下载者及产物共44个

promised

0

promised

C:\ABC\x\bd\bd.zip
        C:\ABC\x\bd\bd.zip\System76.Ins
>>> Virus 'Mal/Dloadr-B' found in file C:\ABC\x\bd\bd.zip\System76.Ins
        C:\ABC\x\bd\bd.zip\svcos.exe
        C:\ABC\x\bd\bd.zip\svcos.exe\FILE:0000
>>> Virus 'Mal/Dloadr-B' found in file C:\ABC\x\bd\bd.zip\svcos.exe\FILE:0000
>>> File "C:\ABC\x\bd\bd.zip\svcos.exe" has been identified as suspicious 'Sus/Dropper-R'.
        C:\ABC\x\bd\样本.rar
        C:\ABC\x\bd\样本.rar\sidjezy.dll
>>> Virus 'Mal/Delagen-A' found in file C:\ABC\x\bd\样本.rar\sidjezy.dll
        C:\ABC\x\bd\样本.rar\svcost.exe
>>> Virus 'Mal/Packer' found in file C:\ABC\x\bd\样本.rar\svcost.exe
        C:\ABC\x\bd\样本.rar\wdfmgr32.exe
>>> File "C:\ABC\x\bd\样本.rar\wdfmgr32.exe" has been identified as suspicious 'Sus/UnkPacker'.
        C:\ABC\x\bd\样本.rar\Wn_Sys8x.Sys
>>> Virus 'Mal/Gampass-A' found in file C:\ABC\x\bd\样本.rar\Wn_Sys8x.Sys
        C:\ABC\x\bd\样本.rar\1.exe
        C:\ABC\x\bd\样本.rar\1.exe\FILE:0000
>>> Virus 'Mal/Packer' found in file C:\ABC\x\bd\样本.rar\1.exe\FILE:0000
>>> Virus 'Mal/PWS-N' found in file C:\ABC\x\bd\样本.rar\1.exe
        C:\ABC\x\bd\样本.rar\2.exe
>>> Virus 'Mal/Packer' found in file C:\ABC\x\bd\样本.rar\2.exe
        C:\ABC\x\bd\样本.rar\3.exe
>>> Virus 'Mal/Behav-112' found in file C:\ABC\x\bd\样本.rar\3.exe
        C:\ABC\x\bd\样本.rar\4.exe
>>> Virus 'Mal/Behav-112' found in file C:\ABC\x\bd\样本.rar\4.exe
        C:\ABC\x\bd\样本.rar\5.exe
>>> Virus 'Mal/Behav-112' found in file C:\ABC\x\bd\样本.rar\5.exe
        C:\ABC\x\bd\样本.rar\6.exe
>>> Virus 'Mal/Behav-112' found in file C:\ABC\x\bd\样本.rar\6.exe
        C:\ABC\x\bd\样本.rar\7.exe
>>> Virus 'Mal/Behav-112' found in file C:\ABC\x\bd\样本.rar\7.exe
        C:\ABC\x\bd\样本.rar\8.exe
>>> Virus 'Mal/Behav-112' found in file C:\ABC\x\bd\样本.rar\8.exe
        C:\ABC\x\bd\样本.rar\9.exe
>>> Virus 'Mal/Behav-112' found in file C:\ABC\x\bd\样本.rar\9.exe
        C:\ABC\x\bd\样本.rar\10.exe
>>> Virus 'Mal/Behav-112' found in file C:\ABC\x\bd\样本.rar\10.exe
        C:\ABC\x\bd\样本.rar\11.exe
>>> Virus 'Mal/Behav-112' found in file C:\ABC\x\bd\样本.rar\11.exe
        C:\ABC\x\bd\样本.rar\12.exe
>>> Virus 'Mal/Packer' found in file C:\ABC\x\bd\样本.rar\12.exe
        C:\ABC\x\bd\样本.rar\13.exe
>>> Virus 'Mal/Packer' found in file C:\ABC\x\bd\样本.rar\13.exe
        C:\ABC\x\bd\样本.rar\14.exe
>>> Virus 'Mal/Packer' found in file C:\ABC\x\bd\样本.rar\14.exe
        C:\ABC\x\bd\样本.rar\15.exe
>>> Virus 'Mal/Behav-112' found in file C:\ABC\x\bd\样本.rar\15.exe
        C:\ABC\x\bd\样本.rar\16.exe
>>> Virus 'Mal/Behav-112' found in file C:\ABC\x\bd\样本.rar\16.exe
        C:\ABC\x\bd\样本.rar\17.exe
>>> Virus 'Mal/Packer' found in file C:\ABC\x\bd\样本.rar\17.exe
        C:\ABC\x\bd\样本.rar\18.exe
        C:\ABC\x\bd\样本.rar\18.exe\FILE:0000
>>> Virus 'Mal/Gampass-A' found in file C:\ABC\x\bd\样本.rar\18.exe\FILE:0000
>>> File "C:\ABC\x\bd\样本.rar\18.exe" has been identified as suspicious 'Sus/Dropper-R'.
        C:\ABC\x\bd\样本.rar\19.exe
        C:\ABC\x\bd\样本.rar\19.exe\FILE:0000
>>> File "C:\ABC\x\bd\样本.rar\19.exe\FILE:0000" has been identified as suspicious 'Sus/UnkPacker'.
        C:\ABC\x\bd\样本.rar\1222.ocx
>>> Virus 'Mal/Packer' found in file C:\ABC\x\bd\样本.rar\1222.ocx
        C:\ABC\x\bd\样本.rar\avwggmn.dll
>>> Virus 'Mal/Delagen-A' found in file C:\ABC\x\bd\样本.rar\avwggmn.dll
        C:\ABC\x\bd\样本.rar\avwlgmn.dll
>>> Virus 'Mal/Gampass-A' found in file C:\ABC\x\bd\样本.rar\avwlgmn.dll
        C:\ABC\x\bd\样本.rar\gdcqi32.dll
>>> Virus 'Mal/Packer' found in file C:\ABC\x\bd\样本.rar\gdcqi32.dll
        C:\ABC\x\bd\样本.rar\gdmsi32.dll
>>> Virus 'Mal/Packer' found in file C:\ABC\x\bd\样本.rar\gdmsi32.dll
        C:\ABC\x\bd\样本.rar\gdqji32.dll
>>> Virus 'Mal/Packer' found in file C:\ABC\x\bd\样本.rar\gdqji32.dll
        C:\ABC\x\bd\样本.rar\gdzxi32.dll
>>> Virus 'Mal/Packer' found in file C:\ABC\x\bd\样本.rar\gdzxi32.dll
        C:\ABC\x\bd\样本.rar\GenProtect.dll
>>> File "C:\ABC\x\bd\样本.rar\GenProtect.dll" has been identified as suspicious 'Sus/Malware-A'.
        C:\ABC\x\bd\样本.rar\kaqhkzy.dll
>>> Virus 'Mal/Behav-001' found in file C:\ABC\x\bd\样本.rar\kaqhkzy.dll
        C:\ABC\x\bd\样本.rar\kawdfzy.dll
>>> Virus 'Mal/Delagen-A' found in file C:\ABC\x\bd\样本.rar\kawdfzy.dll
        C:\ABC\x\bd\样本.rar\kvdxjma.dll
>>> Virus 'Mal/Delagen-A' found in file C:\ABC\x\bd\样本.rar\kvdxjma.dll
        C:\ABC\x\bd\样本.rar\kvdxsjma.dll
>>> Virus 'Mal/Delagen-A' found in file C:\ABC\x\bd\样本.rar\kvdxsjma.dll
        C:\ABC\x\bd\样本.rar\LYLOADER.EXE
>>> Virus 'Mal/Packer' found in file C:\ABC\x\bd\样本.rar\LYLOADER.EXE
        C:\ABC\x\bd\样本.rar\LYMANGR.DLL
>>> Virus 'Mal/Packer' found in file C:\ABC\x\bd\样本.rar\LYMANGR.DLL
        C:\ABC\x\bd\样本.rar\MSDEG32.DLL
>>> Virus 'Mal/Packer' found in file C:\ABC\x\bd\样本.rar\MSDEG32.DLL
        C:\ABC\x\bd\样本.rar\okmhazy.dll
>>> Virus 'Mal/Delagen-A' found in file C:\ABC\x\bd\样本.rar\okmhazy.dll
        C:\ABC\x\bd\样本.rar\rarjepi.dll
>>> Virus 'Mal/Delagen-A' found in file C:\ABC\x\bd\样本.rar\rarjepi.dll
        C:\ABC\x\bd\样本.rar\ratbmpi.dll
>>> Virus 'Mal/Delagen-A' found in file C:\ABC\x\bd\样本.rar\ratbmpi.dll
        C:\ABC\x\bd\样本.rar\rsztmpm.dll
>>> Virus 'Mal/Delagen-A' found in file C:\ABC\x\bd\样本.rar\rsztmpm.dll

IllusionWing

少1个..

UGuard Log (Digital Fox - gankeyu@126.com)
UGuarduu.exe = 4.5.5
HC0.rlb = 3.1.0
HC2.rlb = 2.4.0
FN0.rlb = 2.3.1
扫描选项：扫描档案, 扩展, 忽略非活动, 忽略大文件, nFile, BAT模拟, 捆绑检测, 变形壳, 启发,
[扫描] [Level 1] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\1.exe//Crypt3 检测到 Generic.Virus
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\10.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\11.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\12.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\1222.ocx 检测到 Packed.Unknown.3747
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\13.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\14.exe 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\15.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\16.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\17.exe 检测到 Packed.Generic.Modified
[扫描] [捆绑检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\18.exe//UPX 检测到 Generic.Binder
[扫描] [捆绑检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\19.exe//Crypt1 检测到 Generic.Binder
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\2.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\3.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\4.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\5.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\6.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\7.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\8.exe 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\9.exe 检测到 Packed.Generic.UPack
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\avwggmn.dll 检测到 Trojan.Roast.Hidden
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\avwlgmn.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\gdcqi32.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\gdmsi32.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\gdqji32.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\gdzxi32.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\kaqhkzy.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\kawdfzy.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\kvdxjma.dll 检测到 Generic.nFile
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\kvdxsjma.dll 检测到 Trojan.Roast.Hidden
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\LYLOADER.EXE 检测到 Packed.Generic.Modified
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\LYMANGR.DLL 检测到 Packed.Generic.UPack
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\MSDEG32.DLL 检测到 Packed.Generic.UPack
[扫描] [Level 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\okmhazy.dll 检测到 Trojan.Roast.Hidden
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\rarjepi.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\ratbmpi.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\rsztmpm.dll 检测到 Generic.nFile
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\sidjezy.dll 检测到 Generic.nFile
[扫描] [捆绑检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\svcos.exe 检测到 Generic.Binder
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\svcost.exe 检测到 Packed.Unknown.c2c4
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\System76.Ins 检测到 Generic.nFile
[扫描] [变形壳检测] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\wdfmgr32.exe 检测到 Packed.Unknown.Modified
[扫描] [nFile Detect 2] 在 C:\Documents and Settings\Administrator\桌面\Virus\YB\Wn_Sys8x.Sys 检测到 Generic.nFile
检测到了 40 个未知的恶意程序，请上报。
任务 扫描 完成。共耗费的时间：0-00-00 00:00:00:0761，共扫描的文件数量：47，共扫描到的威胁数量：43，威胁率：91.49%，扫描速率： 61.76 文件/秒，扫描速度： 4307.85 千字节/秒，共扫描了 3278.27 千字节。

IllusionWing

那个GenProtect.dll到底是嘛玩意儿。。。咋啥包里都有

无尽藏海

Begin scan in 'D:\Downloads\样本\bd.zip'
D:\Downloads\样本\
  bd.zip
    [0] Archive type: ZIP
    --> System76.Ins
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> svcos.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

End of the scan: 2007年12月1日  12:50
Used time: 00:04 min
The scan has been done completely.
      0 Scanning directories
      3 Files were scanned
      0 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      1 Archives were scanned
      3 Warnings
      0 Notes



Begin scan in 'D:\Downloads\样本\样本.rar'
D:\Downloads\样本\
  样本.rar
    [0] Archive type: RAR
    --> sidjezy.dll
        [DETECTION] Is the Trojan horse TR/FWDisable.22884
        [WARNING]   Infected files in archives cannot be repaired!
    --> svcost.exe
        [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> wdfmgr32.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> Wn_Sys8x.Sys
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.iwa
        [WARNING]   Infected files in archives cannot be repaired!
    --> 1.exe
        [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
        [WARNING]   Infected files in archives cannot be repaired!
    --> 2.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.iqw
        [WARNING]   Infected files in archives cannot be repaired!
    --> 3.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 4.exe
        [DETECTION] Is the Trojan horse TR/FWDisable.22884
        [WARNING]   Infected files in archives cannot be repaired!
    --> 5.exe
        [DETECTION] Is the Trojan horse TR/FWDisable.24416.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> 6.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 7.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.ikc
        [WARNING]   Infected files in archives cannot be repaired!
    --> 8.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 9.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ixp
        [WARNING]   Infected files in archives cannot be repaired!
    --> 10.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 11.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.iux
        [WARNING]   Infected files in archives cannot be repaired!
    --> 12.exe
        [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
        [WARNING]   Infected files in archives cannot be repaired!
    --> 13.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 14.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 15.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hxy
        [WARNING]   Infected files in archives cannot be repaired!
    --> 16.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 17.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> 18.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.iwa
        [WARNING]   Infected files in archives cannot be repaired!
    --> 19.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> 1222.ocx
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> avwggmn.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> avwlgmn.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> gdcqi32.dll
    --> gdmsi32.dll
        [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
        [WARNING]   Infected files in archives cannot be repaired!
    --> gdqji32.dll
    --> gdzxi32.dll
    --> GenProtect.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.iqw
        [WARNING]   Infected files in archives cannot be repaired!
    --> kaqhkzy.dll
    --> kawdfzy.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.ikc
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvdxjma.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvdxsjma.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.iux
        [WARNING]   Infected files in archives cannot be repaired!
    --> LYLOADER.EXE
        [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
        [WARNING]   Infected files in archives cannot be repaired!
    --> LYMANGR.DLL
        [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
        [WARNING]   Infected files in archives cannot be repaired!
    --> MSDEG32.DLL
        [DETECTION] Is the Trojan horse TR/PSW.Online.gyo.2
        [WARNING]   Infected files in archives cannot be repaired!
    --> okmhazy.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ixp
        [WARNING]   Infected files in archives cannot be repaired!
    --> rarjepi.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hxy
        [WARNING]   Infected files in archives cannot be repaired!
    --> ratbmpi.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> rsztmpm.dll
        [DETECTION] Is the Trojan horse TR/FWDisable.24416.1
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

End of the scan: 2007年12月1日  12:50
Used time: 00:06 min
The scan has been done completely.
      0 Scanning directories
     43 Files were scanned
     30 viruses and/or unwanted programs were found
      8 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     13 Files not concerned
      1 Archives were scanned
     39 Warnings
      0 Notes

[ 本帖最后由 无尽藏海 于 2007-12-1 12:53 编辑 ]

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\bd.zip'
C:\Users\morgan\Documents\
  bd.zip
    [0] Archive type: ZIP
    --> System76.Ins
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
      --> svcos.exe
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains suspicious code HEUR/Malware
            [WARNING]   Infected files in archives cannot be repaired!
      [WARNING]   The file was ignored!

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\��.rar'
C:\Users\morgan\Documents\
  ��.rar
    [0] Archive type: RAR
    --> sidjezy.dll
        [DETECTION] Is the Trojan horse TR/FWDisable.22884
        [WARNING]   Infected files in archives cannot be repaired!
      --> svcost.exe
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
            [WARNING]   Infected files in archives cannot be repaired!
    --> wdfmgr32.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> Wn_Sys8x.Sys
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.iwa
        [WARNING]   Infected files in archives cannot be repaired!
      --> 1.exe
        [1] Archive type: RSRC
        --> Object
      --> 2.exe
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.iqw
            [WARNING]   Infected files in archives cannot be repaired!
      --> 3.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Contains suspicious code HEUR/Malware
              [WARNING]   Infected files in archives cannot be repaired!
      --> 4.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/FWDisable.22884
              [WARNING]   Infected files in archives cannot be repaired!
      --> 5.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/FWDisable.24416.1
              [WARNING]   Infected files in archives cannot be repaired!
      --> 6.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Contains suspicious code HEUR/Malware
              [WARNING]   Infected files in archives cannot be repaired!
      --> 7.exe
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.ikc
            [WARNING]   Infected files in archives cannot be repaired!
      --> 8.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Contains suspicious code HEUR/Malware
              [WARNING]   Infected files in archives cannot be repaired!
      --> 9.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ixp
              [WARNING]   Infected files in archives cannot be repaired!
      --> 10.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Contains suspicious code HEUR/Malware
              [WARNING]   Infected files in archives cannot be repaired!
      --> 11.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.iux
              [WARNING]   Infected files in archives cannot be repaired!
      --> 12.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 13.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 14.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 15.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hxy
              [WARNING]   Infected files in archives cannot be repaired!
      --> 16.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Contains suspicious code HEUR/Malware
              [WARNING]   Infected files in archives cannot be repaired!
      --> 17.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 18.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.iwa
              [WARNING]   Infected files in archives cannot be repaired!
      --> 19.exe
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
            [WARNING]   Infected files in archives cannot be repaired!
      --> 1222.ocx
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Contains suspicious code HEUR/Malware
            [WARNING]   Infected files in archives cannot be repaired!
    --> avwggmn.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> avwlgmn.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
      --> gdcqi32.dll
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
          --> Object
      --> gdmsi32.dll
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
            [WARNING]   Infected files in archives cannot be repaired!
      --> gdqji32.dll
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
          --> Object
      --> gdzxi32.dll
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
          --> Object
    --> GenProtect.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.iqw
        [WARNING]   Infected files in archives cannot be repaired!
    --> kaqhkzy.dll
    --> kawdfzy.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.ikc
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvdxjma.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvdxsjma.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.iux
        [WARNING]   Infected files in archives cannot be repaired!
      --> LYLOADER.EXE
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
          --> Object
      --> LYMANGR.DLL
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
            [WARNING]   Infected files in archives cannot be repaired!
      --> MSDEG32.DLL
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.Online.gyo.2
            [WARNING]   Infected files in archives cannot be repaired!
    --> okmhazy.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ixp
        [WARNING]   Infected files in archives cannot be repaired!
    --> rarjepi.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.hxy
        [WARNING]   Infected files in archives cannot be repaired!
    --> ratbmpi.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> rsztmpm.dll
        [DETECTION] Is the Trojan horse TR/FWDisable.24416.1
        [WARNING]   Infected files in archives cannot be repaired!
      [WARNING]   The file was ignored!


End of the scan: 2007年11月30日  21:10
Used time: 00:07 min

The scan has been done completely.

      0 Scanning directories
     43 Files were scanned
     23 viruses and/or unwanted programs were found
     15 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     20 Files not concerned
     22 Archives were scanned
     33 Warnings
      0 Notes

wangfeng66

bd.rar  全灭
样本.rar   杀34个 漏网10个

DRWEB 4.44

kkgh

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.GameOnline.ars
病毒： Trojan.DL.Win32.VB.ycx   
病毒： Worm.Win32.PaBug.el      
病毒： Trojan.PSW.Win32.GameOnline.aro
病毒： Trojan.PSW.Win32.GameOnline.asx
病毒： Trojan.PSW.Win32.GameOnline.ars
病毒： Trojan.PSW.Win32.SunOnline.hl
病毒： Trojan.PSW.Win32.TLOnline.jjw
病毒： Trojan.PSW.Win32.XYOnline.ty
病毒： Trojan.PSW.Win32.QQHX.tsi
病毒： Trojan.PSW.Win32.XYOnline.uh
病毒： Trojan.PSW.Win32.GameOnline.ato
病毒： Trojan.PSW.Win32.XYOnline.tz
病毒： Trojan.PSW.Win32.XYOnline.sf
病毒： Worm.Win32.PaBug.el      
病毒： Trojan.PSW.Win32.GameOnline.atp
病毒： Trojan.PSW.Win32.LMir.yxs
病毒： Trojan.PSW.Win32.WoWar.afx
病毒： Trojan.PSW.Win32.GameOnline.asx
病毒： Trojan.PSW.Win32.QQHX.tsi
病毒： Trojan.PSW.Win32.AskTao.ey
病毒： Trojan.PSW.Win32.XYOnline.tx
病毒： Trojan.PSW.Win32.GameOnline.aro
病毒： Trojan.PSW.Win32.GameOnline.aro
病毒： Trojan.PSW.Win32.GameOnline.aro
病毒： Trojan.PSW.Win32.XYOnline.uh
病毒： Trojan.PSW.Win32.OnlineGames.hxy
病毒： Trojan.PSW.Win32.TLOnline.jjw
病毒： Trojan.PSW.Win32.GameOnline.atk

用户来源：互联网

软件版本：20.20.50

sam.to

已刪除: 特洛伊木馬程式 Trojan-Dropper.Win32.Small.bbz    檔案: C:\Documents and Settings\kato9096\桌面\样本\1.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jbp    檔案: C:\Documents and Settings\kato9096\桌面\样本\10.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.iux    檔案: C:\Documents and Settings\kato9096\桌面\样本\11.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.iub    檔案: C:\Documents and Settings\kato9096\桌面\样本\12.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hxo    檔案: C:\Documents and Settings\kato9096\桌面\样本\15.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ivx    檔案: C:\Documents and Settings\kato9096\桌面\样本\18.exe//UPX
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jbj    檔案: C:\Documents and Settings\kato9096\桌面\样本\2.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.iys    檔案: C:\Documents and Settings\kato9096\桌面\样本\4.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.irq    檔案: C:\Documents and Settings\kato9096\桌面\样本\5.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jbm    檔案: C:\Documents and Settings\kato9096\桌面\样本\6.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.Lmir.bpe    檔案: C:\Documents and Settings\kato9096\桌面\样本\7.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ixo    檔案: C:\Documents and Settings\kato9096\桌面\样本\8.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ixn    檔案: C:\Documents and Settings\kato9096\桌面\样本\9.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jbp    檔案: C:\Documents and Settings\kato9096\桌面\样本\avwggmn.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jbo    檔案: C:\Documents and Settings\kato9096\桌面\样本\gdmsi32.dll//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jbj    檔案: C:\Documents and Settings\kato9096\桌面\样本\GenProtect.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ixq    檔案: C:\Documents and Settings\kato9096\桌面\样本\kaqhkzy.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.iwb    檔案: C:\Documents and Settings\kato9096\桌面\样本\kawdfzy.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.iux    檔案: C:\Documents and Settings\kato9096\桌面\样本\kvdxsjma.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ixl    檔案: C:\Documents and Settings\kato9096\桌面\样本\LYLOADER.EXE//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ixj    檔案: C:\Documents and Settings\kato9096\桌面\样本\LYMANGR.DLL//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ixk    檔案: C:\Documents and Settings\kato9096\桌面\样本\MSDEG32.DLL//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ixp    檔案: C:\Documents and Settings\kato9096\桌面\样本\okmhazy.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.hxy    檔案: C:\Documents and Settings\kato9096\桌面\样本\rarjepi.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.jbm    檔案: C:\Documents and Settings\kato9096\桌面\样本\ratbmpi.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ivo    檔案: C:\Documents and Settings\kato9096\桌面\样本\rsztmpm.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.iyz    檔案: C:\Documents and Settings\kato9096\桌面\样本\sidjezy.dll
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Cryptic.gen    檔案: C:\Documents and Settings\kato9096\桌面\样本\wdfmgr32.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.iwa    檔案: C:\Documents and Settings\kato9096\桌面\样本\Wn_Sys8x.Sys

29个，１５个没报，已上报

sam.to

Hello.

New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.

--
Regards, Ilya Goncharov
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com