31个

Nerazzurri

Hello,

kaqhiaz.exe_ - Trojan-PSW.Win32.OnLineGames.icq,
kaqhizy.dll - Trojan-PSW.Win32.OnLineGames.ico,
rsztipm.dll - Trojan-PSW.Win32.OnLineGames.icr

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Ermilov Maxim
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\样本.rar'
C:\Users\morgan\Documents\
  样本.rar
    [0] Archive type: RAR
    --> wsmsazx.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> wsmsaax.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> Wn_Sys8x.Sys
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> SysWin7k.Jmp
        [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> sidjdzy.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> sidjdaz.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> rsztisp.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> rsztipm.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> ratbjtl.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> ratbjpi.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> rarjetl.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> rarjepi.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvmxhma.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvmxhis.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvdxsima.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvdxsiis.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvdxjma.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvdxjis.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> kawdezy.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> kawdeaz.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> kaqhizy.dll
    --> kaqhiaz.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> avwldst.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> avwldmn.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 608769WL.DLL
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 608769L.exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 21.exe
        [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.2
        [WARNING]   Infected files in archives cannot be repaired!
    --> 19.exe
        [DETECTION] Is the Trojan horse TR/CrashSystem.C
        [WARNING]   Infected files in archives cannot be repaired!
    --> 18.exe
        [DETECTION] Is the Trojan horse TR/CrashSystem.C
        [WARNING]   Infected files in archives cannot be repaired!
    --> 17.exe
        [DETECTION] Is the Trojan horse TR/CrashSystem.C
        [WARNING]   Infected files in archives cannot be repaired!
    --> 16.exe
        [DETECTION] Is the Trojan horse TR/CrashSystem.C
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年11月18日  00:19
Used time: 00:06 min

The scan has been done completely.

      0 Scanning directories
     32 Files were scanned
     19 viruses and/or unwanted programs were found
     11 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     13 Files not concerned
      1 Archives were scanned
     31 Warnings
      0 Notes

sam.to

Hello,

kaqhiaz.exe_ - Trojan-PSW.Win32.OnLineGames.icq,
kaqhizy.dll - Trojan-PSW.Win32.OnLineGames.ico,
rsztipm.dll - Trojan-PSW.Win32.OnLineGames.icr

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Ermilov Maxim
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 939
Paranoia Database - 48881
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder (2)

C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\wsmsazx.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\wsmsaax.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\Wn_Sys8x.Sys - Infected WIN32.TROJAN-PSW.QQPASS.A - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\SysWin7k.Jmp - Infected WIN32.TROJAN-PSW.QQPASS.A - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\sidjdzy.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\sidjdaz.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\rsztisp.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\rsztipm.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\ratbjtl.exe - Infected TROJAN-PSW.ONLINEGAMES.112 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\ratbjpi.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\rarjetl.exe - Infected TROJAN-PSW.ONLINEGAMES.128 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\rarjepi.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\kvmxhma.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\kvmxhis.exe - Infected TROJAN-PSW.ONLINEGAMES.124 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\kvdxsima.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\kvdxsiis.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\kvdxjma.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\kvdxjis.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\kawdezy.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\kawdeaz.exe - Infected TROJAN-PSW.ONLINEGAMES.83 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\kaqhizy.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\kaqhiaz.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\avwldst.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\avwldmn.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\608769WL.DLL - Infected WIN32.TROJAN-PSW.ONLINEGAMES.G - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\608769L.exe - Infected WIN32.TROJAN-PSW.ONLINEGAMES.G - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\21.exe - Infected WIN32.TROJAN.DELF.5 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\19.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\18.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\17.exe - Infected TROJAN-PSW.ONLINEGAMES.48 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\16.exe - Suspected MaliciousScope:GENERIC.MALWARE.4

31 Files scanned
23 Infected files found
8 Suspected files found
0 Files disinfected
23 Files deleted

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.XYOnline.so
病毒： Trojan.PSW.Win32.ZeroOnline.cm
病毒： Trojan.PSW.Win32.ZeroOnline.cm
病毒： Trojan.PSW.Win32.GameOnline.agy
病毒： Trojan.PSW.Win32.LMir.yyr
病毒： Trojan.PSW.Win32.GameOnline.agd
病毒： Trojan.PSW.Win32.YBOnline.ca
病毒： Trojan.PSW.Win32.XYOnline.so
病毒： Trojan.PSW.Win32.XYOnline.sn
病毒： Trojan.PSW.Win32.XYOnline.sn
病毒： Trojan.PSW.Win32.NSword.cl
病毒： Trojan.PSW.Win32.SunOnline.gv
病毒： Trojan.PSW.Win32.Woool.c
病毒： Trojan.PSW.Win32.Woool.c
病毒： Trojan.PSW.Win32.GameOnline.wf
病毒： Trojan.PSW.Win32.WoWar.afb

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.18.61

kkgh

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.XYOnline.so
病毒： Trojan.PSW.Win32.ZeroOnline.cm
病毒： Trojan.PSW.Win32.ZeroOnline.cm
病毒： Trojan.PSW.Win32.GameOnline.agy
病毒： Trojan.PSW.Win32.LMir.yyr
病毒： Trojan.PSW.Win32.GameOnline.agd
病毒： Trojan.PSW.Win32.YBOnline.ca
病毒： Trojan.PSW.Win32.XYOnline.so
病毒： Trojan.PSW.Win32.XYOnline.sn
病毒： Trojan.PSW.Win32.XYOnline.sn
病毒： Trojan.PSW.Win32.NSword.cl
病毒： Trojan.PSW.Win32.SunOnline.gv
病毒： Trojan.PSW.Win32.Woool.c
病毒： Trojan.PSW.Win32.Woool.c
病毒： Trojan.PSW.Win32.GameOnline.wf
病毒： Trojan.PSW.Win32.WoWar.afb

用户来源：互联网

软件版本：20.18.62

clock11011

kv只杀22个

wangfeng66

D:\样本.rar\wsmsazx.dll - infected with Trojan.PWS.Gamania.5659
D:\样本.rar\wsmsaax.exe - infected with Trojan.PWS.Gamania.5659
D:\样本.rar\Wn_Sys8x.Sys - infected with Trojan.PWS.Lineage.origin
D:\样本.rar\SysWin7k.Jmp - infected with Trojan.PWS.Qqpass.origin
D:\样本.rar\sidjdzy.dll - infected with Trojan.PWS.Gamania.5671
D:\样本.rar\sidjdaz.exe - infected with Trojan.PWS.Gamania.5671
D:\样本.rar\rsztisp.exe - infected with Trojan.PWS.Gamania.origin
D:\样本.rar\ratbjtl.exe - infected with Trojan.PWS.Gamania.5662
D:\样本.rar\ratbjpi.dll - infected with Trojan.PWS.Gamania.5662
D:\样本.rar\rarjetl.exe - infected with Trojan.MulDrop.origin
D:\样本.rar\rarjepi.dll - infected with Trojan.PWS.Gamania.origin
D:\样本.rar\kvmxhma.dll - infected with Trojan.PWS.Gamania.origin
D:\样本.rar\kvmxhis.exe - infected with Trojan.MulDrop.origin
D:\样本.rar\kvdxsima.dll - infected with Trojan.PWS.Gamania.origin
D:\样本.rar\kvdxsiis.exe - infected with Trojan.PWS.Gamania.origin
D:\样本.rar\kvdxjma.dll - infected with Trojan.PWS.Gamania.5663
D:\样本.rar\kvdxjis.exe - infected with Trojan.PWS.Gamania.5663
D:\样本.rar\kawdezy.dll - infected with Trojan.PWS.Gamania.origin
D:\样本.rar\kawdeaz.exe - infected with Trojan.PWS.Gamania.origin
D:\样本.rar\kaqhizy.dll - infected with Trojan.PWS.Gamania.origin
D:\样本.rar\kaqhiaz.exe - infected with Trojan.MulDrop.origin
D:\样本.rar\avwldst.exe - infected with Trojan.PWS.Gamania.5614
D:\样本.rar\avwldmn.dll - infected with Trojan.PWS.Gamania.origin
D:\样本.rar\608769L.exe - probably infected with MULDROP.Trojan
D:\样本.rar\21.exe\data002 - infected with Trojan.Sniff

Archive contains 25 infected items
DRWEB 4.44

398566384

kis8全部干掉

jeremy600832

瑞星病毒查杀结果报告

清除病毒种类列表：30
病毒： Trojan.PSW.Win32.WoWar.afh
病毒： Trojan.PSW.Win32.XYOnline.so
病毒： Worm.Win32.PaBug.du      
病毒： Worm.Win32.PaBug.du      
病毒： Trojan.PSW.Win32.ZeroOnline.cm
病毒： Trojan.PSW.Win32.ZeroOnline.cm
病毒： Trojan.PSW.Win32.GameOnline.agy
病毒： Trojan.PSW.Win32.GameOnline.ajh
病毒： Trojan.PSW.Win32.LMir.yyr
病毒： Trojan.PSW.Win32.GameOnline.agd
病毒： Trojan.PSW.Win32.YBOnline.ca
病毒： Trojan.PSW.Win32.XYOnline.so
病毒： Trojan.PSW.Win32.XYOnline.sw
病毒： Trojan.PSW.Win32.AskTao.eq
病毒： Trojan.PSW.Win32.XYOnline.sn
病毒： Trojan.PSW.Win32.XYOnline.sn
病毒： Trojan.PSW.Win32.AskTao.eq
病毒： Trojan.PSW.Win32.QQHX.tsb
病毒： Trojan.PSW.Win32.QQHX.tsb
病毒： Trojan.PSW.Win32.NSword.cl
病毒： Trojan.PSW.Win32.SunOnline.gv
病毒： Trojan.PSW.Win32.Woool.c
病毒： Trojan.PSW.Win32.Woool.c
病毒： Trojan.PSW.Win32.GameOnline.aji
病毒： Trojan.PSW.Win32.GameOnline.wf
病毒： Trojan.PSW.Win32.WoWar.afb
病毒： Trojan.PSW.Win32.RocOnline.hy

MAC 地址：00:0F:EA:6C:08:F1

用户来源：局域网

软件版本：20.19.12