S168及产物更新

promised

全灭
C:\ABC\样本.rar
C:\ABC\样本.rar\OnlO0r.bak
C:\ABC\样本.rar\OnlO0r.bak\FILE:0000
>>> Virus 'Mal/PWS-K' found in file C:\ABC\样本.rar\OnlO0r.bak\FILE:0000
C:\ABC\样本.rar\2.exe
C:\ABC\样本.rar\2.exe\FILE:0000
>>> File "C:\ABC\样本.rar\2.exe\FILE:0000" has been identified as suspicious 'Sus/Malware-B'.
>>> File "C:\ABC\样本.rar\2.exe" has been identified as suspicious 'Sus/Malware-B'.
C:\ABC\样本.rar\3.exe
C:\ABC\样本.rar\3.exe\FILE:0000
>>> File "C:\ABC\样本.rar\3.exe\FILE:0000" has been identified as suspicious 'Sus/Malware-B'.
C:\ABC\样本.rar\3.exe\FILE:0001
>>> File "C:\ABC\样本.rar\3.exe\FILE:0001" has been identified as suspicious 'Sus/Malware-B'.
>>> Virus 'Mal/Behav-156' found in file C:\ABC\样本.rar\3.exe
C:\ABC\样本.rar\4.exe
C:\ABC\样本.rar\4.exe\FILE:0000
>>> Virus 'Mal/Packer' found in file C:\ABC\样本.rar\4.exe
C:\ABC\样本.rar\1.exe
C:\ABC\样本.rar\1.exe\FILE:0000
>>> Virus 'Mal/Gampass-A' found in file C:\ABC\样本.rar\1.exe\FILE:0000
C:\ABC\样本.rar\1.exe\FILE:0001
>>> Virus 'Mal/Gampass-A' found in file C:\ABC\样本.rar\1.exe\FILE:0001
>>> Virus 'Mal/Behav-156' found in file C:\ABC\样本.rar\1.exe
C:\ABC\样本.rar\mndoor0.dll
>>> Virus 'Mal/Gampass-A' found in file C:\ABC\样本.rar\mndoor0.dll
C:\ABC\样本.rar\qhdoor0.dll
>>> File "C:\ABC\样本.rar\qhdoor0.dll" has been identified as suspicious 'Sus/Malware-B'.
C:\ABC\样本.rar\qqdoor0.dll
>>> File "C:\ABC\样本.rar\qqdoor0.dll" has been identified as suspicious 'Sus/Malware-B'.

无尽藏海

Begin scan in 'D:\Downloads\样本\样本(7).rar'
D:\Downloads\样本\样本(7).rar
  [0] Archive type: RAR
  --> OnlO0r.bak
      [DETECTION] Is the Trojan horse TR/Autorun.BK
  --> 2.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 3.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 4.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> 1.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> mndoor0.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> qhdoor0.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> qqdoor0.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!

上报~

无尽藏海

D:\Downloads\样本\样本(7).rar » RAR » OnlO0r.bak - probably a variant of Win32/PSW.OnLineGames.NBR trojan
D:\Downloads\样本\样本(7).rar » RAR » 2.exe - a variant of Win32/PSW.OnLineGames.NFN trojan
D:\Downloads\样本\样本(7).rar » RAR » 3.exe - a variant of Win32/PSW.OnLineGames.NFN trojan
D:\Downloads\样本\样本(7).rar » RAR » 4.exe - probably unknown NewHeur_PE virus
D:\Downloads\样本\样本(7).rar » RAR » 1.exe - a variant of Win32/PSW.OnLineGames.NFN trojan
D:\Downloads\样本\样本(7).rar » RAR » mndoor0.dll - probably a variant of Win32/Genetik trojan
D:\Downloads\样本\样本(7).rar » RAR » qhdoor0.dll - probably a variant of Win32/PSW.OnLineGames.NFO trojan
D:\Downloads\样本\样本(7).rar » RAR » qqdoor0.dll - probably a variant of Win32/PSW.OnLineGames.NFO trojan

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GameOL.dp

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.25.42

wangjay1980

detected: Trojan program Trojan-PSW.Win32.Delf.ajr        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/OnlO0r.bak//PE_Patch.UPX//UPX
detected: virus Heur.Trojan.Generic        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/2.exe
detected: virus Heur.Trojan.Generic        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/3.exe
detected: Trojan program Trojan-Downloader.Win32.Agent.gxp        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/4.exe//NSPack//#
detected: Trojan program Trojan-PSW.Win32.OnLineGames.mlm        File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾1.rar/qqdoor0.dll

zwl2828

8个

C:\Users\Wesley\Downloads\样本.rar » RAR » OnlO0r.bak - probably a variant of Win32/PSW.OnLineGames.NBR trojan
C:\Users\Wesley\Downloads\样本.rar » RAR » 2.exe - a variant of Win32/PSW.OnLineGames.NFN trojan
C:\Users\Wesley\Downloads\样本.rar » RAR » 3.exe - a variant of Win32/PSW.OnLineGames.NFN trojan
C:\Users\Wesley\Downloads\样本.rar » RAR » 4.exe - probably unknown NewHeur_PE virus
C:\Users\Wesley\Downloads\样本.rar » RAR » 1.exe - a variant of Win32/PSW.OnLineGames.NFN trojan
C:\Users\Wesley\Downloads\样本.rar » RAR » mndoor0.dll - probably a variant of Win32/Genetik trojan
C:\Users\Wesley\Downloads\样本.rar » RAR » qhdoor0.dll - probably a variant of Win32/PSW.OnLineGames.NFO trojan
C:\Users\Wesley\Downloads\样本.rar » RAR » qqdoor0.dll - probably a variant of Win32/PSW.OnLineGames.NFO trojan

Palkia

C:\Documents and Settings\Administrator\桌面\样本.rar>>OnlO0r.bak        TrojanPSW.Delf.ajr.pbdi        木马        还未处理
C:\Documents and Settings\Administrator\桌面\样本.rar>>2.exe        PWSteal.Lemir.gen.h.rppq        木马        还未处理
C:\Documents and Settings\Administrator\桌面\样本.rar>>3.exe        PWSteal.Lemir.gen.h.sfhg        木马        还未处理
C:\Documents and Settings\Administrator\桌面\样本.rar>>4.exe        Trojan.Yutcfa.pcui        木马        还未处理
C:\Documents and Settings\Administrator\桌面\样本.rar>>1.exe        PWSteal.Lemir.gen.h.xbvq        木马        还未处理
C:\Documents and Settings\Administrator\桌面\样本.rar>>qhdoor0.dll        PWSteal.Lemir.dll.zbow.dll        木马        还未处理
C:\Documents and Settings\Administrator\桌面\样本.rar>>qqdoor0.dll        PWSteal.Lemir.dll.cekd.dll        木马        还未处理

wangjay1980

Hello,

1.exe_, mndoor0.dll - Trojan-PSW.Win32.OnLineGames.myx,
2.exe_, qhdoor0.dll - Trojan-PSW.Win32.QQGame.av,
3.exe_ - Trojan-PSW.Win32.QQPass.aqq,
4.exe_ - Trojan-Downloader.Win32.Agent.hao,
00002.exe_, NVDispDrv.dll - Trojan-PSW.Win32.OnLineGames.myu,
00020.exe_, MsPrint32D.dll - Trojan-PSW.Win32.OnLineGames.myv,
jz.exe_ - Trojan-PSW.Win32.OnLineGames.myw,
spoolsv.exe_ - Trojan.Win32.Agent.dss

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.



[ 本帖最后由 wangjay1980 于 2008-1-4 22:06 编辑 ]

IllusionWing

100%

leonfg

ESET 全灭