一段时间以前截获的样本

youthnet

本人前两日截获的一些样本

冷冷

IK
I:\virus\test\v1.zip:\a19.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\test\v1.zip:\a22.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\test\v1.zip:\a5.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\test\v1.zip:\a4.exe - Signature 'Trojan-Dropper.Win32.Agent.ane' found
I:\virus\test\v1.zip:\a11.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\test\v1.zip:\a24.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\test\v1.zip:\a3.exe - Signature 'Virus.Win32.OnLineGames.SR' found
I:\virus\test\v1.zip:\a23.exe - Signature 'Trojan-Spy.Win32.Delf.uv' found
I:\virus\test\v1.zip:\baidu.exe - Signature 'Trojan-Downloader.Win32.Small.hsh' found
I:\virus\test\v1.zip:\a18.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\test\v1.zip
I:\virus\test\v2.zip:\QQ.exe - Signature 'Trojan-Downloader.Win32.VB.aoe' found
I:\virus\test\v2.zip:\a1.exe - Signature 'Virus.Win32.QQRob.AS' found
I:\virus\test\v2.zip:\a6.exe - Signature 'Trojan-Proxy.Win32.Delf.AN' found
I:\virus\test\v2.zip:\a17.exe - Signature 'Packed.Win32.Klone.af' found
I:\virus\test\v2.zip:\pic.exe - Signature 'Worm.Win32.Downloader.cs' found
I:\virus\test\v2.zip:\a16.exe - Signature 'Trojan-PWS.Win32.Agent.jp' found
I:\virus\test\v2.zip:\a13.exe - Signature 'Trojan-PWS.Win32.Lmir.bpv' found
I:\virus\test\v2.zip:\a12.exe - Signature 'Trojan-Spy.Win32.Delf.PD' found
I:\virus\test\v2.zip:\a9.exe - Signature 'Trojan-Spy.Win32.Agent.hz' found
I:\virus\test\v2.zip

        21 Files scanned
          (2 Archives with 19 files)
        19 Signatures found
        0 Suspect code-parts found
        Used time: 0:00.453

mofunzone

19全灭

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\v1.zip'
C:\Documents and Settings\Administrator\My Documents\
  v1.zip
  v1.zip:Zone.Identifier
    [0] Archive type: ZIP
    --> a19.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.prw.3
        [WARNING]   Infected files in archives cannot be repaired!
    --> a22.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.157
        [WARNING]   Infected files in archives cannot be repaired!
    --> a5.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.175
        [WARNING]   Infected files in archives cannot be repaired!
    --> a4.exe
        [DETECTION] Is the Trojan horse TR/PSW.Delf.anb.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> a11.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.oju.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> a24.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.256
        [WARNING]   Infected files in archives cannot be repaired!
    --> a3.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.x
        [WARNING]   Infected files in archives cannot be repaired!
    --> a23.exe
        [DETECTION] Is the Trojan horse TR/WuDisable.B
        [WARNING]   Infected files in archives cannot be repaired!
    --> baidu.exe
        [DETECTION] Is the Trojan horse TR/Drop.Agent.8848
        [WARNING]   Infected files in archives cannot be repaired!
    --> a18.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.116
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\v2.zip'
C:\Documents and Settings\Administrator\My Documents\
  v2.zip
  v2.zip:Zone.Identifier
    [0] Archive type: ZIP
    --> QQ.exe
        [DETECTION] Is the Trojan horse TR/Killqq.C.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> a1.exe
        [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.aqur Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
    --> a6.exe
        [DETECTION] Is the Trojan horse TR/PSW.QQpass.ase
        [WARNING]   Infected files in archives cannot be repaired!
    --> a17.exe
        [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> pic.exe
        [DETECTION] Is the Trojan horse TR/Dropper.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> a16.exe
        [DETECTION] Is the Trojan horse TR/PSW.Wow.ajn
        [WARNING]   Infected files in archives cannot be repaired!
    --> a13.exe
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> a12.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Qha.6
        [WARNING]   Infected files in archives cannot be repaired!
    --> a9.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppm.1
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2008年2月6日  22:49
Used time: 00:06 min

The scan has been done completely.

      0 Scanning directories
     23 Files were scanned
     19 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      2 Archives were scanned
     21 Warnings
      0 Notes

Graybird

Starting the file scan:

Begin scan in 'E:\v1.zip'
E:\v1.zip
  [0] Archive type: ZIP
  --> a19.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.prw.3
  --> a22.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.157
  --> a5.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.175
  --> a4.exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.anb.1
  --> a11.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.oju.1
  --> a24.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.256
  --> a3.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.x
  --> a23.exe
      [DETECTION] Is the Trojan horse TR/WuDisable.B
  --> baidu.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.8848
  --> a18.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.116
      [INFO]      The file was deleted!
Begin scan in 'E:\v2.zip'
E:\v2.zip
  [0] Archive type: ZIP
  --> QQ.exe
      [DETECTION] Is the Trojan horse TR/Killqq.C.1
  --> a1.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.aqur Backdoor server programs
  --> a6.exe
      [DETECTION] Is the Trojan horse TR/PSW.QQpass.ase
  --> a17.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
  --> pic.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> a16.exe
      [DETECTION] Is the Trojan horse TR/PSW.Wow.ajn
  --> a13.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> a12.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Qha.6
  --> a9.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppm.1
      [WARNING]   The file was ignored!


End of the scan: 2008年2月7日  14:50
Used time: 00:25 min

The scan has been done completely.

      0 Scanning directories
     21 Files were scanned
     19 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      2 Archives were scanned
      1 Warnings
      0 Notes

wolffshen

2008年2月7日 14:48:01 - 14:48:05 FS 全杀
--------------------------------------------------------------------------------
结果: 找到 19 恶意软件
Backdoor.Win32.Hupigon.aqur (病毒)
D:\Virus\Test\d\a1.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.nmc (病毒)
D:\Virus\Test\d\a11.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.pzl (病毒)
D:\Virus\Test\d\a12.exe 操作: 删除
Trojan-PSW.Win32.Lmir.bpv (病毒)
D:\Virus\Test\d\a13.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.pef (病毒)
D:\Virus\Test\d\a16.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.pem (病毒)
D:\Virus\Test\d\a17.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.obo (病毒)
D:\Virus\Test\d\a18.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.pry (病毒)
D:\Virus\Test\d\a19.exe 操作: 删除
Trojan.Win32.Vaklik.if (病毒)
D:\Virus\Test\d\a22.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.oed (病毒)
D:\Virus\Test\d\a23.exe 操作: 删除
Trojan.Win32.Vaklik.gk (病毒)
D:\Virus\Test\d\a24.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.pwt (病毒)
D:\Virus\Test\d\a3.exe 操作: 删除
Trojan-PSW.Win32.Delf.anb (病毒)
D:\Virus\Test\d\a4.exe 操作: 删除
Trojan-PSW.Win32.OnLineGames.qgw (病毒)
D:\Virus\Test\d\a5.exe 操作: 删除
Trojan-PSW.Win32.QQPass.asf (病毒)
D:\Virus\Test\d\a6.exe 操作: 删除
Trojan.Win32.Vaklik.gi (病毒)
D:\Virus\Test\d\a9.exe 操作: 删除
Trojan-Downloader.Win32.Small.hsh (病毒)
D:\Virus\Test\d\baidu.exe 操作: 删除
Worm.Win32.Downloader.cs (病毒)
D:\Virus\Test\d\pic.exe 操作: 删除
Trojan-PSW.Win32.QQPass.arv (病毒)
D:\Virus\Test\d\QQ.exe 操作: 删除
--------------------------------------------------------------------------------
统计信息
已扫描:
文件: 19
未扫描: 0
结果:
病毒: 19
间谍软件: 0
可疑项目: 0
危险软件: 0
操作:
已杀毒: 0
已重命名: 0
删除: 19
已隔离: 0
失败: 0
启动扇区:
已扫描: 0
受感染: 0
可疑项目: 0
已杀毒: 0
--------------------------------------------------------------------------------
选项
定义版本:
病毒: 2008-02-06_10
间谍软件: 2008-02-06_10
扫描引擎:
F-Secure AVP: 7.00.171, 2008-02-07
F-Secure Hydra: 2.06.7470, 2008-02-07

[ 本帖最后由 wolffshen 于 2008-2-7 14:52 编辑 ]

Joker

19deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pry        File: C:\Documents and Settings\Administrator\×ÀÃæ\v1.zip/a19.exe//PE_Patch//UPack
deleted: Trojan program Trojan.Win32.Vaklik.if        File: C:\Documents and Settings\Administrator\×ÀÃæ\v1.zip/a22.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.qgw        File: C:\Documents and Settings\Administrator\×ÀÃæ\v1.zip/a5.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.Delf.anb        File: C:\Documents and Settings\Administrator\×ÀÃæ\v1.zip/a4.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.nmc        File: C:\Documents and Settings\Administrator\×ÀÃæ\v1.zip/a11.exe//PE_Patch//UPack
deleted: Trojan program Trojan.Win32.Vaklik.gk        File: C:\Documents and Settings\Administrator\×ÀÃæ\v1.zip/a24.exe//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pwt        File: C:\Documents and Settings\Administrator\×ÀÃæ\v1.zip/a3.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.oed        File: C:\Documents and Settings\Administrator\×ÀÃæ\v1.zip/a23.exe//UPack
deleted: Trojan program Trojan-Downloader.Win32.Small.hsh        File: C:\Documents and Settings\Administrator\×ÀÃæ\v1.zip/baidu.exe//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.obo        File: C:\Documents and Settings\Administrator\×ÀÃæ\v1.zip/a18.exe
deleted: Trojan program Trojan-PSW.Win32.QQPass.arv        File: C:\Documents and Settings\Administrator\×ÀÃæ\v2.zip/QQ.exe//ASPack
deleted: Trojan program Backdoor.Win32.Hupigon.aqur        File: C:\Documents and Settings\Administrator\×ÀÃæ\v2.zip/a1.exe//FSG//PEPatch
deleted: Trojan program Trojan-PSW.Win32.QQPass.asf        File: C:\Documents and Settings\Administrator\×ÀÃæ\v2.zip/a6.exe//UPX
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pem        File: C:\Documents and Settings\Administrator\×ÀÃæ\v2.zip/a17.exe
deleted: virus Worm.Win32.Downloader.cs        File: C:\Documents and Settings\Administrator\×ÀÃæ\v2.zip/pic.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pef        File: C:\Documents and Settings\Administrator\×ÀÃæ\v2.zip/a16.exe//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-PSW.Win32.Lmir.bpv        File: C:\Documents and Settings\Administrator\×ÀÃæ\v2.zip/a13.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.pzl        File: C:\Documents and Settings\Administrator\×ÀÃæ\v2.zip/a12.exe//PE_Patch//UPack
deleted: Trojan program Trojan.Win32.Vaklik.gi        File: C:\Documents and Settings\Administrator\×ÀÃæ\v2.zip/a9.exe//UPack//PE_Patch

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.VB.ywk      
病毒： Trojan.Win32.Undef.byj   
病毒： Worm.Win32.PaBug.gs      
病毒： Trojan.PSW.Win32.GameOL.lmd
病毒： Trojan.Win32.Mnless.zyt  
病毒： Trojan.PSW.Win32.Agent.vrp
病毒： Trojan.PSW.Win32.GamesOnline.fz
病毒： Trojan.PSW.Win32.GamesOnline.mh
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.XYOnline.abc
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.AskTao.gu
病毒： Trojan.PSW.Win32.GameOL.lkx
病毒： Trojan.PSW.Win32.QQGame.GEN
病毒： Trojan.PSW.Win32.XYOnline.abe
病毒： Trojan.PSW.Win32.XYOnline.abe
病毒： Trojan.PSW.Win32.QQFO.j  
病毒： Trojan.DL.Win32.Mnless.rq
病毒： Trojan.PSW.Win32.GameOL.GEN

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.30.20

傻猪猪米走鸡

2008-2-7 15:49:54        Kernel        File  'E:\virus\v2.rar' was sent to ESET for analysis.

su-tt

v2.zip\a1.exe;C:\Documents and Settings\Administrator\桌面\v2.zip;Trojan.BadDate;;
v2.zip\a6.exe;C:\Documents and Settings\Administrator\桌面\v2.zip;Trojan.PWS.Lineage.origin;;
v2.zip\a17.exe;C:\Documents and Settings\Administrator\桌面\v2.zip;Trojan.PWS.Wsgame.2984;;
v2.zip\pic.exe;C:\Documents and Settings\Administrator\桌面\v2.zip;Win32.HLLW.Rubbish;;
v2.zip\a16.exe;C:\Documents and Settings\Administrator\桌面\v2.zip;Trojan.MulDrop.10524;;
v2.zip\a13.exe;C:\Documents and Settings\Administrator\桌面\v2.zip;Trojan.PWS.Legmir;;
v2.zip\a12.exe;C:\Documents and Settings\Administrator\桌面\v2.zip;Trojan.PWS.Wsgame.3240;;
v2.zip\a9.exe;C:\Documents and Settings\Administrator\桌面\v2.zip;Trojan.PWS.Wsgame.3149;;
v2.zip;C:\Documents and Settings\Administrator\桌面;发现档案文件中有受感染的对象;;
v1.zip\a19.exe;C:\Documents and Settings\Administrator\桌面\v1.zip;Trojan.PWS.Wsgame.3196;;
v1.zip\a22.exe;C:\Documents and Settings\Administrator\桌面\v1.zip;Trojan.PWS.Wsgame.2968;;
v1.zip\a5.exe;C:\Documents and Settings\Administrator\桌面\v1.zip;Trojan.PWS.Wsgame.2986;;
v1.zip\a4.exe;C:\Documents and Settings\Administrator\桌面\v1.zip;Trojan.PWS.Gamania.6951;;
v1.zip\a11.exe;C:\Documents and Settings\Administrator\桌面\v1.zip;Trojan.PWS.Wsgame.2981;;
v1.zip\a24.exe;C:\Documents and Settings\Administrator\桌面\v1.zip;Trojan.PWS.Wsgame.3147;;
v1.zip\a3.exe;C:\Documents and Settings\Administrator\桌面\v1.zip;Trojan.DownLoader.origin;;
v1.zip\a23.exe;C:\Documents and Settings\Administrator\桌面\v1.zip;Trojan.PWS.Gamania.6950;;
v1.zip\baidu.exe;C:\Documents and Settings\Administrator\桌面\v1.zip;Trojan.DownLoader.42669;;
v1.zip\a18.exe;C:\Documents and Settings\Administrator\桌面\v1.zip;Trojan.PWS.Wsgame.2787;;
v1.zip;C:\Documents and Settings\Administrator\桌面;发现档案文件中有受感染的对象;;

我爱舒畅

费尔19个全灭
Date,Virus Name,Virus Type,User,Filename,Scan Type
2008-2-7 15:55:53,W32.Viking.k,病毒,shuchang,C:\Downloads\v2.zip>>a9.exe,Manual scan
2008-2-7 15:55:52,TrojanPSW.OnLineGames.pzl.ontg,木马,shuchang,C:\Downloads\v2.zip>>a12.exe,Manual scan
2008-2-7 15:55:52,PWSteal.Lemir.bpv.zhtx,木马,shuchang,C:\Downloads\v2.zip>>a13.exe,Manual scan
2008-2-7 15:55:52,TrojanPSW.OnLineGames.pef.muwy,木马,shuchang,C:\Downloads\v2.zip>>a16.exe,Manual scan
2008-2-7 15:55:52,TrojanDownloader.Nurech.bd.bmqk,木马,shuchang,C:\Downloads\v2.zip>>pic.exe,Manual scan
2008-2-7 15:55:52,TrojanPSW.OnLineGames.pem.ppgn,木马,shuchang,C:\Downloads\v2.zip>>a17.exe,Manual scan
2008-2-7 15:55:52,W32.Gammima.figd,病毒,shuchang,C:\Downloads\v2.zip>>a6.exe,Manual scan
2008-2-7 15:55:52,Backdoor.Hupigon.aqur.ykqc,后门,shuchang,C:\Downloads\v2.zip>>a1.exe,Manual scan
2008-2-7 15:55:52,Trojan.VB.yvh.rrhw,木马,shuchang,C:\Downloads\v2.zip>>QQ.exe,Manual scan
2008-2-7 15:55:40,W32.Viking.k,病毒,shuchang,C:\Downloads\v1.zip>>a18.exe,Manual scan
2008-2-7 15:55:40,Trojan.Yaeesy.wsxp,木马,shuchang,C:\Downloads\v1.zip>>baidu.exe,Manual scan
2008-2-7 15:55:40,TrojanPSW.OnLineGames.lhc.hdro,木马,shuchang,C:\Downloads\v1.zip>>a23.exe,Manual scan
2008-2-7 15:55:40,TrojanPSW.XYOnline.aao.etad,木马,shuchang,C:\Downloads\v1.zip>>a3.exe,Manual scan
2008-2-7 15:55:40,W32.Viking.k,病毒,shuchang,C:\Downloads\v1.zip>>a24.exe,Manual scan
2008-2-7 15:55:40,TrojanPSW.OnLineGames.nmc.foys,木马,shuchang,C:\Downloads\v1.zip>>a11.exe,Manual scan
2008-2-7 15:55:40,TrojanPSW.Delf.anb.bmbu,木马,shuchang,C:\Downloads\v1.zip>>a4.exe,Manual scan
2008-2-7 15:55:40,W32.Viking.k,病毒,shuchang,C:\Downloads\v1.zip>>a5.exe,Manual scan
2008-2-7 15:55:40,W32.Viking.k,病毒,shuchang,C:\Downloads\v1.zip>>a22.exe,Manual scan
2008-2-7 15:55:40,TrojanPSW.OnLineGames.pry.ytot,木马,shuchang,C:\Downloads\v1.zip>>a19.exe,Manual scan