71

sam.to

已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.odx        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\avwgjst.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.odx        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\avwlkst.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.nzk        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\avzxnst.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.odx        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\avzxost.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oee        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\gjcsdzc.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oip        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\gjfhbzc.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oed        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\jsqxczc.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oex        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\kaqhmaz.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oej        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\kawdjaz.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ohg        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\kvdxmis.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.nqo        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\kvdxsois.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oex        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\okmhfaz.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oex        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\raqjmtl.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.odx        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\rarjftl.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oeg        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\rsjzbsp.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.opb        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\rsmyksp.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.nzc        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\rsztpsp.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oee        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\swrcgac.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oex        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\wsmsfax.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oir        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Fonts\wsmsgax.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.onw        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Program Files\csrss2.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ojc        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Program Files\csrss3.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oep        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Program Files\csrss7.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.noj        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Program Files\csrss8.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.njv        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\Program Files\csrssa.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.okf        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\System32\3auhad.dll//UPack//#
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oph        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\System32\hjxr.dll//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oen        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\System32\ijiq.dll//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.opl        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\System32\oadnew.dll//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.osv        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\System32\uyom.dll//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ocz        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\System32\vlihzouhgnfe.dll//UPack//#
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.nqo        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\System32\drivers\11.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.nzh        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\System32\drivers\2.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oex        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\System32\drivers\3.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.nzk        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\System32\drivers\6.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oee        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\System32\drivers\7.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.QQPass.arw        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\System32\drivers\8.exe//UPX
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oeg        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\System32\drivers\a15.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oip        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\System32\drivers\a5.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oed        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\System32\drivers\a8.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.oex        檔案: C:\Documents and Settings\kato9096\桌面\FontVirus\FontVirus\System32\drivers\a9.exe//UPack


上报三十个

Hello,

avwgjin.dll, avwlkin.dll, avzxnin.dll, avzxoin.dll, gjcscssb.dll, gjcsdss.dll, gjfhbss.dll, hookhelp.ini, jsqxcss.dll, kaqhmcs.dll, kawdjcs.dll, kvdxmcf.dll, kvdxsocf.dll, okmhfcs.dll, raqjmni.dll, rarjfni.dll, rsjzbfg.dll, rsmykfg.dll, rsztpfg.dll, swrcgcs.dll, wsmsfcj.dll, wsmsgcj.dll

No malicious code were found in these files.

avwgjtm.dll, avwlktm.dll, avzxntm.dll, gjfhbsc.dll, kvdxmte.dll, rsjzbmp.dll, wsmsflc.dll - Trojan-PSW.Win32.Delf.bbc

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

csrssb.exed

This file is corrupted.

Please quote all when answering.

--
Best regards, Denis Maslennikov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-1-20 16:03 编辑 ]

剑书

卡饭论坛 提示信息
附件文件不存在或无法读入，请与管理员联系。

dericyeoh

??? 样本呢/?

剑书

Start of the scan: 2008年1月20日  00:58

Starting the file scan:

Begin scan in 'K:\FontVirus[1]'
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\avwgjst.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLinGame.lus
      [INFO]      A backup was created as '48092c99.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\avwgjtm.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '499ee1b2.qua'!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\avwlkst.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '48092c9b.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\avwlktm.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '499ee1b4.qua'!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\avzxnst.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '480c2c9a.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\avzxntm.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '499be1b3.qua'!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\avzxost.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLinGame.lus
      [INFO]      A backup was created as '480c2c9c.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\gjcsdzc.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '47f52c8e.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\gjfhbsc.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '47f82c8e.qua'!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\gjfhbzc.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLinGame.auw
      [INFO]      A backup was created as '466fe1a7.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\jsqxczc.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '48032c97.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\kaqhmaz.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '48032c85.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\kawdjaz.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '48092c85.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\kvdxmis.exe
      [DETECTION] Is the Trojan horse TR/FWDisable.37328
      [INFO]      A backup was created as '47f62c9a.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\kvdxmte.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '4661e1b3.qua'!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\kvdxsois.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '47f62c9c.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\okmhfaz.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '47ff2c8f.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\raqjmtl.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '4994e1ae.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\rarjftl.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      A backup was created as '48042c85.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\rsjzbmp.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '47fc2c98.qua'!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\rsjzbsp.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '466be1b1.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\rsmyksp.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '47ff2c98.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\rsztpsp.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [INFO]      A backup was created as '480c2c98.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\swrcgac.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '48042c9c.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\wsmsfax.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLinGame.lus
      [INFO]      A backup was created as '4668e1b1.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\wsmsflc.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '47ff2c9a.qua'!
K:\FontVirus[1]\FontVirus\FontVirus\Fonts\wsmsgax.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.oir
      [INFO]      A backup was created as '4668e1b3.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Program Files\csrss2.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      A backup was created as '48042c98.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Program Files\csrss3.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      A backup was created as '4993e1b1.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Program Files\csrss7.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      A backup was created as '48042c9a.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Program Files\csrss8.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      A backup was created as '4993e1b3.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\Program Files\csrssa.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.njx.8
      [INFO]      A backup was created as '4993e1b5.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\System32\3auhad.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      A backup was created as '48072c86.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\System32\hjxr.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.nwz.4
      [INFO]      A backup was created as '480a2c8f.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\System32\ijiq.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      A backup was created as '47fb2c8f.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\System32\oadnew.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.njx.8
      [INFO]      A backup was created as '47f62c87.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\System32\uyom.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      A backup was created as '48012c9f.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\System32\vlihzouhgnfe.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      A backup was created as '47fb2c92.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\System32\drivers\11.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '47c02c57.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\System32\drivers\2.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLinGame.jfj
      [INFO]      A backup was created as '47f72c54.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\System32\drivers\3.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLinGame.lus
      [INFO]      A backup was created as '46793a25.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\System32\drivers\6.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '47f72c56.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\System32\drivers\7.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '46793a27.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\System32\drivers\8.exe
      [DETECTION] Contains detection pattern of the worm WORM/Autorun.FF.23
      [INFO]      A backup was created as '47f72c58.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\System32\drivers\a15.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '47c72c57.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\System32\drivers\a5.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLinGame.auw
      [INFO]      A backup was created as '47c02c5b.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\System32\drivers\a8.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '47c02c5e.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!
K:\FontVirus[1]\FontVirus\FontVirus\System32\drivers\a9.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
      [INFO]      A backup was created as '47c02c5f.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: 2008年1月20日  00:58
Used time: 00:05 min

The scan has been done completely.

      7 Scanning directories
     71 Files were scanned
     41 viruses and/or unwanted programs were found
      7 Files were classified as suspicious:
     41 files were deleted
      0 files were repaired
     48 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     30 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\FontVirus'
C:\Documents and Settings\Administrator\My Documents\FontVirus\FontVirus\Fonts\
  avwgjin.dll
  avwgjst.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  avwgjtm.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains suspicious code HEUR/Malware
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  avwlkin.dll
  avwlkst.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.C
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  avwlktm.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains suspicious code HEUR/Malware
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  avzxnin.dll
  avzxnst.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  avzxntm.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains suspicious code HEUR/Malware
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  avzxoin.dll
  avzxost.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  gjcscssb.dll
  gjcsdss.dll
  gjcsdzc.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  gjfhbsc.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains suspicious code HEUR/Malware
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  gjfhbss.dll
  gjfhbzc.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  hookhelp.ini
  jsqxcss.dll
  jsqxczc.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  kaqhmaz.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  kaqhmcs.dll
  kawdjaz.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  kawdjcs.dll
  kvdxmcf.dll
  kvdxmis.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/FWDisable.37328
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  kvdxmte.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains suspicious code HEUR/Malware
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  kvdxsocf.dll
  kvdxsois.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  okmhfaz.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  okmhfcs.dll
  raqjmni.dll
  raqjmtl.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  rarjfni.dll
  rarjftl.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains suspicious code HEUR/Malware
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  rsjzbfg.dll
  rsjzbmp.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains suspicious code HEUR/Malware
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  rsjzbsp.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.F
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  rsmykfg.dll
  rsmyksp.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  rsztpfg.dll
  rsztpsp.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains suspicious code HEUR/Malware
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  swrcgac.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  swrcgcs.dll
  wsmsfax.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  wsmsfcj.dll
  wsmsflc.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains suspicious code HEUR/Malware
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  wsmsgax.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.oir
      [INFO]      The file was deleted!
  wsmsgcj.dll
C:\Documents and Settings\Administrator\My Documents\FontVirus\FontVirus\Program Files\
  csrss2.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
      [INFO]      The file was deleted!
  csrss3.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
      [INFO]      The file was deleted!
  csrss7.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
      [INFO]      The file was deleted!
  csrss8.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
      [INFO]      The file was deleted!
  csrssa.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
      [INFO]      The file was deleted!
  csrssb.exe
C:\Documents and Settings\Administrator\My Documents\FontVirus\FontVirus\System32\
  3auhad.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
        --> Object
            [DETECTION] Is the Trojan horse TR/Rootkit.Gen
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  hjxr.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.nwz.4
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  ijiq.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
        --> Object
            [DETECTION] Is the Trojan horse TR/Rootkit.Gen
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  oadnew.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.njx.8
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  uyom.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
        --> Object
            [DETECTION] Is the Trojan horse TR/Rootkit.Gen
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  vlihzouhgnfe.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
        --> Object
            [DETECTION] Is the Trojan horse TR/Rootkit.Gen
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\My Documents\FontVirus\FontVirus\System32\drivers\
  11.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  2.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  3.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  6.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  7.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  8.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains detection pattern of the worm WORM/Autorun.FF.23
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  a15.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.F
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  a5.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  a8.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!
  a9.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/WuDisable.B
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!


End of the scan: 2008年1月19日  09:03
Used time: 00:06 min

The scan has been done completely.

      6 Scanning directories
     71 Files were scanned
     39 viruses and/or unwanted programs were found
      9 Files were classified as suspicious:
     48 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     32 Files not concerned
     47 Archives were scanned
     42 Warnings
      0 Notes

醉一生爱妍

NOD48~

mofunzone

红伞杀完剩下22个dll+一个exe
验证全部dll都为木马asp收信组建
exe运行后崩溃
就都不上报了

醉一生爱妍

一个EXE不杀之外其余DLL都很少杀~~~

冷冷

I:\virus\FontVirus\FontVirus\Fonts\avwgjin.dll
I:\virus\FontVirus\FontVirus\Fonts\avwgjst.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\avwgjtm.dll - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\avwlkin.dll
I:\virus\FontVirus\FontVirus\Fonts\avwlkst.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\avwlktm.dll - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\avzxnin.dll
I:\virus\FontVirus\FontVirus\Fonts\avzxnst.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\avzxntm.dll - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\avzxoin.dll
I:\virus\FontVirus\FontVirus\Fonts\avzxost.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\gjcscssb.dll
I:\virus\FontVirus\FontVirus\Fonts\gjcsdss.dll
I:\virus\FontVirus\FontVirus\Fonts\gjcsdzc.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\gjfhbsc.dll - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\gjfhbss.dll
I:\virus\FontVirus\FontVirus\Fonts\gjfhbzc.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\hookhelp.ini
I:\virus\FontVirus\FontVirus\Fonts\jsqxcss.dll
I:\virus\FontVirus\FontVirus\Fonts\jsqxczc.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\kaqhmaz.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\kaqhmcs.dll
I:\virus\FontVirus\FontVirus\Fonts\kawdjaz.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\kawdjcs.dll
I:\virus\FontVirus\FontVirus\Fonts\kvdxmcf.dll
I:\virus\FontVirus\FontVirus\Fonts\kvdxmis.exe - Signature 'Trojan-Dropper.Win32.Agent.ane' found
I:\virus\FontVirus\FontVirus\Fonts\kvdxmte.dll - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\kvdxsocf.dll
I:\virus\FontVirus\FontVirus\Fonts\kvdxsois.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\okmhfaz.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\okmhfcs.dll
I:\virus\FontVirus\FontVirus\Fonts\raqjmni.dll
I:\virus\FontVirus\FontVirus\Fonts\raqjmtl.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\rarjfni.dll
I:\virus\FontVirus\FontVirus\Fonts\rarjftl.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\rsjzbfg.dll
I:\virus\FontVirus\FontVirus\Fonts\rsjzbmp.dll - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\rsjzbsp.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\rsmykfg.dll
I:\virus\FontVirus\FontVirus\Fonts\rsmyksp.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\rsztpfg.dll
I:\virus\FontVirus\FontVirus\Fonts\rsztpsp.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\swrcgac.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\swrcgcs.dll
I:\virus\FontVirus\FontVirus\Fonts\wsmsfax.exe - Signature 'Trojan-Dropper.Win32.Agent.ane' found
I:\virus\FontVirus\FontVirus\Fonts\wsmsfcj.dll
I:\virus\FontVirus\FontVirus\Fonts\wsmsflc.dll - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\Fonts\wsmsgax.exe - Signature 'Trojan-Dropper.Win32.Agent.ane' found
I:\virus\FontVirus\FontVirus\Fonts\wsmsgcj.dll
I:\virus\FontVirus\FontVirus\Program Files\csrss2.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\FontVirus\FontVirus\Program Files\csrss3.exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found
I:\virus\FontVirus\FontVirus\Program Files\csrss7.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\FontVirus\FontVirus\Program Files\csrss8.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\FontVirus\FontVirus\Program Files\csrssa.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\FontVirus\FontVirus\Program Files\csrssb.exe - Suspect code-parts found (Level: 70)
I:\virus\FontVirus\FontVirus\System32\3auhad.dll - Signature 'Trojan-PWS.Win32.Small.br' found
I:\virus\FontVirus\FontVirus\System32\hjxr.dll - Signature 'Trojan-PWS.Win32.Small.br' found
I:\virus\FontVirus\FontVirus\System32\ijiq.dll - Signature 'Trojan-PWS.Win32.Small.br' found
I:\virus\FontVirus\FontVirus\System32\oadnew.dll - Signature 'Trojan-PWS.Win32.Small.br' found
I:\virus\FontVirus\FontVirus\System32\uyom.dll - Signature 'Trojan-PWS.Win32.Small.br' found
I:\virus\FontVirus\FontVirus\System32\vlihzouhgnfe.dll - Signature 'Trojan-PWS.Win32.Small.br' found
I:\virus\FontVirus\FontVirus\System32\drivers\11.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\System32\drivers\2.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\System32\drivers\3.exe - Signature 'Trojan-Dropper.Win32.Agent.ane' found
I:\virus\FontVirus\FontVirus\System32\drivers\6.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\System32\drivers\7.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\System32\drivers\8.exe - Signature 'Trojan-Proxy.Win32.Delf.AN' found
I:\virus\FontVirus\FontVirus\System32\drivers\a15.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\System32\drivers\a5.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\System32\drivers\a8.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\FontVirus\FontVirus\System32\drivers\a9.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found

        71 Files scanned
          (0 Archives with 0 files)
        48 Signatures found
        1 Suspect code-part found
        Used time: 0:00.468

jerry1273

KIS 7.0.1.321