19x生成物

qianwenxiang

从mop奔回卡饭换换气

wangjay1980

detected: Trojan program Trojan-PSW.Win32.OnLineGames.qza        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/xjxr.dll//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.qxw        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/zadnew.dll//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rbz        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/msepion.sys
detected: Trojan program Trojan-Downloader.Win32.AntiVirPro.b        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/ctfmona.exe
detected: Trojan program Trojan-Downloader.Win32.Murlo.ju        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/instat1.exe//PE_Patch.UPX//UPX//PE_Patch.MaskPE
detected: Trojan program Trojan-PSW.Win32.OnLineGames.pvw        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/LYLOADER.EXE//PE_Patch//UPack
detected: Trojan program Backdoor.Win32.Agent.ebl        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/server.exe//PE-Armor
detected: virus Packed.Win32.Tibs.ic        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/wind32.exe
detected: Trojan program Trojan-Downloader.Win32.Hmir.acx        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/2hvm3pv96m.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.pue        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/auhad.dll//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rbx        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/fyom.dll//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rbw        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/kiluw.dll//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.qos        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/knaixnauhuoyizqq.dll//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.pum        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/LYMANGR.DLL//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.pul        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/MSDEG32.DLL//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rby        File: C:\Documents and Settings\Owner\×ÀÃæ\system32.rar/vhqq.dll//UPack
16

KL


Hello,

dllgh8jkd1q1.exe_ - Trojan.Win32.Qhost.agu,
dllgh8jkd1q2.exe_ - not-virus:Hoax.Win32.Renos.avz

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

sstunst3.exe_

No malicious code was found in this file.

Please quote all when answering.

--
Best regards, Yury Nesmachny
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: system32.rar


[ 本帖最后由 wangjay1980 于 2008-2-15 16:00 编辑 ]

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\system32.rar'
C:\Documents and Settings\Administrator\桌面\system32.rar
  [0] Archive type: RAR
  --> xjxr.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> zadnew.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.QIV.7
  --> msepion.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> ctfmona.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> dllgh8jkd1q1.exe
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
  --> dllgh8jkd1q2.exe
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
  --> instat1.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
  --> LYLOADER.EXE
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
  --> server.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
  --> wind32.exe
      [DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
  --> 2hvm3pv96m.dll
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> auhad.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmi.29
  --> fyom.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> kiluw.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.qnq.6
  --> knaixnauhuoyizqq.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.qoz.6
  --> LYMANGR.DLL
      [DETECTION] Is the Trojan horse TR/PSW.Online.agb.2
  --> MSDEG32.DLL
      [DETECTION] Is the Trojan horse TR/PSW.Online.gyo.2
  --> vhqq.dll
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      The file was deleted!


End of the scan: 星期五 2008年2月15日  14:46
Used time: 00:10 min

The scan has been done completely.

      0 Scanning directories
     21 Files were scanned
     17 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      1 files were deleted

kkgh

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： RootKit.Win32.GameHack.geu
病毒： Trojan.PSW.Win32.OnlineGames.GEN
病毒： RootKit.Win32.GameHack.geu
病毒： Trojan.PSW.Win32.GameOL.lvx
病毒： Trojan.PSW.Win32.XYOnline.abe
病毒： Trojan.PSW.Win32.XYOnline.abe
病毒： Trojan.PSW.Win32.GameOL.b
病毒： RootKit.Win32.GameHack.GEN
病毒： Trojan.PSW.Win32.ZeroOnline.dg

用户来源：互联网

软件版本：20.31.30
13个

傻猪猪米走鸡

正在扫描日志
病毒库版本: 2877 (20080215)
日期: 2008/2/15  时间: 15:10:30
已扫描的磁盘、文件夹和文件: C:\Users\曾卉\桌面\system32.rar
C:\Users\曾卉\桌面\system32.rar>RAR>xjxr.dll - Win32/PSW.OnLineGames.NLH 特洛伊木马
C:\Users\曾卉\桌面\system32.rar>RAR>zadnew.dll - Win32/PSW.OnLineGames.NLH 特洛伊木马
C:\Users\曾卉\桌面\system32.rar>RAR>msepion.sys - Win32/PSW.OnLineGames.NFC 特洛伊木马
C:\Users\曾卉\桌面\system32.rar>RAR>LYLOADER.EXE - Win32/PSW.Agent.NEC 特洛伊木马 的变种
C:\Users\曾卉\桌面\system32.rar>RAR>2hvm3pv96m.dll - 可能是 Win32/Genetik 特洛伊木马 的变种
C:\Users\曾卉\桌面\system32.rar>RAR>auhad.dll - Win32/PSW.OnLineGames.NLH 特洛伊木马
C:\Users\曾卉\桌面\system32.rar>RAR>fyom.dll - Win32/PSW.OnLineGames.NLH 特洛伊木马 的变种
C:\Users\曾卉\桌面\system32.rar>RAR>kiluw.dll - Win32/PSW.OnLineGames.NLH 特洛伊木马 的变种
C:\Users\曾卉\桌面\system32.rar>RAR>knaixnauhuoyizqq.dll - Win32/PSW.OnLineGames.NLH 特洛伊木马
C:\Users\曾卉\桌面\system32.rar>RAR>LYMANGR.DLL - Win32/PSW.OnLineGames.DTR 特洛伊木马
C:\Users\曾卉\桌面\system32.rar>RAR>MSDEG32.DLL - Win32/PSW.OnLineGames.DVV 特洛伊木马 的变种
C:\Users\曾卉\桌面\system32.rar>RAR>vhqq.dll - Win32/PSW.OnLineGames.NLH 特洛伊木马 的变种
已扫描的对象数: 21
发现的威胁数: 12
完成时间: 15:10:35  总扫描时间: 5 秒 (00:00:05)

袋鼠吱吱

McAfee都不让下载。。。

挪威的冬天

信息        2008-02-15  15:16:08        您此次查毒共查出12个病毒以及危险代码                       
信息        2008-02-15  15:16:08        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件31个                       
信息        2008-02-15  15:16:08        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-02-15  15:16:08        C:\Users\挪威的冬天\Desktop\system32.rar\vhqq.dll        Win32.Troj.OnlineGamesT.ty.90112        跳过，未处理       
病毒        2008-02-15  15:16:08        C:\Users\挪威的冬天\Desktop\system32.rar\MSDEG32.DLL        Win32.Troj.OnlineGamesT.ty.135168        跳过，未处理       
病毒        2008-02-15  15:16:08        C:\Users\挪威的冬天\Desktop\system32.rar\LYMANGR.DLL        Win32.PSWTroj.OnLineGames.61440        跳过，未处理       
病毒        2008-02-15  15:16:08        C:\Users\挪威的冬天\Desktop\system32.rar\knaixnauhuoyizqq.dll        Win32.Troj.OnlineGamesT.ty.90112        跳过，未处理       
病毒        2008-02-15  15:16:08        C:\Users\挪威的冬天\Desktop\system32.rar\kiluw.dll        Win32.Troj.OnlineGamesT.ty.90112        跳过，未处理       
病毒        2008-02-15  15:16:08        C:\Users\挪威的冬天\Desktop\system32.rar\fyom.dll        Win32.Troj.OnlineGames.yf.73728        跳过，未处理       
病毒        2008-02-15  15:16:08        C:\Users\挪威的冬天\Desktop\system32.rar\auhad.dll        Win32.Troj.OnlineGamesT.ty.90112        跳过，未处理       
病毒        2008-02-15  15:16:08        C:\Users\挪威的冬天\Desktop\system32.rar\2hvm3pv96m.dll        Win32.TrojDownloader.AgentT.cz.147456        跳过，未处理       
病毒        2008-02-15  15:16:08        C:\Users\挪威的冬天\Desktop\system32.rar\LYLOADER.EXE        Win32.Troj.OnlineGamesT.ty.86016        跳过，未处理       
病毒        2008-02-15  15:16:08        C:\Users\挪威的冬天\Desktop\system32.rar\instat1.exe        Win32.Packed.MaskPE        跳过，未处理       
病毒        2008-02-15  15:16:08        C:\Users\挪威的冬天\Desktop\system32.rar\zadnew.dll        Win32.Troj.OnlineGamesT.ty.90112        跳过，未处理       
病毒        2008-02-15  15:16:08        C:\Users\挪威的冬天\Desktop\system32.rar\xjxr.dll        Win32.Troj.OnlineGamesT.ty.90112        跳过，未处理       


MOP 也有样本区吗？

tttbbb2000

2008.1.17日病毒库的瑞星主防拦截了几个。

qianwenxiang

看MOP的BT帖子受不了了 所以就跑回来咯

hign

统计信息
已扫描:
文件: 20
未扫描: 0
结果:
病毒: 16
间谍软件: 0
可疑对象: 0
危险软件: 0
操作:
已杀毒: 0
已重命名: 0
删除: 0
已隔离: 0
失败: 0
引导区:
已扫描: 0
受感染: 0
可疑对象: 0
已杀毒: 0