某帖挖的55个

The EQs

以后就用FTP上报给eset了。。。而且eset最近将会继续更新我发给它们的威胁。。。

398566384

kis8 51个

wangjay1980

希望你心爱的杀软可以降低对你的入库要求，造福广大中国的NOD粉丝

leonfg

EQ老大 你的论坛我怎么总是打不开......

wangjay1980

Hello,

a1.exe_ - Trojan.Win32.Pakes.bwv,
a15.exe_, kaqhmzy.dll - Trojan-PSW.Win32.OnLineGames.myz,
a25.exe_ - Trojan-PSW.Win32.OnLineGames.myw,
a26.exe_, SHAProc.dll - Trojan-PSW.Win32.OnLineGames.mza,
a28.exe_, jsqxbyc.dll - Trojan-PSW.Win32.OnLineGames.mzb,
a6.exe_, Wn_Sys8x.Sys - Trojan-PSW.Win32.QQPass.aqr,
a9.exe_, NVDispDrv.dll - Trojan-PSW.Win32.OnLineGames.myu,
down.exe_ - Worm.Win32.AutoRun.blz

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Yury Nesmachny
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: 13.rar

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\��.rar'
C:\Documents and Settings\Administrator\桌面\��.rar
  [0] Archive type: RAR
  --> Wn_Sys8x.Sys
      [DETECTION] Contains suspicious code HEUR/Malware
  --> down.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> a2.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.lgk
  --> a3.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
  --> a4.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> a5.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.muy.1
  --> a6.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> a7.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
  --> a1.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> a10.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jyq
  --> a11.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.C
  --> a12.exe
      [DETECTION] Is the Trojan horse TR/FWDisable.23483
  --> a13.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> a14.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
  --> a15.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
  --> a16.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> a17.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.lwe.1
  --> a18.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mjr.1
  --> a19.exe
      [DETECTION] Is the Trojan horse TR/PSW.Nilage.bwm
  --> a20.exe
      [DETECTION] Is the Trojan horse TR/Proxy.Delf.CA
  --> a21.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> a22.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ltm.1
  --> a23.exe
      [DETECTION] Is the Trojan horse TR/PSW.Wow.ahx
  --> a24.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mll
  --> a25.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.F
  --> a26.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> a27.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.18381 Backdoor server programs
  --> a28.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
  --> a8.exe
      [DETECTION] Is the Trojan horse TR/PSW.Nilage.bwn
  --> a9.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> pcihdd.sys
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
  --> scvhost.exe
      [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
  --> AVPSrv.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mjr.1
  --> avwghmn.dll
      [DETECTION] Is the Trojan horse TR/WuDisable.B
  --> avwlimn.dll
      [DETECTION] Is the Trojan horse TR/FWDisable.527440
  --> bgntfkpwow.dll
      [DETECTION] Is the Trojan horse TR/PSW.Nilage.bwn
  --> cmdbcs.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jyq
  --> kpwdpvazx.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.ahx
  --> kqwdntydj.dll
      [DETECTION] Is the Trojan horse TR/PSW.Nilage.bwm
  --> kvdxslma.dll
      [DETECTION] Is the Trojan horse TR/FWDisable.23483
  --> Kvsc3.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ltm.1
  --> LotusHlp.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mll
  --> LYLOADER.EXE
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
  --> LYMANGR.DLL
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
  --> MSDEG32.DLL
      [DETECTION] Is the Trojan horse TR/PSW.Online.gyo.2
  --> MsIMMs32.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> MsPrint32D.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.lwe.1
  --> NVDispDrv.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> puahsxdzx.dll
      [DETECTION] Is the Trojan horse TR/PSW.Wow.ahx
  --> rsjzapm.dll
      [DETECTION] Is the Trojan horse TR/WuDisable.F
  --> SHAProc.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> SSLDyn.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.lgk
  --> upxdnd.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.muy.1
  --> jsqxbyc.dll
      [DETECTION] Is the Trojan horse TR/WuDisable.B
  --> kaqhmzy.dll
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      The file was deleted!


End of the scan: 星期五 2008年1月4日  23:56
Used time: 00:10 min

The scan has been done completely.

      0 Scanning directories
     56 Files were scanned
     50 viruses and/or unwanted programs were found
      5 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      6 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\��.rar'
C:\Documents and Settings\Administrator\My Documents\
  ��.rar
    [0] Archive type: RAR
    --> Wn_Sys8x.Sys
        [DETECTION] Is the Trojan horse TR/PSW.Steal.48246
        [WARNING]   Infected files in archives cannot be repaired!
    --> down.exe
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
      --> a2.exe
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnLineGa.lgk
            [WARNING]   Infected files in archives cannot be repaired!
      --> a3.exe
        [1] Archive type: RSRC
        --> Object
        --> Object
    --> a4.exe
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
      --> a5.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.muy.1
              [WARNING]   Infected files in archives cannot be repaired!
      --> a6.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.Steal.48246
              [WARNING]   Infected files in archives cannot be repaired!
      --> a7.exe
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
            [WARNING]   Infected files in archives cannot be repaired!
      --> a1.exe
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Contains suspicious code HEUR/Crypted
            [WARNING]   Infected files in archives cannot be repaired!
      --> a10.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jyq
              [WARNING]   Infected files in archives cannot be repaired!
      --> a11.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/WuDisable.C
              [WARNING]   Infected files in archives cannot be repaired!
      --> a12.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/FWDisable.23483
              [WARNING]   Infected files in archives cannot be repaired!
      --> a13.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
              [WARNING]   Infected files in archives cannot be repaired!
      --> a14.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/WuDisable.B
              [WARNING]   Infected files in archives cannot be repaired!
      --> a15.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/WuDisable.B
              [WARNING]   Infected files in archives cannot be repaired!
      --> a16.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mwi.1
              [WARNING]   Infected files in archives cannot be repaired!
      --> a17.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.lwe.1
              [WARNING]   Infected files in archives cannot be repaired!
      --> a18.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mjr.1
              [WARNING]   Infected files in archives cannot be repaired!
      --> a19.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.Nilage.bwm
              [WARNING]   Infected files in archives cannot be repaired!
    --> a20.exe
        [DETECTION] Is the Trojan horse TR/Proxy.Delf.CA
        [WARNING]   Infected files in archives cannot be repaired!
      --> a21.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/Spy.Gen
              [WARNING]   Infected files in archives cannot be repaired!
      --> a22.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ltm.1
              [WARNING]   Infected files in archives cannot be repaired!
      --> a23.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.Wow.ahx
              [WARNING]   Infected files in archives cannot be repaired!
      --> a24.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mll
              [WARNING]   Infected files in archives cannot be repaired!
      --> a25.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/WuDisable.F
              [WARNING]   Infected files in archives cannot be repaired!
      --> a26.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Contains suspicious code HEUR/Malware
              [WARNING]   Infected files in archives cannot be repaired!
    --> a27.exe
        [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.18381 Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
      --> a28.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/WuDisable.B
              [WARNING]   Infected files in archives cannot be repaired!
      --> a8.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.Nilage.bwn
              [WARNING]   Infected files in archives cannot be repaired!
      --> a9.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Contains suspicious code HEUR/Malware
              [WARNING]   Infected files in archives cannot be repaired!
    --> pcihdd.sys
        [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
        [WARNING]   Infected files in archives cannot be repaired!
    --> scvhost.exe
        [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> AVPSrv.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mjr.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> avwghmn.dll
        [DETECTION] Is the Trojan horse TR/WuDisable.B
        [WARNING]   Infected files in archives cannot be repaired!
    --> avwlimn.dll
        [DETECTION] Is the Trojan horse TR/FWDisable.527440
        [WARNING]   Infected files in archives cannot be repaired!
    --> bgntfkpwow.dll
        [DETECTION] Is the Trojan horse TR/PSW.Nilage.bwn
        [WARNING]   Infected files in archives cannot be repaired!
    --> cmdbcs.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.jyq
        [WARNING]   Infected files in archives cannot be repaired!
    --> kpwdpvazx.dll
        [DETECTION] Is the Trojan horse TR/PSW.Wow.ahx
        [WARNING]   Infected files in archives cannot be repaired!
    --> kqwdntydj.dll
        [DETECTION] Is the Trojan horse TR/PSW.Nilage.bwm
        [WARNING]   Infected files in archives cannot be repaired!
    --> kvdxslma.dll
        [DETECTION] Is the Trojan horse TR/FWDisable.23483
        [WARNING]   Infected files in archives cannot be repaired!
    --> Kvsc3.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ltm.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> LotusHlp.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mll
        [WARNING]   Infected files in archives cannot be repaired!
      --> LYLOADER.EXE
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
          --> Object
      --> LYMANGR.DLL
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
            [WARNING]   Infected files in archives cannot be repaired!
      --> MSDEG32.DLL
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.Online.gyo.2
            [WARNING]   Infected files in archives cannot be repaired!
    --> MsIMMs32.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mwi.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> MsPrint32D.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.lwe.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> NVDispDrv.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> puahsxdzx.dll
        [DETECTION] Is the Trojan horse TR/PSW.Wow.ahx
        [WARNING]   Infected files in archives cannot be repaired!
    --> rsjzapm.dll
        [DETECTION] Is the Trojan horse TR/WuDisable.F
        [WARNING]   Infected files in archives cannot be repaired!
    --> SHAProc.dll
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> SSLDyn.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.lgk
        [WARNING]   Infected files in archives cannot be repaired!
    --> upxdnd.dll
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.muy.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> jsqxbyc.dll
        [DETECTION] Is the Trojan horse TR/WuDisable.B
        [WARNING]   Infected files in archives cannot be repaired!
    --> kaqhmzy.dll
        [DETECTION] Is the Trojan horse TR/WuDisable.B
        [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!


End of the scan: 2008年1月4日  09:05
Used time: 00:07 min

The scan has been done completely.

      0 Scanning directories
     56 Files were scanned
     49 viruses and/or unwanted programs were found
      6 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      7 Files not concerned
     25 Archives were scanned
     53 Warnings
      0 Notes

绅博周幸

扫描报告
2008年1月4日 9:09:41 - 9:09:44
计算机名称: XING-PC
扫描类型: 扫描指定目标
目标: C:\Users\Xing\Desktop\Downloads\样本.rar


--------------------------------------------------------------------------------

结果: 发现42个恶意软件
Trojan-PSW.Win32.OnLineGames.lgp (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a2.exe
Trojan-PSW.Win32.OnLineGames.mtj (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a3.exe
C:\Users\Xing\Desktop\Downloads\样本.rar\LYMANGR.DLL
Trojan-Downloader.Win32.Delf.aas (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a4.exe
Trojan-PSW.Win32.OnLineGames.mux (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a5.exe
Trojan-Downloader.Win32.Agent.blm (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a7.exe
C:\Users\Xing\Desktop\Downloads\样本.rar\pcihdd.sys
Trojan-PSW.Win32.OnLineGames.isb (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a10.exe
Trojan-PSW.Win32.OnLineGames.mqz (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a11.exe
Trojan-PSW.Win32.OnLineGames.ltt (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a12.exe
Trojan-PSW.Win32.Lmir.boy (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a13.exe
Trojan-PSW.Win32.OnLineGames.mhs (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a14.exe
C:\Users\Xing\Desktop\Downloads\样本.rar\avwghmn.dll
Trojan-PSW.Win32.OnLineGames.mwj (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a16.exe
Trojan-PSW.Win32.OnLineGames.lue (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a17.exe
Trojan-PSW.Win32.OnLineGames.mlu (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a18.exe
Trojan-PSW.Win32.OnLineGames.msf (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a19.exe
Backdoor.Win32.Delf.csn (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a20.exe
Trojan-PSW.Win32.OnLineGames.myj (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a21.exe
Trojan-PSW.Win32.OnLineGames.ltm (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a22.exe
Trojan-PSW.Win32.OnLineGames.mnv (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a23.exe
Trojan-PSW.Win32.OnLineGames.mmu (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a24.exe
Backdoor.Win32.Ceckno.ic (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a27.exe
Trojan-PSW.Win32.Nilage.bwn (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\a8.exe
C:\Users\Xing\Desktop\Downloads\样本.rar\bgntfkpwow.dll
Backdoor.Win32.Delf.awy (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\scvhost.exe
Trojan-PSW.Win32.OnLineGames.mjr (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\AVPSrv.dll
Trojan-PSW.Win32.OnLineGames.mua (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\avwlimn.dll
Trojan-PSW.Win32.OnLineGames.jyq (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\cmdbcs.dll
Trojan-PSW.Win32.WOW.ahx (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\kpwdpvazx.dll
C:\Users\Xing\Desktop\Downloads\样本.rar\puahsxdzx.dll
Trojan-PSW.Win32.Nilage.bwm (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\kqwdntydj.dll
Trojan-PSW.Win32.OnLineGames.lqs (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\kvdxslma.dll
Trojan-PSW.Win32.OnLineGames.mld (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\Kvsc3.dll
Trojan-PSW.Win32.OnLineGames.mll (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\LotusHlp.dll
Trojan-PSW.Win32.OnLineGames.msm (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\LYLOADER.EXE
C:\Users\Xing\Desktop\Downloads\样本.rar\MSDEG32.DLL
Trojan-PSW.Win32.OnLineGames.mwi (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\MsIMMs32.dll
Trojan-PSW.Win32.OnLineGames.lwe (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\MsPrint32D.dll
Trojan-PSW.Win32.OnLineGames.mvb (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\rsjzapm.dll
Trojan-PSW.Win32.OnLineGames.lgk (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\SSLDyn.dll
Trojan-PSW.Win32.OnLineGames.muy (病毒)
C:\Users\Xing\Desktop\Downloads\样本.rar\upxdnd.dll




--------------------------------------------------------------------------------

统计信息
已扫描:
文件: 57
未扫描: 0
结果:
病毒: 42
间谍软件: 0
可疑对象: 0
危险软件: 0
操作:
已杀毒: 0
已重命名: 0
删除: 0
已隔离: 0
失败: 0
引导区:
已扫描: 0
受感染: 0
可疑对象: 0
已杀毒: 0


--------------------------------------------------------------------------------

选项
病毒定义版本:
病毒: 2008-01-04_05
间谍软件: 2008-01-04_04
扫描引擎:
F-Secure AVP: 7.00.171, 2008-01-04
F-Secure Libra: 2.04.01, 2008-01-04
F-Secure Orion: 1.02.37, 2008-01-04
F-Secure Draco: 1.00.35, 2007-11-28
扫描选项:
扫描指定类型的文件: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ANI AVB BAT CEO CMD LSP MAP MHT MIF PHP POT WMF NWS TAR TGZ SWF ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQX
扫描压缩包内部
操作:
病毒: 扫描后询问
间谍软件: 扫描后询问

--------------------------------------------------------------------------------

版权 © 1998-2007 产品支持 | 发送病毒样本到 F-Secure
对于 F-Secure 网页上所链接的由第三方创建和发布的材料， F-Secure 不承担任何责任。 除非已通过电子邮件或 F-Secure CGI 电子邮件向任一台服务器提交材料以清楚说明情况， 您同意 通过 F-Secure 网页或硬拷贝发布已有的材料。 单击带下划线的链接，可访问 F-Secure 公共网站。此时， 系统会在专用访问统计信息中用域名记录您的访问。 此信息不会提供给任何第三方。 您同意不针对所提交的材料向我们提出诉讼。 除非您已明确说明，否则应提交材料以保证 F-Secure 针对可能在 F-Secure 产品/出版物中采用的概念， 不承担任何责任。

mimimi

咖啡8.5扫出51个

FBAV

MicroVita AntiSpyware 100 C
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……


正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\Wn_Sys8x.Sys]
                    …………发现Spy！报告: [4] [8] HOOK者
文件信息:  大小:48280  MD5:b0944c0ca8e5e6a30cc86d26ea523b40


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a2.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:18488  MD5:e05023d0fba651494a2ec7e76d8efe70


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a5.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:16709  MD5:8651eee744c02d3be233fa37abbcbd44


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a7.exe]
                    …………发现Spy！报告:[2]
文件信息:  大小:49152  MD5:f0f748488c3e079ac4288f738ff1aafc


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a1.exe]
                    …………发现Spy！报告:[1] Win32.NkHack.FSG.A
文件信息:  大小:42057  MD5:7493d02c6f2082a037f287882322ea58


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a10.exe]
                    …………发现Spy！报告:[1] Win32.Unknow
文件信息:  大小:17292  MD5:20a9e467dc8c4231d2c691c80f4cd3d3


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a11.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:16498  MD5:44e09bef5b2cefa495bf7838d72d1835


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a12.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:15487  MD5:d77b58cf5efcb8e25c41729825e95b12


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a13.exe]
                    …………发现Spy！报告:[1] Win32.Unknow
文件信息:  大小:29537  MD5:c84708c1fb8a0ffd2ef224e85926a64a


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a14.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:16514  MD5:1f0cf45a2e551250b326da845237f722


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a15.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:15578  MD5:b6dba3d05413e7459f6a3f7452136f6e


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a16.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:17890  MD5:a0073d46740cc4f68265dfc21a27d228


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a17.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:16223  MD5:bc5eafa9bca51a843e8e69ce404966c9


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a18.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:17452  MD5:c9038876711d45356da2020cb0c3321c


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a19.exe]
                    …………发现Spy！报告:[2] [1] Win32.NkHack.FSG.A
文件信息:  大小:31721  MD5:7522a479a95901f1878e0bc91b959e2d


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a20.exe]
                    …………发现Spy！报告:[2] [1] Win32.NkHack.FSG.A
文件信息:  大小:177425  MD5:e82dfa9913ef19f6a07539e5cbe33051


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a21.exe]
                    …………发现Spy！报告:[2]
文件信息:  大小:52529  MD5:6c8d5a014d1f11fe3677fba992e37e7f


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a22.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:17968  MD5:1c6185bbc094e0c2fb6f9c8a10fd0966


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a23.exe]
                    …………发现Spy！报告:[1] Win32.NkHack.FSG.A
文件信息:  大小:31273  MD5:bd47a4c420c86e64ec9aaf2871fc1ee7


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a24.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:16241  MD5:9fd2bec8eff1578de2cc11460d4339d1


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a25.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:16128  MD5:7edbfe568096bb8010946689855e6d9c


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a26.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:17116  MD5:9411ca1be78655e636974caa6e563084


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a27.exe]
                    …………发现Spy！报告:[1] Win32.NkHack.FSG.A
文件信息:  大小:18373  MD5:3a99cd279fe5f842941d37f4e9061f6c


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a28.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:15468  MD5:fbcabd9d350be8a1d11e5ea2c6ce687b


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a8.exe]
                    …………发现Spy！报告:[1] Win32.NkHack.FSG.A
文件信息:  大小:31973  MD5:4697350f36323a4d2b1f79f32ddb405e


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\a9.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:17463  MD5:9137f249da98de2445a6f1cf0022a856


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\scvhost.exe]
                    …………发现Spy！报告:[1] Win32.NkHack.FSG.A
文件信息:  大小:11081  MD5:059725b53772a916f11e27517edb6bf0


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\AVPSrv.dll]
                    …………发现Spy！报告:[1] Win32.Badsoft.RX[8] HOOK者
文件信息:  大小:28672  MD5:b75d24760a1b0987a20b93ef062f1aac


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\avwghmn.dll]
                    …………发现Spy！报告: [4] [6] 注入者[8] HOOK者
文件信息:  大小:24531  MD5:5408d26b796a4aac3b12018869701181


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\bgntfkpwow.dll]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:20494  MD5:70ec2de4556de80341757d95723fedf9


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\cmdbcs.dll]
                    …………发现Spy！报告:[1] Win32.Badsoft.RX[8] HOOK者
文件信息:  大小:27648  MD5:65a798c64a82fefd6073fd9f1ece7e34


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\kpwdpvazx.dll]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:19945  MD5:27a799d13be7ccbe5687c15cc5927b7a


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\kqwdntydj.dll]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:20361  MD5:6bdf603c40424e88660b6cee28a3fc2e


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\kvdxslma.dll]
                    …………发现Spy！报告:[6] 注入者[8] HOOK者
文件信息:  大小:23483  MD5:4418a01f2f4c8f9fe3cc958f396a6f72


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\Kvsc3.dll]
                    …………发现Spy！报告:[1] Win32.Badsoft.RX[8] HOOK者
文件信息:  大小:29696  MD5:51dfc7c03c46ddb36fa4ce10cf7ae27f


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\LotusHlp.dll]
                    …………发现Spy！报告:[1] Win32.Badsoft.RX[8] HOOK者
文件信息:  大小:26624  MD5:bd92f632c873e9af18c8c999b9bcc0f8


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\LYLOADER.EXE]
                    …………发现Spy！报告:[1] Win32.Unknow
文件信息:  大小:11772  MD5:d2fb759e879ff1d5b050c9d819860a31


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\LYMANGR.DLL]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:3398  MD5:b905fcd12f1197bbe05081d291db15db


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\MSDEG32.DLL]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:5959  MD5:f004de13a2085c17deab03af79f4efa5


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\MsIMMs32.dll]
                    …………发现Spy！报告:[1] Win32.Badsoft.RX[8] HOOK者
文件信息:  大小:29184  MD5:f6d683684076caf79efd0874578e0fb6


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\MsPrint32D.dll]
                    …………发现Spy！报告:[1] Win32.Badsoft.RX[8] HOOK者
文件信息:  大小:26112  MD5:31f2c2c0eb7796521b71962eb6d2dd6f


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\NVDispDrv.dll]
                    …………发现Spy！报告:[1] Win32.Badsoft.RX[8] HOOK者
文件信息:  大小:28160  MD5:000ab81894d4524d3e330e95d66c2ed1


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\puahsxdzx.dll]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:19945  MD5:990f89a276ccd3826b6ffb26ba196c77


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\rsjzapm.dll]
                    …………发现Spy！报告: [4]
文件信息:  大小:526430  MD5:f06aa4882a6761bc21c5a7e8cf2894da


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\SHAProc.dll]
                    …………发现Spy！报告:[1] Win32.Badsoft.RX[8] HOOK者
文件信息:  大小:28160  MD5:f043b2e8badc14caaf18a726f43f327d


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\upxdnd.dll]
                    …………发现Spy！报告:[1] Win32.Badsoft.RX[8] HOOK者
文件信息:  大小:27648  MD5:3124f7a2d91edc8cfb6b00f468085e03


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\jsqxbyc.dll]
                    …………发现Spy！报告: [4]
文件信息:  大小:2120185  MD5:56391e6e143420763e07c75ed9e2e131


[C:\Documents and Settings\Administrator\桌面\Virus\wwqwq\kaqhmzy.dll]
                    …………发现Spy！报告: [4]
文件信息:  大小:2120544  MD5:96a69d603466684d82ecd143dee7cf08


文件数:56   病毒数:48  比重:0.8571428571429
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎   
[2] 文件特征码引擎
[1] 文件启发式引擎