46个

sam.to

已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.Lmir.boy    檔案: C:\Documents and Settings\kato9096\桌面\164587\608769M.exe//ASPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ieg    檔案: C:\Documents and Settings\kato9096\桌面\164587\608769MM.DLL
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ixl    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa1.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.isb    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa11.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.QQPass.ana    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa12.exe//UPX
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jbt    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa13.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.iys    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa14.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.iuw    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa15.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jbg    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa17.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jbl    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa18.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ism    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa2.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jer    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa22.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ixo    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa23.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jep    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa24.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ivs    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa25.exe//UPack
已刪除: 特洛伊木馬程式 Backdoor.Win32.Ceckno.ff    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa27.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.isb    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa3.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.isb    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa4.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.isb    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa5.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jch    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa7.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.isb    檔案: C:\Documents and Settings\kato9096\桌面\164587\aa8.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jci    檔案: C:\Documents and Settings\kato9096\桌面\164587\AVPSrv.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.iuw    檔案: C:\Documents and Settings\kato9096\桌面\164587\avwggmn.dll
已刪除: 病毒 Worm.Win32.Downloader.bi    檔案: C:\Documents and Settings\kato9096\桌面\164587\cd22.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jbl    檔案: C:\Documents and Settings\kato9096\桌面\164587\gdqqsgi32.dll//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jbg    檔案: C:\Documents and Settings\kato9096\桌面\164587\gdwli32.dll//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.isb    檔案: C:\Documents and Settings\kato9096\桌面\164587\GenProtect.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jck    檔案: C:\Documents and Settings\kato9096\桌面\164587\kapjezy.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ixq    檔案: C:\Documents and Settings\kato9096\桌面\164587\kaqhkzy.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jch    檔案: C:\Documents and Settings\kato9096\桌面\164587\LotusHlp.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ixl    檔案: C:\Documents and Settings\kato9096\桌面\164587\LYLOADER.EXE//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ixj    檔案: C:\Documents and Settings\kato9096\桌面\164587\LYMANGR.DLL//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ixk    檔案: C:\Documents and Settings\kato9096\桌面\164587\MSDEG32.DLL//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.QQPass.ana    檔案: C:\Documents and Settings\kato9096\桌面\164587\NvSys_55.Sys
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.iyz    檔案: C:\Documents and Settings\kato9096\桌面\164587\sidjezy.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ivs    檔案: C:\Documents and Settings\kato9096\桌面\164587\wszjbzx.dll

36个,10个沒报,已上报

sam.to

Hello,

aa16.exed, avzxjmn.dll - Trojan-PSW.Win32.OnLineGames.jey,
aa26.exed, swjqbzc.dll - Trojan-PSW.Win32.OnLineGames.jex,
DbgHlp32.dll - Trojan-PSW.Win32.OnLineGames.jfe,
gdjzi32.dll - Trojan-PSW.Win32.OnLineGames.jfd,
gdmsi32.dll - Trojan-PSW.Win32.OnLineGames.jfc,
MsIMMs32.dll - Trojan-PSW.Win32.OnLineGames.jfb,
NVDispDrv.dll - Trojan-PSW.Win32.OnLineGames.jfa,
upxdnd.dll - Trojan-PSW.Win32.OnLineGames.jez

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Denis Maslennikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

xiongyimeng

48个？？小红伞

左手心

C:\Documents and Settings\c\桌面\样本.rar » RAR » LYMANGR.DLL - Win32/PSW.OnLineGames.DTR trojan - was a part of the deleted object

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.ZhuXian.ej
病毒： Trojan.PSW.Win32.GameOnline.aqn
病毒： Trojan.PSW.Win32.GameOnline.ars
病毒： Trojan.PSW.Win32.GameOnline.aut
病毒： Trojan.PSW.Win32.QQHX.tsi
病毒： Trojan.PSW.Win32.GameOnline.aun
病毒： Trojan.PSW.Win32.SunOnline.ic
病毒： Trojan.PSW.Win32.GameOnline.aqs
病毒： Trojan.PSW.Win32.GameOnline.asm
病毒： Trojan.PSW.Win32.GameOnline.ask
病毒： Trojan.PSW.Win32.GameOnline.asv
病毒： Trojan.PSW.Win32.GameOnline.ans
病毒： Trojan.PSW.Win32.GameOnline.aqo
病毒： Trojan.Win32.Mnless.zqz  
病毒： Trojan.PSW.Win32.WoWar.agc
病毒： Trojan.PSW.Win32.GameOnline.att
病毒： Worm.Win32.PaBug.eq      
病毒： Trojan.PSW.Win32.GameOnline.ars
病毒： Trojan.PSW.Win32.GameOnline.auq
病毒： Trojan.PSW.Win32.GameOnline.aqa
病毒： Trojan.PSW.Win32.GameOnline.aup
病毒： Trojan.PSW.Win32.GameOnline.auc
病毒： Trojan.PSW.Win32.GameOnline.aty
病毒： Trojan.PSW.Win32.ZhuXian.ek
病毒： Trojan.PSW.Win32.QQHX.tsi
病毒： Trojan.PSW.Win32.GameOnline.aqs
病毒： Trojan.PSW.Win32.GameOnline.aur
病毒： Backdoor.Win32.cywl.d   
病毒： Trojan.PSW.Win32.LMir.yyy
病毒： Worm.Win32.PaBug.eq      
病毒： Trojan.PSW.Win32.GameOnline.aro
病毒： Trojan.PSW.Win32.GameOnline.atw
病毒： Trojan.PSW.Win32.GameOnline.asc
病毒： Trojan.PSW.Win32.GameOnline.att
病毒： Trojan.PSW.Win32.GameOnline.aro
病毒： Trojan.PSW.Win32.GameOnline.aro
病毒： Trojan.PSW.Win32.GameOnline.aqk
病毒： Trojan.PSW.Win32.GameOnline.aup
病毒： Trojan.PSW.Win32.GameOnline.aus
病毒： Trojan.PSW.Win32.GameOnline.apo
病毒： Trojan.PSW.Win32.ZeroOnline.cr
病毒： Trojan.PSW.Win32.WoWar.agc
病毒： Trojan.PSW.Win32.QQSG.aq
病毒： Trojan.Win32.Mnless.znc  

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.20.52

墨色丹青

江民只发现30个``

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 985
Paranoia Database - 49298
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder

C:\Documents and Settings\Uhthn\Desktop\New Folder\gdwli32.dll - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\avwggmn.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\sidjezy.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\avzxjmn.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\kaqhkzy.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\kapjezy.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\swjqbzc.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\wszjbzx.dll - Infected WIN32.TROJAN-PSW.ONLINEGAMES.AF - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa1.exe - Infected TROJAN-PSW.ONLINEGAMES.U - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa8.exe - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa17.exe - Suspected MaliciousScope:GENERIC.MALWARE.4
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa18.exe - Suspected MaliciousScope:GENERIC.MALWARE.4
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa11.exe - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa15.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\608769M.exe - Infected WIN32.TROJAN-PSW.LMIR.6 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa13.exe - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa7.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa12.exe - Infected WIN32.TROJAN-PSW.QQPASS.A - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa14.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa16.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa2.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa3.exe - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa4.exe - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa5.exe - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa22.exe - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa23.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa24.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa25.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa26.exe - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\aa27.exe - Suspected TROJAN-DOWNLOADER (HTTP://{REMOVED}/...)
C:\Documents and Settings\Uhthn\Desktop\New Folder\608769MM.DLL - Infected WIN32.MALWARE.AGENT.6 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\NvSys_55.Sys - Infected WIN32.TROJAN-PSW.QQPASS.A - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\LYLOADER.EXE - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\New Folder\AVPSrv.dll - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\DbgHlp32.dll - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\LotusHlp.dll - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\LYMANGR.DLL - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\MSDEG32.DLL - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\NVDispDrv.dll - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\upxdnd.dll - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\MsIMMs32.dll - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\GenProtect.dll - Infected TROJAN-PSW.ONLINEGAMES.43 - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder\gdjzi32.dll - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\gdmsi32.dll - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\gdqqsgi32.dll - Suspected MaliciousScope:GENERIC.MALWARE.3
C:\Documents and Settings\Uhthn\Desktop\New Folder\cd22.exe - Infected GENERIC.MALWARE.28E.7B54 - Deleted

46 Files scanned
20 Infected files found
26 Suspected files found
0 Files disinfected
20 Files deleted

qcs_93140521

金山毒霸报35个

hookon_miriam

CA 43个

Graybird

Starting the file scan:

Begin scan in 'E:\样本.rar'
E:\样本.rar
  [0] Archive type: RAR
  --> gdwli32.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jbg.7
  --> avwggmn.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.iuw
  --> sidjezy.dll
      [DETECTION] Is the Trojan horse TR/FWDisable.22884
  --> avzxjmn.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jey
  --> kaqhkzy.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ixq.10
  --> kapjezy.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGam.htk
  --> swjqbzc.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jex
  --> wszjbzx.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ivs
  --> aa1.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
  --> aa8.exe
      [DETECTION] Is the Trojan horse TR/PSW.28160.2
  --> aa17.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jbg.6
  --> aa18.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jbl.1
  --> aa11.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> aa15.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.iuw
  --> 608769M.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> aa13.exe
      [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
  --> aa7.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jch.1
  --> aa12.exe
      [DETECTION] Is the Trojan horse TR/PSW.QQpass.ana
  --> aa14.exe
      [DETECTION] Is the Trojan horse TR/FWDisable.22884
  --> aa16.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jey
  --> aa2.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.iqw
  --> aa3.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> aa4.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> aa5.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> aa22.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Jer.7
  --> aa23.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> aa24.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGam.htk
  --> aa25.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ivs
  --> aa26.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jex
  --> aa27.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Ceckno.F Backdoor server programs
  --> 608769MM.DLL
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> NvSys_55.Sys
      [DETECTION] Is the Trojan horse TR/PSW.QQpass.ana
  --> LYLOADER.EXE
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
  --> AVPSrv.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> DbgHlp32.dll
      [DETECTION] Is the Trojan horse TR/PSW.28160.2
  --> LotusHlp.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jch.1
  --> LYMANGR.DLL
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
  --> MSDEG32.DLL
      [DETECTION] Is the Trojan horse TR/PSW.Online.gyo.2
  --> NVDispDrv.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> upxdnd.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> MsIMMs32.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> GenProtect.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.iqw
  --> gdjzi32.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jfd
  --> gdmsi32.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
  --> gdqqsgi32.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jbl.2
  --> cd22.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.45056
      [INFO]      The file was deleted!


End of the scan: 2007年12月3日  20:52
Used time: 00:39 min

The scan has been done completely.

      0 Scanning directories
     47 Files were scanned
     45 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes