explorer.exe伪装

qigang

rising20.30.40未认得！

qigang

瑞星病毒查杀结果报告（53/13）

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GamesOnline.mh
病毒： Trojan.PSW.Win32.GamesOnline.mn
病毒： RootKit.Win32.GameHack.GEN
病毒： Dropper.Win32.Agent.ytr  
病毒： Trojan.PSW.Win32.AskTao.gw
病毒： Backdoor.Jusi.ar         
病毒： Trojan.PSW.Win32.GameOL.lle

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.30.40

gho

迅雷卡巴报，咖啡miss

gho

只剩1个
2008-2-9        19:37:38        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\1.exe        New Malware.aj (Trojan)
2008-2-9        19:37:38        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\cq.exe        New Malware.aj (Trojan)
2008-2-9        19:37:38        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\cs.exe        New Malware.aj (Trojan)
2008-2-9        19:37:39        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\dj.exe        New Malware.aj (Trojan)
2008-2-9        19:37:39        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\fy.exe        New Malware.aj (Trojan)
2008-2-9        19:37:39        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\hx.exe        New Malware.aj (Trojan)
2008-2-9        19:37:39        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\jh.exe        New Malware.aj (Trojan)
2008-2-9        19:37:40        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\mh.exe        New Malware.aj (Trojan)
2008-2-9        19:37:40        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\qj.exe        New Malware.aj (Trojan)
2008-2-9        19:37:40        Deleted         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\qq.exe        PWS-QQGame (Trojan)
2008-2-9        19:37:40        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\qqhx.exe        New Malware.aj (Trojan)
2008-2-9        19:37:40        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\tl.exe        New Malware.n (Trojan)
2008-2-9        19:37:41        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\wd.exe        New Malware.n (Trojan)
2008-2-9        19:37:41        Deleted         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\wl.exe        PWS-OnlineGames.a (Trojan)
2008-2-9        19:37:42        Deleted         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\xy.exe        Downloader-AZV (Trojan)
2008-2-9        19:37:42        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\zt.exe        New Malware.aj (Trojan)
2008-2-9        19:37:43        Moved (Clean failed because the file isn't cleanable)         WHUT-D9193C067E\gho        WinRAR.exe        C:\Documents and Settings\gho\My Documents\zx.exe        New Malware.aj (Trojan)

傻猪猪米走鸡

2008-2-9 20:31:08        Kernel        File  'E:\virus\explorer\explorer.exe' was sent to ESET for analysis.

醉一生爱妍

已删除：木马程序 Trojan-PSW.Win32.OnLineGames.qlb        文件: C:\Documents and Settings\Administrator\桌面\test.rar/1.exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.pzl        文件: C:\Documents and Settings\Administrator\桌面\test.rar/cq.exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.qiv        文件: C:\Documents and Settings\Administrator\桌面\test.rar/cs.exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.pzl        文件: C:\Documents and Settings\Administrator\桌面\test.rar/dj.exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.qiv        文件: C:\Documents and Settings\Administrator\桌面\test.rar/fy.exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.qnk        文件: C:\Documents and Settings\Administrator\桌面\test.rar/hx.exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.pzl        文件: C:\Documents and Settings\Administrator\桌面\test.rar/jh.exe//PE_Patch//UPack
已删除：木马程序 Backdoor.Win32.Ceckno.qf        文件: C:\Documents and Settings\Administrator\桌面\test.rar/ma.exe
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.qoz        文件: C:\Documents and Settings\Administrator\桌面\test.rar/mh.exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.qiv        文件: C:\Documents and Settings\Administrator\桌面\test.rar/qj.exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.QQPass.atq        文件: C:\Documents and Settings\Administrator\桌面\test.rar/qq.exe//UPX
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.qoz        文件: C:\Documents and Settings\Administrator\桌面\test.rar/qqhx.exe//PE_Patch//UPack
已删除：木马程序 Trojan-Downloader.Win32.Agent.inj        文件: C:\Documents and Settings\Administrator\桌面\test.rar/tl.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.Delf.aob        文件: C:\Documents and Settings\Administrator\桌面\test.rar/wd.exe//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.pzl        文件: C:\Documents and Settings\Administrator\桌面\test.rar/wl.exe//PE_Patch//UPack
已删除：木马程序 Backdoor.Win32.Agent.fs        文件: C:\Documents and Settings\Administrator\桌面\test.rar/xy.exe//NSPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.qiv        文件: C:\Documents and Settings\Administrator\桌面\test.rar/zt.exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.pbp        文件: C:\Documents and Settings\Administrator\桌面\test.rar/zx.exe//PE_Patch//UPack

Graybird

Starting the file scan:

Begin scan in 'E:\virus\explorer.rar'
E:\virus\explorer.rar
  [0] Archive type: RAR
  --> explorer.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.iop.3
      [INFO]      The file was deleted!

Graybird

全灭~
Starting the file scan:

Begin scan in 'E:\virus\test.rar'
E:\virus\test.rar
  [0] Archive type: RAR
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Small.RV
  --> cq.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Qha.5
  --> cs.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.QIV.4
  --> dj.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Qha.4
  --> fy.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> hx.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.qnq.2
  --> jh.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Qha.1
  --> ma.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Ceckno.QF Backdoor server programs
  --> mh.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.qoz
  --> qj.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.qiv
  --> qq.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.33915
  --> qqhx.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.qoz.6
  --> tl.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.ink
  --> wd.exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.aob
  --> wl.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Qha.8
  --> xy.exe
      [DETECTION] Is the Trojan horse TR/Agent.18944.C.2
  --> zt.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> zx.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.oqq.5
      [INFO]      The file was deleted!


End of the scan: 2008年2月11日  07:33
Used time: 00:24 min

The scan has been done completely.

      0 Scanning directories
     19 Files were scanned
     18 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

chunnian

kv2007查到一个

chunnian