maran变种X7

promised

C:\ABC\con32.dll - 特征码 'Generic.Lineage' 被发现
C:\ABC\dlyy.dll - 特征码 'Trojan-PWS.Win32.Magania.ke' 被发现
C:\ABC\jar.exe - 特征码 'Trojan-Dropper.Win32.Delf.MM' 被发现
C:\ABC\od3mdi.dll - 特征码 'Generic.PWS.Maran' 被发现
C:\ABC\Pause.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现
C:\ABC\setup_SLL.com - 可疑代码段 被发现 (Level: 120)
C:\ABC\temp.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现
7 文件被扫描
   (0 压缩档 0 文件)
6 特征码被侦测
1 可疑代码段被发现
耗时: 0:12.282

woai_jolin

Date,Virus Name,Virus Type,User,Filename,Scan Type
2007-11-24 19:06:13,Heuri.Possible/Packed,启发式扫描,Administrator,G:\V\maran.rar>>temp.exe,Manual scan
2007-11-24 19:06:13,Heuri.Possible/Packed,启发式扫描,Administrator,G:\V\maran.rar>>setup_SLL.com,Manual scan
2007-11-24 19:06:13,Heuri.Possible/Packed,启发式扫描,Administrator,G:\V\maran.rar>>Pause.exe,Manual scan
2007-11-24 19:06:13,PWSteal.Lineage.rova.dll,木马,Administrator,G:\V\maran.rar>>jar.exe>>emb-1.dll,Manual scan
2007-11-24 19:06:13,PWSteal.Lineage.rova.dll,木马,Administrator,G:\V\maran.rar>>con32.dll,Manual scan

Graybird

Starting the file scan:

Begin scan in 'E:\maran.rar'
E:\maran.rar
  [0] Archive type: RAR
  --> setup_SLL.com
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> Pause.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> od3mdi.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> jar.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> dlyy.dll
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> con32.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> temp.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年11月24日  19:13
Used time: 00:13 min

The scan has been done completely.

      0 Scanning directories
      8 Files were scanned
      3 viruses and/or unwanted programs were found
      4 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      5 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

aerbeisi

检测到：木马程序 Trojan-PSW.Win32.Magania.bjc        文件　: F:\du\maran.rar/Pause.exe
检测到：木马程序 Trojan-PSW.Win32.Magania.bjc        文件　: F:\du\maran.rar/od3mdi.dll
检测到：木马程序 Trojan-PSW.Win32.Magania.bjc        文件　: F:\du\maran.rar/dlyy.dll
检测到：木马程序 Trojan-PSW.Win32.Magania.bjc        文件　: F:\du\maran.rar/temp.exe

sam.to

已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.Magania.bjc    檔案: C:\Documents and Settings\kato9096\桌面\161272\dlyy.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.Magania.bjc    檔案: C:\Documents and Settings\kato9096\桌面\161272\od3mdi.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.Magania.bjc    檔案: C:\Documents and Settings\kato9096\桌面\161272\Pause.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.Magania.bjc    檔案: C:\Documents and Settings\kato9096\桌面\161272\temp.exe

3个没报，已上报

SONGBOWEN

24:11:2007 19:39:05 SEARCHTASK "USER_DEFINED" started...
scan item: C:\Documents and Settings\Administrator\桌面\maran
File scanned: C:\Documents and Settings\Administrator\桌面\maran\con32.dll - SIGNATURE FOUND "Generic.Lineage"
File scanned: C:\Documents and Settings\Administrator\桌面\maran\dlyy.dll - SIGNATURE FOUND "Trojan-PWS.Win32.Magania.ke"
File scanned: C:\Documents and Settings\Administrator\桌面\maran\jar.exe - SIGNATURE FOUND "Trojan-Dropper.Win32.Delf.MM"
File scanned: C:\Documents and Settings\Administrator\桌面\maran\od3mdi.dll - SIGNATURE FOUND "Generic.PWS.Maran"
File scanned: C:\Documents and Settings\Administrator\桌面\maran\Pause.exe - SIGNATURE FOUND "Backdoor.Win32.Agent.ahj"
File scanned: C:\Documents and Settings\Administrator\桌面\maran\temp.exe - SIGNATURE FOUND "Backdoor.Win32.Agent.ahj"
24:11:2007 19:39:15 SEARCHTASK "USER_DEFINED" FINISHED...
----------------------------------------------------
Directories scanned: 1
Files scanned: 7
Virus found: 6
----------------------------------------------------
落下一个……

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Gamania.GEN   
病毒： Trojan.PSW.Win32.OnlineGames.xyq
病毒： Trojan.PSW.Gamania.wn   
病毒： Trojan.PSW.Win32.OnlineGames.cvo

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.19.52

SONGBOWEN

Begin scan in 'C:\Documents and Settings\Administrator\桌面\maran\od3mdi.dll'
C:\Documents and Settings\Administrator\桌面\maran\od3mdi.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '477b0e2a.qua'!
Begin scan in 'C:\Documents and Settings\Administrator\桌面\maran\Pause.exe'
C:\Documents and Settings\Administrator\桌面\maran\Pause.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was moved to '47bd0e27.qua'!
Begin scan in 'C:\Documents and Settings\Administrator\桌面\maran\setup_SLL.com'
C:\Documents and Settings\Administrator\桌面\maran\setup_SLL.com
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was moved to '47bc0e2b.qua'!
Begin scan in 'C:\Documents and Settings\Administrator\桌面\maran\temp.exe'
C:\Documents and Settings\Administrator\桌面\maran\temp.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
      [INFO]      The file was moved to '47b50e2b.qua'!
Begin scan in 'C:\Documents and Settings\Administrator\桌面\maran\con32.dll'
C:\Documents and Settings\Administrator\桌面\maran\con32.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '47b60e35.qua'!
Begin scan in 'C:\Documents and Settings\Administrator\桌面\maran\dlyy.dll'
C:\Documents and Settings\Administrator\桌面\maran\dlyy.dll
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      The file was moved to '47c10e33.qua'!
Begin scan in 'C:\Documents and Settings\Administrator\桌面\maran\jar.exe'
C:\Documents and Settings\Administrator\桌面\maran\jar.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '47ba0e28.qua'!


End of the scan: 2007年11月24日  19:40
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
      7 Files were scanned
      3 viruses and/or unwanted programs were found
      4 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      7 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes

小红伞一个没剩……
还是报壳牛B啊……

SONGBOWEN

卡巴剩下三个……
已删除：木马程序 Trojan-PSW.Win32.Magania.bjc        文件: C:\Documents and Settings\Administrator\桌面\maran\dlyy.dll
已删除：木马程序 Trojan-PSW.Win32.Magania.bjc        文件: C:\Documents and Settings\Administrator\桌面\maran\od3mdi.dll
已删除：木马程序 Trojan-PSW.Win32.Magania.bjc        文件: C:\Documents and Settings\Administrator\桌面\maran\Pause.exe
已删除：木马程序 Trojan-PSW.Win32.Magania.bjc        文件: C:\Documents and Settings\Administrator\桌面\maran\temp.exe
爆汗……

sam.to

Hello,

con32.dll, jar.exe_ - Trojan-PSW.Win32.OnLineGames.iqr,
setup_SLL.com_ - Trojan-PSW.Win32.OnLineGames.iqs

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Namestnikov Yury
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.