还有一小包

zzh161

没注意，又发现个下载地址

样本：

hshhua01

Begin scan in 'D:\BOOK\11.rar'
D:\BOOK\11.rar
  [0] Archive type: RAR
  --> 11\avp.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> 11\QQ2007.gif
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.sns
  --> 11\right_h3_game_cq[1].gif
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 11\right_h3_game_cs[1].gif
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 11\right_h3_game_dh2[1].gif
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 11\right_h3_game_dh3[1].gif
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 11\right_h3_game_hx[1].gif
      [DETECTION] Is the Trojan horse TR/BHO.aya.1
  --> 11\right_h3_game_mh[1].gif
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 11\right_h3_game_ms[1].gif
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 11\right_h3_game_my[1].gif
      [DETECTION] Contains suspicious code HEUR/Crypted.E
  --> 11\right_h3_game_pt[1].gif
      [DETECTION] Is the Trojan horse TR/Drop.Agent.12291
  --> 11\right_h3_game_qqhx[1].gif
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 11\right_h3_game_wd[1].gif
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 11\right_h3_game_wl[1].gif
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 11\right_h3_game_wm[1].gif
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.XO
  --> 11\right_h3_game_zt[1].gif
      [DETECTION] Is the Trojan horse TR/Onlinegames.rxt
  --> 11\right_h3_game_zx[1].gif
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 11\right_h3_game_zyhx[1].gif
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!


End of the scan: 2008年3月3日星期一  09:39
Used time: 00:09 min

The scan has been done completely.

      0 Scanning directories
     19 Files were scanned
     14 viruses and/or unwanted programs were found
      4 Files were classified as suspicious:

wangjay1980

哈哈，早

hign

18

啊弥陀佛

木马名称:Trojan-PSW.Win32.OLGames.pcz
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\11\11\RIGHT_H3_GAME_CS[1].GIF
是木马程序!
已成功阻止其运行,是否要删除此文件?


程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\11\11\QQ2007.GIF.EXE
木马程序生成以下文件:
1) C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\WINSYS8V.SYS
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\11\11\RIGHT_H3_GAME_CQ[1].GIF.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\OQNAUHC.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\11\11\RIGHT_H3_GAME_DH2[1].GIF.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\CUHAD.DLL
2) C:\WINDOWS\SYSTEM32\MSEION.SYS
3) C:\WINDOWS\SYSTEM32\DRIVERS\MSELK.SYS
是否删除木马程序及其衍生物?

fpx_123

没过我的杀软

傻猪猪米走鸡

esetkill！

傻猪猪米走鸡

Scan Log
Version of virus signature database: 2915 (20080303)
Date: 2008-3-3  Time: 10:23:29
Scanned disks, folders and files: D:\firefox download\11(2).rar
D:\firefox download\11(2).rar » RAR » 11\avp.exe - a variant of Win32/Mypis virus
D:\firefox download\11(2).rar » RAR » 11\QQ2007.gif - probably a variant of Win32/AutoRun.Q worm
D:\firefox download\11(2).rar » RAR » 11\right_h3_game_cq[1].gif - a variant of Win32/PSW.OnLineGames.MUG trojan
D:\firefox download\11(2).rar » RAR » 11\right_h3_game_cs[1].gif - Win32/PSW.OnLineGames.MUG trojan
D:\firefox download\11(2).rar » RAR » 11\right_h3_game_dh2[1].gif - Win32/PSW.OnLineGames.MUG trojan
D:\firefox download\11(2).rar » RAR » 11\right_h3_game_dh3[1].gif - a variant of Win32/PSW.OnLineGames.NFL trojan
D:\firefox download\11(2).rar » RAR » 11\right_h3_game_hx[1].gif - Win32/PSW.OnLineGames.NML trojan
D:\firefox download\11(2).rar » RAR » 11\right_h3_game_mh[1].gif - probably a variant of Win32/Genetik trojan
D:\firefox download\11(2).rar » RAR » 11\right_h3_game_ms[1].gif - a variant of Win32/PSW.OnLineGames.GJV trojan
D:\firefox download\11(2).rar » RAR » 11\right_h3_game_my[1].gif - a variant of Win32/PSW.OnLineGames.MUG trojan
D:\firefox download\11(2).rar » RAR » 11\right_h3_game_pt[1].gif - a variant of Win32/PSW.OnLineGames.PBQ trojan
D:\firefox download\11(2).rar » RAR » 11\right_h3_game_qqhx[1].gif - a variant of Win32/PSW.OnLineGames.NML trojan
D:\firefox download\11(2).rar » RAR » 11\right_h3_game_wd[1].gif - a variant of Win32/PSW.OnLineGames.MUG trojan
D:\firefox download\11(2).rar » RAR » 11\right_h3_game_wl[1].gif - a variant of Win32/PSW.OnLineGames.MUG trojan
D:\firefox download\11(2).rar » RAR » 11\right_h3_game_wm[1].gif - a variant of Win32/PSW.OnLineGames.GJV trojan
D:\firefox download\11(2).rar » RAR » 11\right_h3_game_zt[1].gif - probably a variant of Win32/PSW.OnLineGames.NFL trojan
D:\firefox download\11(2).rar » RAR » 11\right_h3_game_zx[1].gif - a variant of Win32/PSW.OnLineGames.MUG trojan
D:\firefox download\11(2).rar » RAR » 11\right_h3_game_zyhx[1].gif - a variant of Win32/PSW.OnLineGames.NML trojan
Number of scanned objects: 18
Number of threats found: 18
Time of completion: 10:24:00  Total scanning time: 31 sec (00:00:31)

kkgh

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.QQPass.zee
病毒： Trojan.PSW.Win32.GamesOnline.oz
病毒： Trojan.PSW.Win32.XYOnline.abt
病毒： Trojan.PSW.Win32.XYOnline.aay
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.GameOL.mcy
病毒： Trojan.PSW.Win32.GamesOnline.ph
病毒： Trojan.PSW.Win32.GameOL.lxg
病毒： Trojan.PSW.Win32.GameOL.mcx
病毒： Trojan.PSW.Win32.GamesOnline.pc

用户来源：互联网

软件版本：20.33.62
16个
mcafee14个

hahacomcn

Begin scan in 'C:\Documents and Settings\haha\桌面\11.rar'
C:\Documents and Settings\haha\桌面\11.rar
  [0] Archive type: RAR
  --> 11\avp.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
    --> 11\QQ2007.gif
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.sns
  --> 11\right_h3_game_hx[1].gif
      [DETECTION] Is the Trojan horse TR/BHO.aya.1
  --> 11\right_h3_game_my[1].gif
      [DETECTION] Contains suspicious code HEUR/Crypted.E
  --> 11\right_h3_game_pt[1].gif
      [DETECTION] Is the Trojan horse TR/Drop.Agent.12291
    --> 11\right_h3_game_qqhx[1].gif
          [DETECTION] Contains suspicious code HEUR/Malware
  --> 11\right_h3_game_wm[1].gif
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.XO
    --> 11\right_h3_game_zt[1].gif
          [DETECTION] Is the Trojan horse TR/Onlinegames.rxt
    --> 11\right_h3_game_zyhx[1].gif
          [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      A backup was created as '47f97b00.qua'  ( QUARANTINE )


End of the scan: 2008年3月3日  12:13
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
     19 Files were scanned
     14 viruses and/or unwanted programs were found
      5 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      5 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes