10+1

显示全部楼层 · 发表于 2008-1-12 16:27:22

detected: Trojan program Trojan-PSW.Win32.WOW.aim URL: http://bbs.kafan.cn/attachment.php?aid=183082//wow.exe//FSG
卡巴的结果。

显示全部楼层 · 发表于 2008-1-12 16:28:34

已删除：木马程序 Trojan-PSW.Win32.WOW.aim 文件　: G:\Temp\0112.rar/wow.exe//FSG
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.nil 文件　: G:\Temp\0112.rar/zx.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.WOW.ahp 文件　: G:\Temp\0112.rar/wow1.exe//ARM//ASPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.njv 文件　: G:\Temp\0112.rar/dh.exe//PE_Patch//UPack
已删除：木马程序 Backdoor.Win32.Delf.awy 文件　: G:\Temp\0112.rar/fy.exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.njs 文件　: G:\Temp\0112.rar/mh.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.nal 文件　: G:\Temp\0112.rar/mir.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.neu 文件　: G:\Temp\0112.rar/my.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.nio 文件　: G:\Temp\0112.rar/qj.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.QQPass.aqz 文件　: G:\Temp\0112.rar/qst.exe//UPX

显示全部楼层 · 发表于 2008-1-12 16:29:07

all killed 大点的没测

显示全部楼层 · 发表于 2008-1-12 16:29:42

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\0112.rar'
C:\Documents and Settings\Administrator\My Documents\
  0112.rar
[0] Archive type: RAR
   --> wow.exe
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
   --> zx.exe
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING] Infected files in archives cannot be repaired!
--> wow1.exe
      [DETECTION] Is the Trojan horse TR/PSW.76864
      [WARNING] Infected files in archives cannot be repaired!
   --> dh.exe
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
--> fy.exe
      [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
      [WARNING] Infected files in archives cannot be repaired!
   --> mh.exe
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
            [DETECTION] Contains suspicious code HEUR/Malware
            [WARNING] Infected files in archives cannot be repaired!
   --> mir.exe
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING] Infected files in archives cannot be repaired!
   --> my.exe
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
            [DETECTION] Contains suspicious code HEUR/Malware
            [WARNING] Infected files in archives cannot be repaired!
   --> qj.exe
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING] Infected files in archives cannot be repaired!
   --> qst.exe
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/PSW.Steal.48270
            [WARNING] Infected files in archives cannot be repaired!
   [INFO]    A backup was created as '47b97a8c.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\Msgmaker.rar'
C:\Documents and Settings\Administrator\My Documents\
  Msgmaker.rar
[0] Archive type: RAR
--> Msgmaker.exe
      [DETECTION] Is the Trojan horse TR/Spy.Banker.Gen
      [WARNING] Infected files in archives cannot be repaired!
   [WARNING] The file was ignored!

End of the scan: 2008年1月12日  00:29
Used time: 00:07 min

The scan has been done completely.

   0 Scanning directories
   13 Files were scanned
   9 viruses and/or unwanted programs were found
   2 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   4 Files not concerned
   10 Archives were scanned
   10 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-1-12 16:43:23

检测到病毒:
Trojan-PSW.Win32.WOW.aim, Trojan-PSW.Win32.OnLineGames.nil, Trojan-PSW.Win32.WOW.ahp, Trojan-PSW.Win32.OnLineGames.njv, Backdoor.Win32.Delf.awy, Trojan-PSW.Win32.OnLineGames.njs, Trojan-PSW.Win32.OnLineGames.nal, Trojan-PSW.Win32.OnLineGames.neu, Trojan-PSW.Win32.OnLineGames.nio, Trojan-PSW.Win32.QQPass.aqz

装载时发现网络内病毒

地址: bbs.kafan.cn

显示全部楼层 · 发表于 2008-1-12 16:59:31

10个

C:\Users\Wesley\Downloads\0112.rar
  [0] Archive type: RAR
  --> wow.exe
   [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> zx.exe
   [DETECTION] Is the Trojan horse TR/WuDisable.B
  --> wow1.exe
   [DETECTION] Is the Trojan horse TR/PSW.76864
  --> dh.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.njx
  --> fy.exe
   [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.1
  --> mh.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> mir.exe
   [DETECTION] Is the Trojan horse TR/WuDisable.B
  --> my.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> qj.exe
   [DETECTION] Is the Trojan horse TR/WuDisable.B
  --> qst.exe
   [DETECTION] Is the Trojan horse TR/PSW.Steal.48270

显示全部楼层 · 发表于 2008-1-12 17:00:39

C:\Users\Wesley\Downloads\Msgmaker.rar
  [0] Archive type: RAR
  --> Msgmaker.exe
   [DETECTION] Is the Trojan horse TR/Spy.Banker.Gen

显示全部楼层 · 发表于 2008-1-12 17:04:39

发现木马
木马名称:Backdoor.Win32.Delf.bpw

程序:
C:\DOCUMENTS AND SETTINGS\TIAN\桌面\FY.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

发现未知间谍软件，是否删除？
程序:
C:\DOCUMENTS AND SETTINGS\TIAN\桌面\WOW.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\TYFMVAHWOW.DLL
2) C:\WINDOWS\SYSTEM32\CYCCOMPRESS.DLL
是否删除木马程序及其衍生物?

发现木马
木马名称:Trojan-PSW.Win32.OLGames.gvj

程序:
C:\DOCUMENTS AND SETTINGS\TIAN\LOCAL SETTINGS\TEMP\TMPA.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?

发现未知木马，是否删除？
程序:
C:\DOCUMENTS AND SETTINGS\TIAN\桌面\DH.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\AUHAD.DLL
2) C:\WINDOWS\SYSTEM32\MSEPION.SYS
3) C:\DOCUMENTS AND SETTINGS\TIAN\LOCAL SETTINGS\TEMP\TMPA.TMP
是否删除木马程序及其衍生物?

发现可疑程序
程序:
C:\DOCUMENTS AND SETTINGS\TIAN\桌面\MIR.EXE
1) C:\DFD6299156.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

发现可疑程序
程序:
C:\DOCUMENTS AND SETTINGS\TIAN\桌面\QJ.EXE
1) C:\DFD6337453.BAT
是可疑程序!
试图删除文件!
是否阻止该进程继续运行?

发现未知木马，是否删除？
程序:
C:\DOCUMENTS AND SETTINGS\TIAN\桌面\QST.EXE
并生成以下文件:
1) E:\AUTORUN.EXE
2) E:\AUTORUN.INF
3) E:\AUTORUN.EXE

是否删除木马程序及其衍生物?

发现未知间谍软件，是否删除？
程序:
C:\DOCUMENTS AND SETTINGS\TIAN\桌面\MH.EXE
木马程序生成以下文件:
1) C:\WINDOWS\WINFORM.EXE
2) C:\WINDOWS\SYSTEM32\WINFORM.DLL
是否删除木马程序及其衍生物?

发现未知间谍软件，是否删除？
程序:
C:\DOCUMENTS AND SETTINGS\TIAN\桌面\MY.EXE
木马程序生成以下文件:
1) C:\WINDOWS\WSOCKDRV32.EXE
2) C:\WINDOWS\SYSTEM32\WSOCKDRV32.DLL
是否删除木马程序及其衍生物?

发现未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\TIAN\桌面\WOW1.EXE
木马程序生成以下文件:
1) C:\RECYCLER\OW.EXE
2) C:\RECYCLER\OW.DLL
是否删除木马程序及其衍生物?

[ 本帖最后由 taiw_1144 于 2008-1-12 17:08 编辑 ]

显示全部楼层 · 发表于 2008-1-12 17:14:23

已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.njv 檔案: C:\Documents and Settings\kato9096\桌面\186916\dh.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Backdoor.Win32.Delf.awy 檔案: C:\Documents and Settings\kato9096\桌面\186916\fy.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.njs 檔案: C:\Documents and Settings\kato9096\桌面\186916\mh.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.nal 檔案: C:\Documents and Settings\kato9096\桌面\186916\mir.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.neu 檔案: C:\Documents and Settings\kato9096\桌面\186916\my.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.nio 檔案: C:\Documents and Settings\kato9096\桌面\186916\qj.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.QQPass.aqz 檔案: C:\Documents and Settings\kato9096\桌面\186916\qst.exe//UPX
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.WOW.aim 檔案: C:\Documents and Settings\kato9096\桌面\186916\wow.exe//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.WOW.ahp 檔案: C:\Documents and Settings\kato9096\桌面\186916\wow1.exe//ARM//ASPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.nil 檔案: C:\Documents and Settings\kato9096\桌面\186916\zx.exe//UPack

7.0.1.321,报十个

不报的上报...

显示全部楼层 · 发表于 2008-1-12 18:07:00

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GameOL.lgd
病毒： Trojan.PSW.Win32.GameOL.len
病毒： Trojan.PSW.Win32.WorldOnline.mc
病毒： Trojan.Mnless.lpi
病毒： Trojan.PSW.Win32.GamesOnline.gc
病毒： Trojan.PSW.Win32.LMir.yzw
病毒： Trojan.PSW.Win32.GameOL.lcz
病毒： Trojan.PSW.Win32.JHOnline.fde
病毒： Worm.Win32.PaBug.gi

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.26.51

[病毒样本] 10+1

本帖子中包含更多资源

Avira AntiVir

Avira AntiVir

21/9