下载者一包

zzh161

可怜瑞星总是漏杀那么几个 不过比较奇怪的是，有些清毒不行，点删除提示文件删除了，但是文件还是在那里，真是搞笑了

22:http://59.60.154.154/2a.exe
22:http://59.60.154.154/3a.exe
22:http://59.60.154.154/4a.exe
22:http://59.60.154.154/5a.exe
22:http://59.60.154.154/6a.exe
22:http://59.60.154.154/7a.exe
22:http://59.60.154.154/8a.exe
22:http://59.60.154.154/9a.exe
22:http://59.60.154.154/10a.exe
22:http://59.60.154.154/11a.exe
22:http://59.60.154.154/12a.exe
22:http://59.60.154.154/13a.exe
22:http://59.60.154.154/14a.exe
22:http://59.60.154.154/15a.exe
22:http://dow.183858.com:81/16a.exe
22:http://dow.183858.com:81/17a.exe
22:http://dow.183858.com:81/18a.exe
22:http://dow.183858.com:81/19a.exe
22:http://dow.183858.com:81/20a.exe
22:http://dow.183858.com:81/21a.exe
22:http://dow.183858.com:81/22a.exe
22:http://dow.183858.com:81/23a.exe
22:http://dow.183858.com:81/24a.exe
22:http://dow.183858.com:81/25a.exe

样本：

  瑞星病毒查杀结果报告
清除病毒种类列表：
病毒： Trojan.PSW.Win32.GameOL.lhu
病毒： RootKit.Win32.GameHack.ger
病毒： RootKit.Win32.GameHack.ger
病毒： RootKit.Win32.GameHack.ger
病毒： Trojan.PSW.Win32.XYOnline.abc
病毒： Trojan.PSW.Win32.GameOL.lrr
病毒： Trojan.PSW.Win32.GameOL.lph
病毒： Trojan.PSW.Win32.GameOL.glf
病毒： Worm.Win32.PaBug.GEN     
病毒： Trojan.PSW.Win32.QQGame.GEN
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.OnlineGames.GEN
病毒： Trojan.PSW.Win32.QQHX.tvu
病毒： Trojan.PSW.Win32.OnlineGames.GEN
病毒： Trojan.DL.Win32.Mnless.xc
病毒： Trojan.PSW.Win32.QQGame.GEN
病毒： Trojan.PSW.Win32.WorldOnline.mc
病毒： Trojan.PSW.Win32.GamesOnline.ik
病毒： Trojan.PSW.Win32.GameOL.luh
病毒： Trojan.PSW.Win32.GameOL.llr
MAC 地址：00:00:00:00:00:00
用户来源：局域网
软件版本：20.29.32

挪威的冬天

信息        2008-02-01  10:57:47        您此次查毒共查出22个病毒以及危险代码                       
信息        2008-02-01  10:57:47        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件45个                       
信息        2008-02-01  10:57:47        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒

Graybird

Starting the file scan:

Begin scan in 'E:\ggg.rar'
E:\ggg.rar
  [0] Archive type: RAR
  --> ggg\10a.exe
      [DETECTION] Is the Trojan horse TR/FWDisable.42528
  --> ggg\11a.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> ggg\12a.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.prw.11
  --> ggg\13a.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pou.1
  --> ggg\14a.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> ggg\15a.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.E
  --> ggg\16a.exe
      [DETECTION] Contains detection pattern of the worm WORM/Autorun.FF.27
  --> ggg\17a.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> ggg\18a.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
  --> ggg\19a.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.12211
  --> ggg\20a.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> ggg\21a.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.aav.1
  --> ggg\22a.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> ggg\23a.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmi.30
  --> ggg\24a.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pqb
  --> ggg\2a.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.dyd
  --> ggg\3a.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.plq
  --> ggg\4a.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> ggg\5a.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> ggg\6a.exe
      [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
  --> ggg\7a.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.olr.1
  --> ggg\8a.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> ggg\9a.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NYS.60
      [INFO]      The file was deleted!


End of the scan: 2008年2月1日  10:59
Used time: 00:22 min

The scan has been done completely.

      0 Scanning directories
     24 Files were scanned
     23 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

挪威的冬天

顶楼列了 24 个 包里面只有 23 个

mofunzone

可能有的失效了，没下载下来

wangjay1980

恰恰说明瑞星很不错了，在如此严峻的情况下只楼杀了几个嘛，免杀从业者该努力了。删除不了难道是引擎有问题？

[ 本帖最后由 wangjay1980 于 2008-2-1 11:06 编辑 ]

mofunzone

25a失效了

zzh161

天知道是啥意思，瑞星报的是exe里面的一个dll，难道有脱壳？点清楚病毒不行，点删除染毒文件，提示删除了，但是文件还在

[ 本帖最后由 zzh161 于 2008-2-1 11:17 编辑 ]

清蒸波波面

费尔杀了23个

leonfg

ESET 全k
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\10a.exe - Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\11a.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\12a.exe - Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\13a.exe - a variant of Win32/PSW.OnLineGames.PBQ trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\14a.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\15a.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\16a.exe - probably a variant of Win32/AutoRun.Q worm
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\17a.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\18a.exe - a variant of Win32/PSW.OnLineGames.FDY trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\19a.exe - a variant of Win32/PSW.OnLineGames.PBQ trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\20a.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\21a.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\22a.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\23a.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\24a.exe - probably a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\2a.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\3a.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\4a.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\5a.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\6a.exe - Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\7a.exe - Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\8a.exe - a variant of Win32/PSW.OnLineGames.GJV trojan
C:\Documents and Settings\GUNDAM\桌面\ggg.rar » RAR » ggg\9a.exe - a variant of Win32/PSW.OnLineGames.MUG trojan