下载者下的19个

显示全部楼层 · 发表于 2007-12-2 13:00:17

C:\ABC\1\样本.rar:\WinSy_8z.Sys - 特征码 'Trojan-PWS.Win32.Nilage.bga' 被发现
C:\ABC\1\样本.rar:\sms0s.exe - 特征码 'Virus.Win32.AutoRun.bs' 被发现
C:\ABC\1\样本.rar:\sms2s.exe - 特征码 'Trojan-Spy.Win32.Agent.hz' 被发现
C:\ABC\1\样本.rar:\sms3s.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.jer' 被发现
C:\ABC\1\样本.rar:\sms4s.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\1\样本.rar:\sms5s.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\1\样本.rar:\sms6s.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\1\样本.rar:\sms7s.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\1\样本.rar:\sms8s.exe - 特征码 'Trojan-Downloader.Win32.Zlob.and' 被发现
C:\ABC\1\样本.rar:\sms9s.exe - 特征码 'Trojan-Spy.Win32.Delf.uv' 被发现
C:\ABC\1\样本.rar:\Sy_Win7z.Jmp
C:\ABC\1\样本.rar:\GenProtect.dll - 特征码 'Trojan-PWS.Win32.OnLineGames.es' 被发现
C:\ABC\1\样本.rar:\upxdnd.dll - 特征码 'Trojan-PWS.Win32.OnLineGames.isb' 被发现
C:\ABC\1\样本.rar:\kvdxjma.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\1\样本.rar:\sidjezy.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\1\样本.rar:\avwggmn.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\1\样本.rar:\rarjepi.dll - 特征码 'BehavesLikeTrojan.WUDisable' 被发现
C:\ABC\1\样本.rar:\gdmsi32.dll - 特征码 'Trojan-PWS.Win32.Small.br' 被发现
C:\ABC\1\样本.rar:\gdcqi32.dll - 特征码 'Trojan-PWS.Win32.Small.br' 被发现
C:\ABC\1\样本.rar

显示全部楼层 · 发表于 2007-12-2 13:07:08

MicroVita AntiSpyware 100 C
_____________________________________________

         风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\19\WinSy_8z.Sys]
                  …………发现Spy！报告: [4] [8] HOOK者
文件信息:  大小:45730  MD5:a1459c20b51fa0a890a0e41027ea58bd

[C:\Documents and Settings\Administrator\桌面\Virus\19\sms0s.exe]
                  …………发现Spy！报告:[2]
文件信息:  大小:34978  MD5:ef11f4c81ba33b24b72e5e0ffeddba30

[C:\Documents and Settings\Administrator\桌面\Virus\19\sms2s.exe]
                  …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:18997  MD5:306d6d5d7449c385713d5e7280bb5a19

[C:\Documents and Settings\Administrator\桌面\Virus\19\sms3s.exe]
                  …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:14288  MD5:6337e48a1ec3662e34f399c20a7c0ed1

[C:\Documents and Settings\Administrator\桌面\Virus\19\sms4s.exe]
                  …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:15556  MD5:10c0f2011d4887313f07337c626a1feb

[C:\Documents and Settings\Administrator\桌面\Virus\19\sms5s.exe]
                  …………发现Spy！报告:[1] Win32.Unknow
文件信息:  大小:18476  MD5:9f1c2b1e4b4975a6388a8574c943ccb5

[C:\Documents and Settings\Administrator\桌面\Virus\19\sms6s.exe]
                  …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:14564  MD5:7707b4f4c442d33ccad2b5f44933ebb2

[C:\Documents and Settings\Administrator\桌面\Virus\19\sms7s.exe]
                  …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:15299  MD5:4816b4ae66b133d300e49d18efb0c7c4

[C:\Documents and Settings\Administrator\桌面\Virus\19\sms8s.exe]
                  …………发现Spy！报告:[1] Win32.Unknow
文件信息:  大小:16148  MD5:268f584f3d2ceb38e68ea492b3e31523

[C:\Documents and Settings\Administrator\桌面\Virus\19\sms9s.exe]
                  …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:15356  MD5:32355098adf01e0596972b205b385eb4

[C:\Documents and Settings\Administrator\桌面\Virus\19\Sy_Win7z.Jmp]
                  …………发现Spy！报告:[2]
文件信息:  大小:34978  MD5:6c016272fbafe89af50c2ddd62de1504

[C:\Documents and Settings\Administrator\桌面\Virus\19\upxdnd.dll]
                  …………发现Spy！报告:[1] Win32.Badsoft.RX[8] HOOK者
文件信息:  大小:26112  MD5:17967a54fc9b4890137892f3444d6040

[C:\Documents and Settings\Administrator\桌面\Virus\19\kvdxjma.dll]
                  …………发现Spy！报告: [4] [6] 注入者[8] HOOK者
文件信息:  大小:24402  MD5:bcd868c4a28f10f31a4f5c9611654952

[C:\Documents and Settings\Administrator\桌面\Virus\19\sidjezy.dll]
                  …………发现Spy！报告: [4] [6] 注入者[8] HOOK者
文件信息:  大小:22886  MD5:f5064339b35b09d26fab921284820757

[C:\Documents and Settings\Administrator\桌面\Virus\19\avwggmn.dll]
                  …………发现Spy！报告: [4] [6] 注入者[8] HOOK者
文件信息:  大小:22368  MD5:ebf210fb42087c6b4a319fa4b988fae8

[C:\Documents and Settings\Administrator\桌面\Virus\19\rarjepi.dll]
                  …………发现Spy！报告: [4] [6] 注入者[8] HOOK者
文件信息:  大小:22362  MD5:8207ca2eba27284321ff4b2c716387f4

[C:\Documents and Settings\Administrator\桌面\Virus\19\gdmsi32.dll]
                  …………发现Spy！报告: [4] [1] Win32.F/S.ByDwing
文件信息:  大小:15067  MD5:2bd737642b13bac1f5b47991704fe1b0

[C:\Documents and Settings\Administrator\桌面\Virus\19\gdcqi32.dll]
                  …………发现Spy！报告: [4] [1] Win32.F/S.ByDwing
文件信息:  大小:10863  MD5:c6b394faac870efb670946e5d89e7471

文件数:19 病毒数:18  比重:0.9473684210526
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎
[2] 文件特征码引擎
[1] 文件启发式引擎

[ 本帖最后由 FBAV 于 2007-12-2 13:09 编辑 ]

显示全部楼层 · 发表于 2007-12-2 13:08:06

2007-12-2 13:06:12 URL: http://www.kafan.cn/bbs/attachme ... 8//sms2s.exe//UPack 检测到木马程序 'Trojan-PSW.Win32.OnLineGames.ism'
2007-12-2 13:06:12 URL: http://www.kafan.cn/bbs/attachme ... 8//sms2s.exe//UPack 拒绝访问
2007-12-2 13:06:57 URL: http://www.kafan.cn/bbs/attachme ... 8//sms2s.exe//UPack 检测到木马程序 'Trojan-PSW.Win32.OnLineGames.ism'
2007-12-2 13:06:57 URL: http://www.kafan.cn/bbs/attachme ... 8//sms2s.exe//UPack 拒绝访问
2007-12-2 13:07:14 URL: http://www.kafan.cn/bbs/attachme ... 8//sms2s.exe//UPack 检测到木马程序 'Trojan-PSW.Win32.OnLineGames.ism'
2007-12-2 13:07:14 URL: http://www.kafan.cn/bbs/attachme ... 8//sms2s.exe//UPack 拒绝访问

显示全部楼层 · 发表于 2007-12-2 13:25:05

检测到：木马程序 Trojan-PSW.Win32.OnLineGames.ism 文件　: F:\du\样本.rar/sms2s.exe//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.jer 文件　: F:\du\样本.rar/sms3s.exe//PE_Patch//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.jbp 文件　: F:\du\样本.rar/sms4s.exe//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.jgq 文件　: F:\du\样本.rar/sms5s.exe//PE_Patch//UPack
未发现：木马程序 Trojan-PSW.Win32.OnLineGames.iyz 文件　: F:\du\样本.rar/sms6s.exe//UPack//#
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.isb 文件　: F:\du\样本.rar/sms8s.exe
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.jcn 文件　: F:\du\样本.rar/sms9s.exe//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.isb 文件　: F:\du\样本.rar/GenProtect.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.jcn 文件　: F:\du\样本.rar/kvdxjma.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.iyz 文件　: F:\du\样本.rar/sidjezy.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.jbp 文件　: F:\du\样本.rar/avwggmn.dll
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.jgq 文件　: F:\du\样本.rar/gdmsi32.dll//UPack//#
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.jeu 文件　: F:\du\样本.rar/gdcqi32.dll//UPack
检测到：木马程序 Trojan-PSW.Win32.OnLineGames.iys 文件　: F:\du\样本.rar/sms6s.exe//UPack

显示全部楼层 · 发表于 2007-12-2 13:27:59

G:\Users\Administrator\Desktop\样本.rar » RAR » WinSy_8z.Sys - probably a variant of Win32/AutoRun.Q worm - was a part of the deleted object
G:\Users\Administrator\Desktop\样本.rar » RAR » sms0s.exe - probably a variant of Win32/AutoRun.Q worm - was a part of the deleted object
G:\Users\Administrator\Desktop\样本.rar » RAR » sms2s.exe - a variant of Win32/PSW.OnLineGames.NFL trojan - was a part of the deleted object
G:\Users\Administrator\Desktop\样本.rar » RAR » sms4s.exe - a variant of Win32/PSW.OnLineGames.FDY trojan - was a part of the deleted object
G:\Users\Administrator\Desktop\样本.rar » RAR » sms5s.exe - probably a variant of Win32/PSW.OnLineGames.NHF trojan - was a part of the deleted object
G:\Users\Administrator\Desktop\样本.rar » RAR » sms6s.exe - Win32/PSW.OnLineGames.FDY trojan - was a part of the deleted object
G:\Users\Administrator\Desktop\样本.rar » RAR » sms7s.exe - a variant of Win32/PSW.OnLineGames.FDY trojan - was a part of the deleted object
G:\Users\Administrator\Desktop\样本.rar » RAR » sms8s.exe - a variant of Win32/PSW.OnLineGames.NFL trojan - was a part of the deleted object
G:\Users\Administrator\Desktop\样本.rar » RAR » sms9s.exe - a variant of Win32/PSW.OnLineGames.FDY trojan - was a part of the deleted object
G:\Users\Administrator\Desktop\样本.rar » RAR » GenProtect.dll - Win32/PSW.OnLineGames.HCV trojan - was a part of the deleted object
G:\Users\Administrator\Desktop\样本.rar » RAR » upxdnd.dll - probably a variant of Win32/PSW.OnLineGames.HCV trojan - was a part of the deleted object
G:\Users\Administrator\Desktop\样本.rar » RAR » kvdxjma.dll - a variant of Win32/PSW.OnLineGames.FDY trojan - was a part of the deleted object
G:\Users\Administrator\Desktop\样本.rar » RAR » sidjezy.dll - Win32/PSW.OnLineGames.FDY trojan - was a part of the deleted object
G:\Users\Administrator\Desktop\样本.rar » RAR » avwggmn.dll - a variant of Win32/PSW.OnLineGames.FDY trojan - was a part of the deleted object
G:\Users\Administrator\Desktop\样本.rar » RAR » rarjepi.dll - a variant of Win32/PSW.OnLineGames.FDY trojan - was a part of the deleted object
G:\Users\Administrator\Desktop\样本.rar » RAR » gdmsi32.dll - probably a variant of Win32/PSW.OnLineGames.NHF trojan - was a part of the deleted object
G:\Users\Administrator\Desktop\样本.rar - multiple threats - deleted - quarantined

显示全部楼层 · 发表于 2007-12-2 13:32:08

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本'
C:\Documents and Settings\Administrator\桌面\样本\
  WinSy_8z.Sys
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was moved to '47c043fa.qua'!
  sms0s.exe
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
   [INFO]    The file was moved to '47c54403.qua'!
  sms2s.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.iqw
   [INFO]    The file was moved to '4667362c.qua'!
  sms3s.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was moved to '47c54404.qua'!
  sms4s.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was moved to '4667362d.qua'!
  sms5s.exe
   [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
   [INFO]    The file was moved to '47c54406.qua'!
  sms6s.exe
   [DETECTION] Is the Trojan horse TR/FWDisable.22884
   [INFO]    The file was moved to '4667362f.qua'!
  sms7s.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was moved to '47c54405.qua'!
  sms8s.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [INFO]    The file was moved to '4667362e.qua'!
  sms9s.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jcn
   [INFO]    The file was moved to '47c54407.qua'!
  Sy_Win7z.jmp
  GenProtect.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.iqw
   [INFO]    The file was moved to '47c043fd.qua'!
  upxdnd.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [INFO]    The file was moved to '47ca4408.qua'!
  kvdxjma.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jcn
   [INFO]    The file was moved to '47b6440e.qua'!
  sidjezy.dll
   [DETECTION] Is the Trojan horse TR/FWDisable.22884
   [INFO]    The file was moved to '47b64401.qua'!
  avwggmn.dll
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was moved to '47c9440e.qua'!
  rarjepi.dll
   [DETECTION] Contains suspicious code HEUR/Malware
   [INFO]    The file was moved to '47c443f9.qua'!
  gdmsi32.dll
   [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
   [INFO]    The file was moved to '47bf43fc.qua'!
  gdcqi32.dll

显示全部楼层 · 发表于 2007-12-2 14:03:15

AVG10个

显示全部楼层 · 发表于 2007-12-2 14:06:14

Start of the scan: Sunday, 2 December, 2007  14:05

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\樣本'
C:\Documents and Settings\tim\桌面\樣本\欴掛.rar
  [0] Archive type: RAR
  --> WinSy_8z.Sys
   [DETECTION] Contains suspicious code HEUR/Malware
  --> sms0s.exe
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
  --> sms2s.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.iqw
  --> sms3s.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> sms4s.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> sms5s.exe
   [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
  --> sms6s.exe
   [DETECTION] Is the Trojan horse TR/FWDisable.22884
  --> sms7s.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> sms8s.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> sms9s.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jcn
  --> GenProtect.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.iqw
  --> upxdnd.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> kvdxjma.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jcn
  --> sidjezy.dll
   [DETECTION] Is the Trojan horse TR/FWDisable.22884
  --> avwggmn.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> rarjepi.dll
   [DETECTION] Contains suspicious code HEUR/Malware
  --> gdmsi32.dll
   [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
   [INFO]    A backup was created as '4780aedf.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

End of the scan: Sunday, 2 December, 2007  14:05
Used time: 00:03 min

The scan has been done completely.

   1 Scanning directories
   21 Files were scanned
   13 viruses and/or unwanted programs were found
   4 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   8 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-12-2 14:38:03

F:\virus\样本.rar » RAR » WinSy_8z.Sys - probably a variant of Win32/AutoRun.Q worm
F:\virus\样本.rar » RAR » sms0s.exe - probably a variant of Win32/AutoRun.Q worm
F:\virus\样本.rar » RAR » sms2s.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
F:\virus\样本.rar » RAR » sms4s.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
F:\virus\样本.rar » RAR » sms5s.exe - probably a variant of Win32/PSW.OnLineGames.NHF trojan
F:\virus\样本.rar » RAR » sms6s.exe - Win32/PSW.OnLineGames.FDY trojan
F:\virus\样本.rar » RAR » sms7s.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
F:\virus\样本.rar » RAR » sms8s.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
F:\virus\样本.rar » RAR » sms9s.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
F:\virus\样本.rar » RAR » GenProtect.dll - Win32/PSW.OnLineGames.HCV trojan
F:\virus\样本.rar » RAR » upxdnd.dll - probably a variant of Win32/PSW.OnLineGames.HCV trojan
F:\virus\样本.rar » RAR » kvdxjma.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
F:\virus\样本.rar » RAR » sidjezy.dll - Win32/PSW.OnLineGames.FDY trojan
F:\virus\样本.rar » RAR » avwggmn.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
F:\virus\样本.rar » RAR » rarjepi.dll - a variant of Win32/PSW.OnLineGames.FDY trojan
F:\virus\样本.rar » RAR » gdmsi32.dll - probably a variant of Win32/PSW.OnLineGames.NHF trojan

显示全部楼层 · 发表于 2007-12-2 14:52:20

清除病毒种类列表：
病毒： Trojan.PSW.Win32.GameOnline.aqa
病毒： Trojan.PSW.Win32.ZhuXian.ek
病毒： Trojan.PSW.Win32.GameOnline.ato
病毒： Trojan.PSW.Win32.GameOnline.ars
病毒： Trojan.PSW.Win32.GameOnline.aul
病毒： Trojan.PSW.Win32.GameOnline.apo
病毒： Trojan.PSW.Win32.XYOnline.uq
病毒： Trojan.PSW.Win32.GameOnline.ars
病毒： Trojan.PSW.Win32.GameOnline.atp
病毒： Trojan.PSW.Win32.LMir.yxs

用户来源：互联网

软件版本：20.20.60

[病毒样本] 下载者下的19个

本帖子中包含更多资源

16