报告: [4] [6] 注入者[8] HOOK者
文件信息:  大小:24422  MD5:56776a56eae2a0f78f252ee8f67fc040

[C:\Documents and Settings\Administrator\桌面\Virus\3533\kapjeaz.exe]
                  …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:15140  MD5:164393230f8204bda8c9f6d6d55cf00a

[C:\Documents and Settings\Administrator\桌面\Virus\3533\avzxfst.exe]
                  …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:16134  MD5:a907d89c8a8bd2f2bc4508901c0155fe

[C:\Documents and Settings\Administrator\桌面\Virus\3533\avzxfmn.dll]
                  …………发现Spy！报告:[6] 注入者[8] HOOK者
文件信息:  大小:26446  MD5:d6a32075dbbb2dd639c721d76ee4a5b0

[C:\Documents and Settings\Administrator\桌面\Virus\3533\avwldst.exe]
                  …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:15956  MD5:e33b1fcf04d8f6ae6fcbf59dae5c5cee

[C:\Documents and Settings\Administrator\桌面\Virus\3533\avwldmn.dll]
                  …………发现Spy！报告:[6] 注入者[8] HOOK者
文件信息:  大小:23890  MD5:1705ef5e126feb94421c77deb6183a37

[C:\Documents and Settings\Administrator\桌面\Virus\3533\avwgest.exe]
                  …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:15902  MD5:f262c0c3e47a11faa86997209142fb4c

[C:\Documents and Settings\Administrator\桌面\Virus\3533\avwgemn.dll]
                  …………发现Spy！报告: [4] [6] 注入者[8] HOOK者
文件信息:  大小:23372  MD5:29d1fb7094df3358bfcc07d233f10204

[C:\Documents and Settings\Administrator\桌面\Virus\3533\20.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:33409  MD5:b021f223ef435177cae5a99fb75f230a

[C:\Documents and Settings\Administrator\桌面\Virus\3533\19.exe]
                  …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:15942  MD5:89943dcc71967d60dea603aa82ce282e

[C:\Documents and Settings\Administrator\桌面\Virus\3533\17.exe]
                  …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:14366  MD5:eb5156c7565ba56a5191dd4dd87a05b3

[C:\Documents and Settings\Administrator\桌面\Virus\3533\13.exe]
                  …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:15281  MD5:83a2f7f7522d9f1f873cec5915e73e7e

[C:\Documents and Settings\Administrator\桌面\Virus\3533\12.exe]
                  …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:14678  MD5:43d9a099f56d0e6f7d1752e7221ea0da

[C:\Documents and Settings\Administrator\桌面\Virus\3533\11.exe]
                  …………发现Spy！报告:[1] Win32.Unknow[5] 下载者
文件信息:  大小:19787  MD5:cb53cb38621602db27146f560d30c1df

[C:\Documents and Settings\Administrator\桌面\Virus\3533\10.exe]
                  …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:15205  MD5:c48a7272c41b129a6db4d45052484dfb

[C:\Documents and Settings\Administrator\桌面\Virus\3533\4.exe]
                  …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:22450  MD5:e1c48baec44d4db99e46ed9235e8502b

[C:\Documents and Settings\Administrator\桌面\Virus\3533\3.exe]
                  …………发现Spy！报告:[1] Win32.Unknow
文件信息:  大小:13756  MD5:61341347a489d75c99aaf04076b67a73

[C:\Documents and Settings\Administrator\桌面\Virus\3533\2.exe]
                  …………发现Spy！报告:[2] [1] Win32.F/S.ByDwing
文件信息:  大小:16208  MD5:8cadd9cd7a0f7fdeb17b63df6bc27ffd

[C:\Documents and Settings\Administrator\桌面\Virus\3533\Wn_Sys8x.Sys]
                  …………发现Spy！报告: [4] [8] HOOK者
文件信息:  大小:48257  MD5:1b603fde8c062141cb823ad49c951478

[C:\Documents and Settings\Administrator\桌面\Virus\3533\winsock32.dll]
                  …………发现Spy！报告:[8] HOOK者
文件信息:  大小:7680  MD5:ac964f92d3f93ebf4a6667ba45826729

[C:\Documents and Settings\Administrator\桌面\Virus\3533\swjqbzc.dll]
                  …………发现Spy！报告: [4] [6] 注入者[8] HOOK者
文件信息:  大小:24908  MD5:de158f2a6aa1bc35876bd8dde9d689a1

[C:\Documents and Settings\Administrator\桌面\Virus\3533\sidjczy.dll]
                  …………发现Spy！报告: [4] [6] 注入者[8] HOOK者
文件信息:  大小:20316  MD5:14221c761f7d114a6479f0ea92a00ea8

[C:\Documents and Settings\Administrator\桌面\Virus\3533\rsmyhpm.dll]
                  …………发现Spy！报告: [4] [6] 注入者[8] HOOK者
文件信息:  大小:23376  MD5:572a166e86ecc448abc59c918ece630d

[C:\Documents and Settings\Administrator\桌面\Virus\3533\ratbjpi.dll]
                  …………发现Spy！报告: [4] [6] 注入者[8] HOOK者
文件信息:  大小:22876  MD5:39fd111fbc5198339883f0073bfba1cf

文件数:35 病毒数:35  比重:1
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎
[2] 文件特征码引擎
[1] 文件启发式引擎

显示全部楼层 · 发表于 2007-11-17 13:04:49

检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hxn 文件　: F:\du\样本.rar/raqjdtl.exe//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hxp 文件　: F:\du\样本.rar/raqjdpi.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.htv 文件　: F:\du\样本.rar/kvmxhma.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.htv 文件　: F:\du\样本.rar/kvmxhis.exe//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hwt 文件　: F:\du\样本.rar/kvdxsima.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hwt 文件　: F:\du\样本.rar/kvdxsiis.exe//UPack
检测到：木马程序 Trojan-PSW.Win32.Nilage.bue 文件　: F:\du\样本.rar/KVBatch01.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hgx 文件　: F:\du\样本.rar/kawdczy.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hza 文件　: F:\du\样本.rar/kaqhizy.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hza 文件　: F:\du\样本.rar/kaqhiaz.exe//UPack//#
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hzu 文件　: F:\du\样本.rar/kapjezy.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hzu 文件　: F:\du\样本.rar/kapjeaz.exe//UPack//#
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hej 文件　: F:\du\样本.rar/avzxfst.exe//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hoq 文件　: F:\du\样本.rar/avzxfmn.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hlr 文件　: F:\du\样本.rar/avwldst.exe//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hlr 文件　: F:\du\样本.rar/avwldmn.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hsj 文件　: F:\du\样本.rar/avwgest.exe//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hsj 文件　: F:\du\样本.rar/avwgemn.dll
检测到：木马程序 Trojan-PSW.Win32.QQPass.als 文件　: F:\du\样本.rar/20.exe//UPX
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hmn 文件　: F:\du\样本.rar/17.exe//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hzp 文件　: F:\du\样本.rar/13.exe//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hxc 文件　: F:\du\样本.rar/12.exe//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.eop 文件　: F:\du\样本.rar/11.exe
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.gtf 文件　: F:\du\样本.rar/4.exe//PE_Patch//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hxi 文件　: F:\du\样本.rar/3.exe//PE_Patch//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.htv 文件　: F:\du\样本.rar/2.exe//UPack
检测到：木马程序 Trojan-PSW.Win32.QQPass.als 文件　: F:\du\样本.rar/Wn_Sys8x.Sys
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hmp 文件　: F:\du\样本.rar/sidjczy.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hyj 文件　: F:\du\样本.rar/rsmyhpm.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.hxe 文件　: F:\du\样本.rar/ratbjpi.dll

显示全部楼层 · 发表于 2007-11-17 13:07:22

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.5.0
HC0.rlb = 3.0.0
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\10.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\11.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\12.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\13.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\17.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\19.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\2.exe 检测到 Packed.Generic.UPack
[扫描] [捆绑检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\20.exe//UPX 检测到 Generic.Binder
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\3.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\4.exe 检测到 Packed.Generic.Modified
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\avwgemn.dll 检测到 Generic.nFile
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\avwgest.exe 检测到 Packed.Generic.UPack
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\avwldmn.dll 检测到 Trojan.Roast.Hidden
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\avwldst.exe 检测到 Packed.Generic.UPack
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\avzxfmn.dll 检测到 Trojan.Roast.Hidden
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\avzxfst.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\kapjeaz.exe 检测到 Packed.Generic.UPack
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\kapjezy.dll 检测到 Generic.nFile
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\kaqhiaz.exe 检测到 Packed.Generic.UPack
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\kaqhizy.dll 检测到 Generic.nFile
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\kawdczy.dll 检测到 Trojan.Roast.Hidden
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\KVBatch01.dll 检测到 Generic.nFile
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\kvdxsiis.exe 检测到 Packed.Generic.UPack
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\kvdxsima.dll 检测到 Generic.nFile
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\kvmxhis.exe 检测到 Packed.Generic.UPack
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\kvmxhma.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\raqjdpi.dll 检测到 Generic.nFile
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\raqjdtl.exe 检测到 Packed.Generic.UPack
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\rarjepi.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\ratbjpi.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\rsmyhpm.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\sidjczy.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\swjqbzc.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\Wn_Sys8x.Sys 检测到 Generic.nFile
检测到了 31 个未知的恶意程序，请上报。
任务扫描完成。共耗费的时间：0-00-00 00:00:00:0370，共扫描的文件数量：36，共扫描到的威胁数量：34，威胁率：94.44%，扫描速率： 97.3 文件/秒，扫描速度： 7605.48 千字节/秒，共扫描了 2814.03 千字节。

显示全部楼层 · 发表于 2007-11-17 13:10:40

费尔19个。。。。

[病毒样本] logogogo.exe下的35个

本帖子中包含更多资源

浏览过的版块