18

sam.to

Scanned file:   wnp.rar  - Infected
wnp.rar/Program.rar/21.exe - infected by Trojan-PSW.Win32.OnLineGames.mwe
wnp.rar/Program.rar/22.exe - infected by Trojan-PSW.Win32.OnLineGames.mzj
wnp.rar/Program.rar/arpqc.exe - infected by Backdoor.Win32.Delf.awy
wnp.rar/Program.rar/explorer.exe - infected by Trojan-Downloader.Win32.Agent.blm
wnp.rar/Program.rar/1.exe - OK
wnp.rar/Program.rar/1.exe - OK
wnp.rar/Program.rar/3.exe - infected by Trojan-PSW.Win32.OnLineGames.mes
wnp.rar/Program.rar/4.exe - infected by Trojan-PSW.Win32.OnLineGames.mzs
wnp.rar/Program.rar/5.exe - infected by Trojan-PSW.Win32.OnLineGames.mwj
wnp.rar/Program.rar/6.exe - OK
wnp.rar/Program.rar/6.exe - OK
wnp.rar/Program.rar/7.exe - infected by Trojan-PSW.Win32.OnLineGames.myu
wnp.rar/Program.rar/8.exe - infected by Trojan-PSW.Win32.OnLineGames.mvx
wnp.rar/Program.rar/9.exe - infected by Trojan-PSW.Win32.OnLineGames.mvz
wnp.rar/Program.rar/11.exe - infected by Trojan-PSW.Win32.OnLineGames.mup
wnp.rar/Program.rar/12.exe - infected by Trojan-PSW.Win32.QQPass.aqr
wnp.rar/Program.rar/18.exe - infected by Trojan-PSW.Win32.OnLineGames.mza
wnp.rar/Program.rar/19.exe - infected by Trojan-PSW.Win32.OnLineGames.mzi
wnp.rar/Program.rar/20.exe - infected by Trojan-PSW.Win32.WOW.aif
wnp.rar/Wn_Sys8x.rar/Wn_Sys8x.Sys - infected by Trojan-PSW.Win32.QQPass.aqr





Hello,

1.exe_ - Trojan-PSW.Win32.OnLineGames.njs,
6.exe_ - Trojan-PSW.Win32.OnLineGames.njt

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Namestnikov Yury
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-1-9 15:14 编辑 ]

hshhua01

Starting the file scan:

Begin scan in 'D:\BOOK\wnp.rar'
D:\BOOK\wnp.rar
  [0] Archive type: RAR
    --> Program.rar
      [1] Archive type: RAR
      --> 21.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mys
      --> 22.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mzj.1
      --> arpqc.exe
          [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
      --> explorer.exe
          [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
      --> 1.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
      --> 3.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
      --> 4.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mzs
      --> 5.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.17
      --> 6.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
      --> 7.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.myu.8
      --> 8.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mvw.6
      --> 9.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mty.12
      --> 11.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mup.2
      --> 12.exe
          [DETECTION] Is the Trojan horse TR/PSW.Steal.48246
      --> 18.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mza.1
      --> 19.exe
          [DETECTION] Is the Trojan horse TR/Spy.Gen
      --> 20.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.nbr
    --> Wn_Sys8x.rar
      [1] Archive type: RAR
      --> Wn_Sys8x.Sys
          [DETECTION] Is the Trojan horse TR/PSW.Steal.48246
      [INFO]      The file was deleted!

The EQs

C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » 21.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » 22.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » arpqc.exe - a variant of Win32/Delf.CSN trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » explorer.exe - Win32/Agent.NLW trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » 1.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » 3.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » 4.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » 5.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » 6.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » 7.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » 8.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » 9.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » 11.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » 12.exe - Win32/PSW.QQPass.AQR trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » 18.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » 19.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Program.rar » RAR » 20.exe - a variant of Win32/PSW.OnLineGames.GJV trojan
C:\Documents and Settings\Don johnson\桌面\wnp.rar » RAR » Wn_Sys8x.rar » RAR » Wn_Sys8x.Sys - Win32/PSW.QQPass.AQR trojan

Graybird

Starting the file scan:

Begin scan in 'E:\wnp.rar'
E:\wnp.rar
  [0] Archive type: RAR
    --> Program.rar
      [1] Archive type: RAR
      --> 21.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mys
      --> 22.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mzj.1
      --> arpqc.exe
          [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
      --> explorer.exe
          [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
      --> 1.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
      --> 3.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
      --> 4.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mzs
      --> 5.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.17
      --> 6.exe
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
      --> 7.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.myu.8
      --> 8.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mvw.6
      --> 9.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mty.12
      --> 11.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mup.2
      --> 12.exe
          [DETECTION] Is the Trojan horse TR/PSW.Steal.48246
      --> 18.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mza.1
      --> 19.exe
          [DETECTION] Is the Trojan horse TR/Spy.Gen
      --> 20.exe
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.nbr
    --> Wn_Sys8x.rar
      [1] Archive type: RAR
      --> Wn_Sys8x.Sys
          [DETECTION] Is the Trojan horse TR/PSW.Steal.48246
      [INFO]      The file was deleted!


End of the scan: 2008年1月9日  15:00
Used time: 00:21 min

The scan has been done completely.

      0 Scanning directories
     21 Files were scanned
     18 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      3 Archives were scanned
      0 Warnings
      0 Notes

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\wnp.rar'
C:\Documents and Settings\Administrator\My Documents\
  wnp.rar
    [0] Archive type: RAR
      --> Program.rar
        [1] Archive type: RAR
        --> 21.exe
          [2] Archive type: Runtime Packed
          --> Object
            [3] Archive type: RSRC
            --> Object
                [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mys
                [WARNING]   Infected files in archives cannot be repaired!
        --> 22.exe
          [2] Archive type: Runtime Packed
          --> Object
            [3] Archive type: RSRC
            --> Object
                [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mzj.1
                [WARNING]   Infected files in archives cannot be repaired!
        --> arpqc.exe
            [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
            [WARNING]   Infected files in archives cannot be repaired!
        --> explorer.exe
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/Dldr.Agent.blm.3
              [WARNING]   Infected files in archives cannot be repaired!
        --> 1.exe
          [2] Archive type: Runtime Packed
          --> Object
            [3] Archive type: RSRC
            --> Object
                [DETECTION] Contains suspicious code HEUR/Malware
                [WARNING]   Infected files in archives cannot be repaired!
        --> 3.exe
          [2] Archive type: Runtime Packed
          --> Object
            [3] Archive type: RSRC
            --> Object
                [DETECTION] Contains suspicious code HEUR/Malware
                [WARNING]   Infected files in archives cannot be repaired!
        --> 4.exe
          [2] Archive type: Runtime Packed
          --> Object
            [3] Archive type: RSRC
            --> Object
                [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mzs
                [WARNING]   Infected files in archives cannot be repaired!
        --> 5.exe
          [2] Archive type: Runtime Packed
          --> Object
            [3] Archive type: RSRC
            --> Object
                [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.17
                [WARNING]   Infected files in archives cannot be repaired!
        --> 6.exe
          [2] Archive type: Runtime Packed
          --> Object
            [3] Archive type: RSRC
            --> Object
                [DETECTION] Contains suspicious code HEUR/Malware
                [WARNING]   Infected files in archives cannot be repaired!
        --> 7.exe
          [2] Archive type: Runtime Packed
          --> Object
            [3] Archive type: RSRC
            --> Object
                [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.myu.8
                [WARNING]   Infected files in archives cannot be repaired!
        --> 8.exe
          [2] Archive type: Runtime Packed
          --> Object
            [3] Archive type: RSRC
            --> Object
                [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mvw.6
                [WARNING]   Infected files in archives cannot be repaired!
        --> 9.exe
          [2] Archive type: Runtime Packed
          --> Object
            [3] Archive type: RSRC
            --> Object
                [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mty.12
                [WARNING]   Infected files in archives cannot be repaired!
        --> 11.exe
          [2] Archive type: Runtime Packed
          --> Object
            [3] Archive type: RSRC
            --> Object
                [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mup.2
                [WARNING]   Infected files in archives cannot be repaired!
        --> 12.exe
          [2] Archive type: Runtime Packed
          --> Object
            [3] Archive type: RSRC
            --> Object
                [DETECTION] Is the Trojan horse TR/PSW.Steal.48246
                [WARNING]   Infected files in archives cannot be repaired!
        --> 18.exe
          [2] Archive type: Runtime Packed
          --> Object
            [3] Archive type: RSRC
            --> Object
                [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mza.1
                [WARNING]   Infected files in archives cannot be repaired!
        --> 19.exe
          [2] Archive type: Runtime Packed
          --> Object
            [3] Archive type: RSRC
            --> Object
                [DETECTION] Is the Trojan horse TR/Spy.Gen
                [WARNING]   Infected files in archives cannot be repaired!
        --> 20.exe
          [2] Archive type: Runtime Packed
          --> Object
            [3] Archive type: RSRC
            --> Object
                [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.nbr
                [WARNING]   Infected files in archives cannot be repaired!
      --> Wn_Sys8x.rar
        [1] Archive type: RAR
        --> Wn_Sys8x.Sys
            [DETECTION] Is the Trojan horse TR/PSW.Steal.48246
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!


End of the scan: 2008年1月8日  23:05
Used time: 00:05 min

The scan has been done completely.

      0 Scanning directories
     21 Files were scanned
     15 viruses and/or unwanted programs were found
      3 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      6 Files not concerned
     19 Archives were scanned
     18 Warnings
      0 Notes

28654621

D:\download\18.rar>>Program.rar>>21.exe        W32.Viking.k        病毒        还未处理
D:\download\18.rar>>Program.rar>>22.exe        W32.Viking.k        病毒        还未处理
D:\download\18.rar>>Program.rar>>arpqc.exe        Heuri.Suspicious.ERNM        启发式扫描        还未处理
D:\download\18.rar>>Program.rar>>explorer.exe        TrojanDownloader.Agent.blm.ypdh        木马        还未处理
D:\download\18.rar>>Program.rar>>1.exe        W32.Viking.k        病毒        还未处理
D:\download\18.rar>>Program.rar>>3.exe        W32.Viking.k        病毒        还未处理
D:\download\18.rar>>Program.rar>>4.exe        W32.Viking.k        病毒        还未处理
D:\download\18.rar>>Program.rar>>5.exe        W32.Viking.k        病毒        还未处理
D:\download\18.rar>>Program.rar>>6.exe        W32.Viking.k        病毒        还未处理
D:\download\18.rar>>Program.rar>>7.exe        W32.Viking.k        病毒        还未处理
D:\download\18.rar>>Program.rar>>8.exe        W32.Viking.k        病毒        还未处理
D:\download\18.rar>>Program.rar>>9.exe        W32.Viking.k        病毒        还未处理
D:\download\18.rar>>Program.rar>>11.exe        W32.Viking.k        病毒        还未处理
D:\download\18.rar>>Program.rar>>12.exe        W32.Gammima.xkzd        病毒        还未处理
D:\download\18.rar>>Program.rar>>18.exe        W32.Viking.k        病毒        还未处理
D:\download\18.rar>>Program.rar>>19.exe        W32.Viking.k        病毒        还未处理
D:\download\18.rar>>Program.rar>>20.exe        TrojanPSW.OnLineGames.lha.oiaq        木马        还未处理
D:\download\18.rar>>Wn_Sys8x.rar>>Wn_Sys8x.Sys        PWSteal.QQGame.nibx.dll        木马        还未处理

scottxzt

2008-1-9 16:25:32,PWSteal.QQGame.nibx.dll,木马,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Wn_Sys8x.rar>>Wn_Sys8x.Sys,Manual scan
2008-1-9 16:25:32,TrojanDownloader.Agent.blm.ypdh,木马,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>explorer.exe,Manual scan
2008-1-9 16:25:32,Heuri.Suspicious.ERNM,启发式扫描,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>arpqc.exe,Manual scan
2008-1-9 16:25:32,W32.Viking.k,病毒,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>9.exe,Manual scan
2008-1-9 16:25:32,W32.Viking.k,病毒,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>8.exe,Manual scan
2008-1-9 16:25:32,W32.Viking.k,病毒,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>7.exe,Manual scan
2008-1-9 16:25:32,W32.Viking.k,病毒,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>6.exe,Manual scan
2008-1-9 16:25:32,W32.Viking.k,病毒,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>5.exe,Manual scan
2008-1-9 16:25:32,W32.Viking.k,病毒,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>4.exe,Manual scan
2008-1-9 16:25:32,W32.Viking.k,病毒,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>3.exe,Manual scan
2008-1-9 16:25:32,W32.Viking.k,病毒,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>22.exe,Manual scan
2008-1-9 16:25:32,W32.Viking.k,病毒,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>21.exe,Manual scan
2008-1-9 16:25:32,TrojanPSW.OnLineGames.lha.oiaq,木马,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>20.exe,Manual scan
2008-1-9 16:25:32,W32.Viking.k,病毒,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>19.exe,Manual scan
2008-1-9 16:25:32,W32.Viking.k,病毒,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>18.exe,Manual scan
2008-1-9 16:25:32,W32.Gammima.xkzd,病毒,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>12.exe,Manual scan
2008-1-9 16:25:32,W32.Viking.k,病毒,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>11.exe,Manual scan
2008-1-9 16:25:32,W32.Viking.k,病毒,dell,C:\Documents and Settings\dell\桌面\wnp.rar>>Program.rar>>1.exe,Manual scan
2008-1-9 16:21:56,非法的写操作,可疑程序,dell,C:\Documents and Settings\dell\桌面\picture-0012.JPEG_www.facebook.com->

will

"Win32:OnLineGames-BCD [Trj]"              1.exe
"Win32:Delf-FZG [Trj]"                                   12.exe
"Win32:OnLineGames-BPD [Trj]"               19.exe  
"Win32:OnLineGames-BMZ [Trj]"                3.exe  
"Win32:OnLineGames-BQS [Trj]"               4.exe  
"Win32:OnLineGames-BCD [Trj]"               5.exe
"Win32:Small-DJC [Trj]"                                arpqc.exe  
"Win32:Agent-LSI [Trj]"                                  explorer.exe
"Win32:Delf-FZG [Trj]"                                   Wn_Sys8x.Sys

人族

现在盗号马很流行啊

kkgh

2008-1-9 17:02:13        wnp.rar        C:\Documents and Settings\zh\桌面                3
        Program.rar                        3
        21.exe                Trojan.PWS.Wsgame.2691
        22.exe                Trojan.PWS.Wsgame.2702
        arpqc.exe                Trojan.Sniff
        explorer.exe                Trojan.DownLoader.31883
        1.exe                MULDROP.Trojan
        3.exe                MULDROP.Trojan
        4.exe                MULDROP.Trojan
        5.exe                Trojan.PWS.Wsgame.2716
        6.exe                MULDROP.Trojan
        7.exe                Trojan.PWS.Wsgame.2701
        8.exe                Trojan.PWS.Wsgame.2714
        9.exe                Trojan.PWS.Wsgame.2694
        11.exe                MULDROP.Trojan
        18.exe                Trojan.PWS.Wsgame.2683
        19.exe                MULDROP.Trojan
        20.exe                Trojan.PWS.Gamania.6724

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.GamesOnline.dr
病毒： Trojan.PSW.Win32.GamesOnline.fe
病毒： Trojan.Mnless.lpi        
病毒： Trojan.DL.Win32.Agent.yrh
病毒： Trojan.PSW.Win32.GameOL.gnj
病毒： Trojan.PSW.Win32.GamesOnline.fr
病毒： Malicious Code           
病毒： Trojan.PSW.Win32.GamesOnline.fc
病毒： Trojan.PSW.Win32.GamesOnline.et
病毒： Trojan.PSW.Win32.GameOL.iba
病毒： Trojan.PSW.Win32.SunOnline.ku
病毒： Worm.Win32.PaBug.fz      
病毒： Trojan.PSW.Win32.GameOL.ibk
病毒： Trojan.PSW.Win32.GameOL.lbx
病毒： Trojan.PSW.Win32.GameOL.ldz
病毒： Worm.Win32.PaBug.fz      

用户来源：互联网

软件版本：20.26.20