23[MD5: 2C7E3C ~~C562F5]

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\SAMPLE.rar'
C:\Documents and Settings\Administrator\My Documents\
  SAMPLE.rar
    [0] Archive type: RAR
      --> 11.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Contains suspicious code HEUR/Malware
              [WARNING]   Infected files in archives cannot be repaired!
      --> 12.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 13.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 14.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 15.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 16.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 17.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 18.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 19.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 20.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
    --> 22.exe
        [DETECTION] Is the Trojan horse TR/Drop.Agent.RE.1
        [WARNING]   Infected files in archives cannot be repaired!
      --> 23.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 24.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 25.exe
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Contains suspicious code HEUR/Crypted
            [WARNING]   Infected files in archives cannot be repaired!
    --> 28.exe
        [DETECTION] Is the Trojan horse TR/Drop.Agent.RE
        [WARNING]   Infected files in archives cannot be repaired!
      --> 29.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 30.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 31.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 32.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 33.exe
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Contains suspicious code HEUR/Crypted
            [WARNING]   Infected files in archives cannot be repaired!
    --> DSConvert.dll
    --> LanguageSetter.exe
    --> SetupHelper.exe
      [WARNING]   The file was ignored!


End of the scan: 2008年1月20日  10:35
Used time: 00:05 min

The scan has been done completely.

      0 Scanning directories
     24 Files were scanned
     17 viruses and/or unwanted programs were found
      3 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      7 Files not concerned
     17 Archives were scanned
      6 Warnings
      0 Notes

Graybird

Starting the file scan:

Begin scan in 'E:\jhfrxz.rar'
E:\jhfrxz.rar
  [0] Archive type: RAR
  --> jhfrxz.dll
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
  --> zjydcx.dll
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [INFO]      The file was deleted!

HC303

毒霸2008，杀16个。

28654621

D:\download\SAMPLE.rar>>11.exe        W32.Viking.k        病毒        还未处理
D:\download\SAMPLE.rar>>12.exe        TrojanPSW.GameOL.GEN.yfkc        木马        还未处理
D:\download\SAMPLE.rar>>13.exe        TrojanPSW.OnLineGames.oeq.eisv        木马        还未处理
D:\download\SAMPLE.rar>>14.exe        Trojan.Cap811623.vxqy        木马        还未处理
D:\download\SAMPLE.rar>>15.exe        TrojanPSW.OnLineGames.oji.sutg        木马        还未处理
D:\download\SAMPLE.rar>>16.exe        TrojanPSW.OnLineGames.otp.vigy        木马        还未处理
D:\download\SAMPLE.rar>>17.exe        RootKit.GameHacktool.az.xtbf        木马        还未处理
D:\download\SAMPLE.rar>>18.exe        TrojanPSW.OnLineGames.oml.xtbf        木马        还未处理
D:\download\SAMPLE.rar>>19.exe        TrojanPSW.OnLineGames.noj.pdyt        木马        还未处理
D:\download\SAMPLE.rar>>20.exe        TrojanPSW.OnLineGames.nmc.foys        木马        还未处理
D:\download\SAMPLE.rar>>22.exe        Trojan.Undef.bra.yupv        木马        还未处理
D:\download\SAMPLE.rar>>23.exe        TrojanPSW.OnLineGames.odg.oqgp        木马        还未处理
D:\download\SAMPLE.rar>>24.exe        TrojanPSW.OnLineGames.oml.llxs        木马        还未处理
D:\download\SAMPLE.rar>>25.exe        Heuri.Suspicious.ERNM        启发式扫描        还未处理
D:\download\SAMPLE.rar>>28.exe        Trojan.Undef.bra.crtx        木马        还未处理
D:\download\SAMPLE.rar>>29.exe        Trojan.AvKiller.v.yseh        木马        还未处理
D:\download\SAMPLE.rar>>30.exe        TrojanPSW.GameOL.GEN.pbou        木马        还未处理
D:\download\SAMPLE.rar>>31.exe        TrojanPSW.OnLineGames.ohb.rbut        木马        还未处理
D:\download\SAMPLE.rar>>32.exe        Trojan.AvKiller.v.nwjg        木马        还未处理
D:\download\SAMPLE.rar>>33.exe        Heuri.Suspicious.ERNM        启发式扫描        还未处理

spatra

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\SAMPLE.rar'
C:\Documents and Settings\Administrator\桌面\SAMPLE.rar
  [0] Archive type: RAR
  --> 11.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.195
  --> 12.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 13.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.nxj.2
  --> 14.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 15.exe
      [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
  --> 16.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 17.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 18.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 19.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 20.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.oju.1
  --> 22.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.RE.1
  --> 23.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.nwz
  --> 24.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.omf
  --> 28.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.RE
  --> 29.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 30.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 31.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.nvu.1
  --> 32.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      The file was deleted!

ballakay

Scanning Report
21 January 2008 11:58:13 - 11:58:14
Computer name: PUMA-PC
Scanning type: Scan target
Target: C:\Users\Administrator\Desktop\Sample.rar


--------------------------------------------------------------------------------

Result: 13 malware found
Trojan.Win32.Vaklik.eg (virus)
C:\Users\Administrator\Desktop\Sample.rar\11.exe
Trojan-PSW.Win32.OnLineGames.oeq (virus)
C:\Users\Administrator\Desktop\Sample.rar\13.exe
Trojan-PSW.Win32.OnLineGames.nmc (virus)
C:\Users\Administrator\Desktop\Sample.rar\14.exe
C:\Users\Administrator\Desktop\Sample.rar\20.exe
Trojan-PSW.Win32.OnLineGames.oji (virus)
C:\Users\Administrator\Desktop\Sample.rar\15.exe
Trojan-PSW.Win32.OnLineGames.otp (virus)
C:\Users\Administrator\Desktop\Sample.rar\16.exe
Trojan-PSW.Win32.OnLineGames.oml (virus)
C:\Users\Administrator\Desktop\Sample.rar\18.exe
Trojan-PSW.Win32.OnLineGames.noj (virus)
C:\Users\Administrator\Desktop\Sample.rar\19.exe
Trojan.Win32.Agent.ebs (virus)
C:\Users\Administrator\Desktop\Sample.rar\22.exe
C:\Users\Administrator\Desktop\Sample.rar\28.exe
Trojan-PSW.Win32.OnLineGames.odg (virus)
C:\Users\Administrator\Desktop\Sample.rar\23.exe
Trojan-Downloader.Win32.Zlob.gef (virus)
C:\Users\Administrator\Desktop\Sample.rar\24.exe
Trojan-PSW.Win32.OnLineGames.ohb (virus)
C:\Users\Administrator\Desktop\Sample.rar\31.exe




--------------------------------------------------------------------------------

Statistics
Scanned:
Files: 24
Not scanned: 0
Result:
Viruses: 13
Spyware: 0
Suspicious items: 0
Riskware: 0
Actions:
Disinfected: 0
Renamed: 0
Deleted: 0
Quarantined: 0
Failed: 0
Boot Sectors:
Scanned: 0
Infected: 0
Suspicious items: 0
Disinfected: 0


--------------------------------------------------------------------------------

Options
Definitions version:
Viruses: 2008-01-20_03
Spyware: 2008-01-20_03
Scanning Engines:
F-Secure AVP: 7.00.171, 2008-01-20
F-Secure Libra: 2.04.01, 2008-01-18
F-Secure Orion: 1.02.37, 2008-01-20
F-Secure Draco: 1.00.35, 2007-11-28
Scanning options:
Scan all files
Scan inside archives
Actions:
Viruses: Delete infected files
Spyware: Delete infected files

sdhlong

KV08查14个！

kkgh

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.GameOL.ljz
病毒： Trojan.PSW.Win32.XYOnline.aaf
病毒： Trojan.PSW.Win32.GameOL.ljx
病毒： Trojan.PSW.Win32.XYOnline.aal
病毒： Trojan.PSW.Win32.GamesOnline.ir
病毒： Trojan.PSW.Win32.GamesOnline.gs
病毒： Trojan.Win32.Undef.bra   
病毒： Trojan.PSW.Win32.GameOL.lhy
病毒： Trojan.PSW.Win32.SO2Online.at

用户来源：互联网

软件版本：20.28

xiaohf

费尔23，给微点抢了一个
小红伞18

Graybird

The file 'DSConvert.dll' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

The file 'LanguageSetter.exe' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

The file 'SetupHelper.exe' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.