19x生成物

啊弥陀佛

木马名称:Trojan-PSW.Win32.OLGames.jxv
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SYSTEM32\LYLOADER.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SYSTEM32\INSTAT1.EXE
是可疑程序!
试图修改系统时间!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SYSTEM32\DLLGH8JKD1Q2.EXE
木马程序生成以下文件:
1) C:\WINDOWS\XPUPDATE.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SYSTEM32\SERVER.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SYSTEM32\WIND32.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\WIND32.EXE
是否删除木马程序及其衍生物?

woai_jolin

Scan Log
Version of virus signature database: 2877 (20080215)
Date: 2008/2/15  Time: 15:38:33
Scanned disks, folders and files: G:\v\system32.rar
G:\v\system32.rar » RAR » xjxr.dll - Win32/PSW.OnLineGames.NLH trojan - was a part of the deleted object
G:\v\system32.rar » RAR » zadnew.dll - Win32/PSW.OnLineGames.NLH trojan - was a part of the deleted object
G:\v\system32.rar » RAR » msepion.sys - Win32/PSW.OnLineGames.NFC trojan - was a part of the deleted object
G:\v\system32.rar » RAR » ctfmona.exe - is OK
G:\v\system32.rar » RAR » dllgh8jkd1q1.exe - is OK
G:\v\system32.rar » RAR » dllgh8jkd1q2.exe - is OK
G:\v\system32.rar » RAR » instat1.exe » UPX v12_m2 - is OK
G:\v\system32.rar » RAR » LYLOADER.EXE - a variant of Win32/PSW.Agent.NEC trojan - was a part of the deleted object
G:\v\system32.rar » RAR » server.exe - is OK
G:\v\system32.rar » RAR » sstunst3.exe - is OK
G:\v\system32.rar » RAR » wind32.exe - is OK
G:\v\system32.rar » RAR » 2hvm3pv96m.dll - probably a variant of Win32/Genetik trojan - was a part of the deleted object
G:\v\system32.rar » RAR » auhad.dll - Win32/PSW.OnLineGames.NLH trojan - was a part of the deleted object
G:\v\system32.rar » RAR » fyom.dll - a variant of Win32/PSW.OnLineGames.NLH trojan - was a part of the deleted object
G:\v\system32.rar » RAR » kiluw.dll - a variant of Win32/PSW.OnLineGames.NLH trojan - was a part of the deleted object
G:\v\system32.rar » RAR » knaixnauhuoyizqq.dll - Win32/PSW.OnLineGames.NLH trojan - was a part of the deleted object
G:\v\system32.rar » RAR » LYMANGR.DLL - Win32/PSW.OnLineGames.DTR trojan - was a part of the deleted object
G:\v\system32.rar » RAR » MSDEG32.DLL - a variant of Win32/PSW.OnLineGames.DVV trojan - was a part of the deleted object
G:\v\system32.rar » RAR » vhqq.dll - a variant of Win32/PSW.OnLineGames.NLH trojan - was a part of the deleted object
Number of scanned objects: 20
Number of threats found: 12
Time of completion: 15:38:35  Total scanning time: 2 sec (00:00:02)

wangjay1980

Hello,

dllgh8jkd1q1.exe_ - Trojan.Win32.Qhost.agu,
dllgh8jkd1q2.exe_ - not-virus:Hoax.Win32.Renos.avz

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

sstunst3.exe_

No malicious code was found in this file.

Please quote all when answering.

--
Best regards, Yury Nesmachny
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: system32.rar

冷冷

IK
I:\virus\test\system32\2hvm3pv96m.dll - Signature 'Virus.Win32.Agent.JZN' found
I:\virus\test\system32\auhad.dll - Signature 'Trojan-PWS.Win32.Small.br' found
I:\virus\test\system32\ctfmona.exe - Signature 'Trojan.Peed' found
I:\virus\test\system32\dllgh8jkd1q1.exe - Suspect code-parts found (Level: 20)
I:\virus\test\system32\dllgh8jkd1q2.exe
I:\virus\test\system32\fyom.dll - Signature 'Trojan-PWS.Win32.Small.br' found
I:\virus\test\system32\instat1.exe - Signature 'Dialer' found
I:\virus\test\system32\kiluw.dll - Signature 'Trojan-PWS.Win32.Small.br' found
I:\virus\test\system32\knaixnauhuoyizqq.dll - Signature 'Trojan-PWS.Win32.Small.br' found
I:\virus\test\system32\LYLOADER.EXE - Signature 'Trojan-Downloader.Win32.Zlob.and' found
I:\virus\test\system32\LYMANGR.DLL - Signature 'Trojan-Dropper.Win32.Agent.ane' found
I:\virus\test\system32\MSDEG32.DLL - Signature 'Generic.PWS.Games.3' found
I:\virus\test\system32\msepion.sys - Signature 'Trojan.Win32.Agent.anj' found
I:\virus\test\system32\server.exe - Signature 'MalwareScope.Backdoor.Hupigon.17' found
I:\virus\test\system32\sstunst3.exe
I:\virus\test\system32\vhqq.dll - Signature 'Trojan-PWS.Win32.Small.br' found
I:\virus\test\system32\wind32.exe
I:\virus\test\system32\xjxr.dll - Signature 'Trojan-PWS.Win32.Small.br' found
I:\virus\test\system32\zadnew.dll - Signature 'Trojan-PWS.Win32.Small.br' found

        19 Files scanned
          (0 Archives with 0 files)
        15 Signatures found
        1 Suspect code-part found
        Used time: 0:00.547

28654621

D:\download\system32.rar>>xjxr.dll        Trojan.Gampass.cxvb.dll        木马        还未处理
D:\download\system32.rar>>zadnew.dll        TrojanPSW.GameOL.lvx.okqn.dll        木马        还未处理
D:\download\system32.rar>>instat1.exe        TrojanDownloader.Murlo.ju.drcl        木马        还未处理
D:\download\system32.rar>>LYLOADER.EXE        TrojanPSW.XYOnline.abe.hpav        木马        还未处理
D:\download\system32.rar>>server.exe        Backdoor.Agent.ebl.agzv        后门        还未处理
D:\download\system32.rar>>auhad.dll        TrojanPSW.XYOnline.aay.zizg.dll        木马        还未处理
D:\download\system32.rar>>fyom.dll        RootKit.GameHacktool.GEN.wslp.dll        木马        还未处理
D:\download\system32.rar>>kiluw.dll        TrojanPSW.GameOL.lvx.iwci.dll        木马        还未处理
D:\download\system32.rar>>knaixnauhuoyizqq.dll        TrojanPSW.OnLineGames.qos.sfgz.dll        木马        还未处理
D:\download\system32.rar>>LYMANGR.DLL        TrojanPSW.OnLineGames.pum.xnre.dll        木马        还未处理
D:\download\system32.rar>>vhqq.dll        PWSteal.OnlineGames.r.ynjh.dll        木马        还未处理

capsshift

21个中红伞报17个，难道有漏网的。

allinwonderi

[Scanning : C:\Test]


C:\Test\system32.rar<RAR>:xjxr.dll<UPack>:xjxr.dll<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Qxo : No action
C:\Test\system32.rar<RAR>:zadnew.dll<UPack>:zadnew.dll<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Qiv : No action
C:\Test\system32.rar<RAR>:zadnew.dll<UPack>:zadnew.dll<DLLRES>:res1.exe <- Trojan.Psw.Onlinegames.Qiv : No action
C:\Test\system32.rar<RAR>:LYLOADER.EXE <- Trojan.Psw.Onlinegames.Pvw : No action
C:\Test\system32.rar<RAR>:LYLOADER.EXE<UPack>:LYLOADER.EXE<DLLRES>:MSDEG32.DLL1.exe <- Trojan.Psw.Onlinegames.Pul : No action
C:\Test\system32.rar<RAR>:server.exe <- Trojan.Agent.Ebl : No action
C:\Test\system32.rar<RAR>:auhad.dll<UPack>:auhad.dll<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Pmi : No action
C:\Test\system32.rar<RAR>:auhad.dll<UPack>:auhad.dll<DLLRES>:res1.exe <- Trojan.Psw.Onlinegames.Pqq : No action
C:\Test\system32.rar<RAR>:auhad.dll<UPack>:auhad.dll<DLLRES>:res2.exe <- Trojan.Psw.Onlinegames.Pri : No action
C:\Test\system32.rar<RAR>:fyom.dll<UPack>:fyom.dll<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Qnq : No action
C:\Test\system32.rar<RAR>:fyom.dll<UPack>:fyom.dll<DLLRES>:res1.exe <- Trojan.Psw.Onlinegames.Qnr : No action
C:\Test\system32.rar<RAR>:kiluw.dll<UPack>:kiluw.dll<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Qnq : No action
C:\Test\system32.rar<RAR>:kiluw.dll<UPack>:kiluw.dll<DLLRES>:res1.exe <- Trojan.Psw.Onlinegames.Qnr : No action
C:\Test\system32.rar<RAR>:knaixnauhuoyizqq.dll <- Trojan.Psw.Onlinegames.Qos : No action
C:\Test\system32.rar<RAR>:knaixnauhuoyizqq.dll<UPack>:knaixnauhuoyizqq.dll<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Qoz : No action
C:\Test\system32.rar<RAR>:knaixnauhuoyizqq.dll<UPack>:knaixnauhuoyizqq.dll<DLLRES>:res1.exe <- Trojan.Psw.Onlinegames.Qoz : No action
C:\Test\system32.rar<RAR>:MSDEG32.DLL <- Trojan.Psw.Onlinegames.Pul : No action
C:\Test\system32.rar<RAR>:vhqq.dll<UPack>:vhqq.dll<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Qxo : No action



Scanned objects : 51

Infected objects : 18

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： RootKit.Win32.GameHack.geu
病毒： Trojan.PSW.Win32.OnlineGames.GEN
病毒： RootKit.Win32.GameHack.geu
病毒： Trojan.PSW.Win32.GameOL.lvx
病毒： Trojan.PSW.Win32.XYOnline.abe
病毒： Trojan.PSW.Win32.XYOnline.abe
病毒： Trojan.PSW.Win32.GameOL.b
病毒： RootKit.Win32.GameHack.GEN
病毒： Trojan.PSW.Win32.ZeroOnline.dg

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.31.30

ykz1991

原帖由 capsshift 于 2008-2-15 17:17 发表
21个中红伞报17个，难道有漏网的。

一共19样本，suspicious1个
还有一个
The file 'sstunst3.exe' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content. 

PS:antivir漏网挺常见吧

guohan1113

FSIS2008
扫描报告
2008年2月15日 21:18:18 - 21:18:21
计算机名称: HP-C135C4A8CD0B
扫描类型: 扫描目标
目标: C:\Documents and Settings\hp\桌面\system32.rar


--------------------------------------------------------------------------------

结果: 找到 16 恶意软件
Trojan-PSW.Win32.OnLineGames.qza (病毒)
C:\Documents and Settings\hp\桌面\system32.rar\xjxr.dll
Trojan-PSW.Win32.OnLineGames.qxw (病毒)
C:\Documents and Settings\hp\桌面\system32.rar\zadnew.dll
Trojan-PSW.Win32.OnLineGames.rbz (病毒)
C:\Documents and Settings\hp\桌面\system32.rar\msepion.sys
Trojan-Downloader.Win32.AntiVirPro.b (病毒)
C:\Documents and Settings\hp\桌面\system32.rar\ctfmona.exe
Trojan-Downloader.Win32.Murlo.ju (病毒)
C:\Documents and Settings\hp\桌面\system32.rar\instat1.exe
Trojan-PSW.Win32.OnLineGames.pvw (病毒)
C:\Documents and Settings\hp\桌面\system32.rar\LYLOADER.EXE
Backdoor.Win32.Agent.ebl (病毒)
C:\Documents and Settings\hp\桌面\system32.rar\server.exe
Packed.Win32.Tibs.ic (病毒)
C:\Documents and Settings\hp\桌面\system32.rar\wind32.exe
Trojan-Downloader.Win32.Hmir.acx (病毒)
C:\Documents and Settings\hp\桌面\system32.rar\2hvm3pv96m.dll
Trojan-PSW.Win32.OnLineGames.pue (病毒)
C:\Documents and Settings\hp\桌面\system32.rar\auhad.dll
Trojan-PSW.Win32.OnLineGames.rbx (病毒)
C:\Documents and Settings\hp\桌面\system32.rar\fyom.dll
Trojan-PSW.Win32.OnLineGames.rbw (病毒)
C:\Documents and Settings\hp\桌面\system32.rar\kiluw.dll
Trojan-PSW.Win32.OnLineGames.qos (病毒)
C:\Documents and Settings\hp\桌面\system32.rar\knaixnauhuoyizqq.dll
Trojan-PSW.Win32.OnLineGames.pum (病毒)
C:\Documents and Settings\hp\桌面\system32.rar\LYMANGR.DLL
Trojan-PSW.Win32.OnLineGames.pul (病毒)
C:\Documents and Settings\hp\桌面\system32.rar\MSDEG32.DLL
Trojan-PSW.Win32.OnLineGames.rby (病毒)
C:\Documents and Settings\hp\桌面\system32.rar\vhqq.dll




--------------------------------------------------------------------------------

统计信息
已扫描:
文件: 20
未扫描: 0
结果:
病毒: 16
间谍软件: 0
可疑项目: 0
危险软件: 0
操作:
已杀毒: 0
已重命名: 0
删除: 0
已隔离: 0
失败: 0
启动扇区:
已扫描: 0
受感染: 0
可疑项目: 0
已杀毒: 0


--------------------------------------------------------------------------------

选项
定义版本:
病毒: 2008-02-15_03
间谍软件: 2008-02-15_03
扫描引擎:
F-Secure AVP: 7.00.171, 2008-02-15
F-Secure Libra: 2.04.01, 2008-02-13
F-Secure Orion: 1.02.37, 2008-02-15
F-Secure Draco: 1.00.35, 2008-02-13
扫描选项:
扫描定义的文件: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML AVB BAT CEO CMD LSP MAP MHT MIF PHP POT WMF NWS TAR TGZ ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQX
扫描内部存档
排除:
对象: C:\Program Files\360safe\ F:\安装程序\安软\
操作:
病毒: 对受感染文件进行杀毒
间谍软件: 隔离和删除