14个

qianwenxiang

信息来源：瑞星病毒预警

3、被注入IE进程的代码调用URLDownloadToFileA下载http://xxx.vg/ss.exe为本地c:\temp.exe。

猜都能猜到是http://w18.vg/ss.exe

病毒会下载如下文件：http://wellbate.com/1.exe ，http://wellbate.com/2.exe 等文件保存在系统system32目录下。

1~13.exe均有效..

wangjay1980

detected: Trojan program Trojan-PSW.Win32.Lmir.bpv        File: C:\Documents and Settings\Owner\×ÀÃæ\0310.rar/11.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.Delf.aqk        File: C:\Documents and Settings\Owner\×ÀÃæ\0310.rar/ss.exe//PE_Patch.UPX//UPX
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rkf        File: C:\Documents and Settings\Owner\×ÀÃæ\0310.rar/1.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.tea        File: C:\Documents and Settings\Owner\×ÀÃæ\0310.rar/2.exe//UPack
detected: Trojan program Trojan.Win32.Vaklik.qu        File: C:\Documents and Settings\Owner\×ÀÃæ\0310.rar/3.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.tmo        File: C:\Documents and Settings\Owner\×ÀÃæ\0310.rar/4.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.tgb        File: C:\Documents and Settings\Owner\×ÀÃæ\0310.rar/5.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.qpa        File: C:\Documents and Settings\Owner\×ÀÃæ\0310.rar/6.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.sem        File: C:\Documents and Settings\Owner\×ÀÃæ\0310.rar/7.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rxps        File: C:\Documents and Settings\Owner\×ÀÃæ\0310.rar/8.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.tde        File: C:\Documents and Settings\Owner\×ÀÃæ\0310.rar/9.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.tde        File: C:\Documents and Settings\Owner\×ÀÃæ\0310.rar/10.exe//PE_Patch//UPack

1 TO KL

[ 本帖最后由 wangjay1980 于 2008-3-10 21:57 编辑 ]

无尽藏海

Begin scan in 'E:\VIRUS\0310.rar'
E:\VIRUS\0310.rar
  [0] Archive type: RAR
  --> 11.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> ss.exe
      [DETECTION] Is the Trojan horse TR/Autorun.BK
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.XO
  --> 2.exe
      [DETECTION] Is the Trojan horse TR/Onlinegames.rxt
  --> 3.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 4.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 5.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 6.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.qsq.2
  --> 7.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.sem.5
  --> 8.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.olm.2
  --> 9.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 10.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!


End of the scan: 2008年3月10日  21:57
Used time: 00:11 min

The scan has been done completely.

      0 Scanning directories
     15 Files were scanned
     10 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      5 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

无尽藏海

Scan Log
Version of virus signature database: 2934 (20080310)
Date: 2008-3-10  Time: 21:58:40
Scanned disks, folders and files: E:\VIRUS\0310.rar
E:\VIRUS\0310.rar » RAR » 11.exe - probably a variant of Win32/PSW.WOW.WU trojan
E:\VIRUS\0310.rar » RAR » 12.exe - Win32/TrojanDownloader.Delf.EAZ trojan
E:\VIRUS\0310.rar » RAR » 13.exe - Win32/TrojanDownloader.Delf.EAZ trojan
E:\VIRUS\0310.rar » RAR » ss.exe - Win32/PSW.OnLineGames.NBR trojan
E:\VIRUS\0310.rar » RAR » 1.exe - a variant of Win32/PSW.OnLineGames.GJV trojan
E:\VIRUS\0310.rar » RAR » 2.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
E:\VIRUS\0310.rar » RAR » 3.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
E:\VIRUS\0310.rar » RAR » 4.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
E:\VIRUS\0310.rar » RAR » 5.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
E:\VIRUS\0310.rar » RAR » 6.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
E:\VIRUS\0310.rar » RAR » 7.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
E:\VIRUS\0310.rar » RAR » 8.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
E:\VIRUS\0310.rar » RAR » 9.exe - probably a variant of Win32/PSW.OnLineGames.NMQ trojan
E:\VIRUS\0310.rar » RAR » 10.exe - probably a variant of Win32/PSW.OnLineGames.NMQ trojan
Number of scanned objects: 14
Number of threats found: 14
Time of completion: 21:58:43  Total scanning time: 3 sec (00:00:03)

挪威的冬天

信息        2008-03-10  22:01:20        您此次查毒清除了12个病毒                       
信息        2008-03-10  22:01:20        您此次查毒共查出12个病毒以及危险代码                       
信息        2008-03-10  22:01:20        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件26个                       
信息        2008-03-10  22:01:20        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-03-10  22:01:19        D:\Desktop\0310.rar\8.exe        Win32.Troj.OnlineGamesT.zy.32923        清除成功       
病毒        2008-03-10  22:01:19        D:\Desktop\0310.rar\7.exe        Win32.PSWTroj.OnLineGames.13953        清除成功       
病毒        2008-03-10  22:01:19        D:\Desktop\0310.rar\6.exe        Win32.Troj.OnlineGamesT.ty.98304        清除成功       
病毒        2008-03-10  22:01:19        D:\Desktop\0310.rar\5.exe        Win32.Troj.OnlineGamesT.e.94315        清除成功       
病毒        2008-03-10  22:01:19        D:\Desktop\0310.rar\4.exe        Win32.Troj.OnlineGamesT.ty.98304        清除成功       
病毒        2008-03-10  22:01:19        D:\Desktop\0310.rar\3.exe        Win32.Troj.OnlineGamesT.ty.98304        清除成功       
病毒        2008-03-10  22:01:19        D:\Desktop\0310.rar\2.exe        Win32.Troj.OnlineGamesT.ty.98304        清除成功       
病毒        2008-03-10  22:01:19        D:\Desktop\0310.rar\1.exe        Win32.Troj.OnLineGamesT.b.20198        清除成功       
病毒        2008-03-10  22:01:19        D:\Desktop\0310.rar\ss.exe        Win32.PSWTroj.Win32.63011        清除成功       
病毒        2008-03-10  22:01:19        D:\Desktop\0310.rar\13.exe        Win32.TrojDownloader.Delf.19456        清除成功       
病毒        2008-03-10  22:01:19        D:\Desktop\0310.rar\12.exe        Win32.TrojDownloader.Delf.19456        清除成功       
病毒        2008-03-10  22:01:19        D:\Desktop\0310.rar\11.exe        Win32.Troj.LmirT.by.9900        清除成功

Kakura

C:\Documents and Settings\Elvis\桌面\0310.rar > RAR > 11.exe - 可能是 Win32/PSW.WOW.WU 特洛伊木马 的变种
C:\Documents and Settings\Elvis\桌面\0310.rar > RAR > 12.exe - Win32/TrojanDownloader.Delf.EAZ 特洛伊木马
C:\Documents and Settings\Elvis\桌面\0310.rar > RAR > 13.exe - Win32/TrojanDownloader.Delf.EAZ 特洛伊木马
C:\Documents and Settings\Elvis\桌面\0310.rar > RAR > ss.exe - Win32/PSW.OnLineGames.NBR 特洛伊木马
C:\Documents and Settings\Elvis\桌面\0310.rar > RAR > 1.exe - Win32/PSW.OnLineGames.GJV 特洛伊木马 的变种
C:\Documents and Settings\Elvis\桌面\0310.rar > RAR > 2.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
C:\Documents and Settings\Elvis\桌面\0310.rar > RAR > 3.exe - Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
C:\Documents and Settings\Elvis\桌面\0310.rar > RAR > 4.exe - Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
C:\Documents and Settings\Elvis\桌面\0310.rar > RAR > 5.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
C:\Documents and Settings\Elvis\桌面\0310.rar > RAR > 6.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种
C:\Documents and Settings\Elvis\桌面\0310.rar > RAR > 7.exe - Win32/PSW.OnLineGames.MUG 特洛伊木马 的变种
C:\Documents and Settings\Elvis\桌面\0310.rar > RAR > 8.exe - Win32/PSW.OnLineGames.MUG 特洛伊木马 的变种
C:\Documents and Settings\Elvis\桌面\0310.rar > RAR > 9.exe - 可能是 Win32/PSW.OnLineGames.NMQ 特洛伊木马 的变种
C:\Documents and Settings\Elvis\桌面\0310.rar > RAR > 10.exe - 可能是 Win32/PSW.OnLineGames.NMQ 特洛伊木马 的变种

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GamesOnline.fz
病毒： Trojan.PSW.Win32.GameOL.lzn
病毒： Trojan.PSW.Win32.SunOnline.ma
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.QQGame.GEN
病毒： Trojan.PSW.Win32.GamesOnline.pp
病毒： Trojan.PSW.Win32.GameOL.min
病毒： RootKit.Win32.Mnless.ji  
病毒： RootKit.Win32.Mnless.ji  
病毒： Trojan.PSW.Win32.GamesOnline.qc

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.35.02

红心王子

木马名称:Trojan-PSW.Win32.Delf.gml

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\SS.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OLGames.kti

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\6.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

cake

趋势发现8个直接删除了

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\0310.rar'
C:\Documents and Settings\Administrator\My Documents\
  0310.rar
    [0] Archive type: RAR
      --> 11.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 12.exe
        [1] Archive type: Runtime Packed
        --> Object
      --> 13.exe
        [1] Archive type: Runtime Packed
        --> Object
      --> ss.exe
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Is the Trojan horse TR/Autorun.BK
            [WARNING]   Infected files in archives cannot be repaired!
    --> 1.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.XO
      --> 2.exe
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Is the Trojan horse TR/Onlinegames.rxt
            [WARNING]   Infected files in archives cannot be repaired!
      --> 3.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 4.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 5.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
      --> 6.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.qsq.2
              [WARNING]   Infected files in archives cannot be repaired!
    --> 7.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.sem.5
      --> 8.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: RSRC
          --> Object
            [3] Archive type: Runtime Packed
            --> Object
                [DETECTION] Is the Trojan horse TR/PSW.Online.olm.2
                [WARNING]   Infected files in archives cannot be repaired!
    --> 9.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.TDE.1
    --> 10.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.TDE.14
      [WARNING]   The file was ignored!
  0310.rar:Zone.Identifier


End of the scan: 2008年3月10日  11:34
Used time: 00:04 min

The scan has been done completely.

      0 Scanning directories
     16 Files were scanned
     12 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      1 Archives were scanned
      5 Warnings
      0 Notes