机器狗新变种

小白鼠

机器狗新变种。。。新手误玩

llgiggs

红伞C漏三个，上报


C:\Documents and Settings\Administrator\桌面\dog\AtiSrv.exe
      [DETECTION] Contains detection pattern of the rootkit RKIT/HideProcess.B
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\dog\AuToRUN.Inf
      [DETECTION] Contains detection pattern of the worm WORM/Autorun.HW
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\dog\DbgHlp32.dlL
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.TJR.6
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\dog\DbgHlp32.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.TJR.6
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\dog\Kvsc3.dll
      [DETECTION] Is the Trojan horse TR/Vaklik.PD.3
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\dog\Kvsc3.exE
      [DETECTION] Is the Trojan horse TR/Vaklik.PD.3
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\dog\Ns_Sys55.Sys
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '483655d8.qua'!
C:\Documents and Settings\Administrator\桌面\dog\cmdbcs.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.spf.1
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\dog\cmdbcs.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.spf.1
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\dog\iemnaw.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Small.ivi
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\dog\msccrt.exe
      [DETECTION] Is the Trojan horse TR/PSW.33792.23
      [INFO]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\dog\soS.Exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!


The scan has been done completely.
      1 Scanning directories
     15 Files were scanned
     11 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
     11 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes

ztly159

刚下完就被趋势2008隔离了

傻猪猪米走鸡

2008-3-12 12:07:29        Real-time file system protection        file        D:\firefox download\机器狗新变种\Kvsc3.dll        probably a variant of Win32/PSW.OnLineGames.HCV trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 12:07:22        Real-time file system protection        file        D:\firefox download\机器狗新变种\DbgHlp32.dlL        probably a variant of Win32/PSW.OnLineGames.HCV trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 12:07:12        Real-time file system protection        file        D:\firefox download\机器狗新变种\cmdbcs.dll        Win32/PSW.OnLineGames.HCV trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 12:07:05        Real-time file system protection        file        D:\firefox download\机器狗新变种\soS.Exe        probably unknown NewHeur_PE virus        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 12:06:59        Real-time file system protection        file        D:\firefox download\机器狗新变种\msccrt.exe        probably a variant of Win32/PSW.OnLineGames.NFL trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 12:06:45        Real-time file system protection        file        D:\firefox download\机器狗新变种\Kvsc3.exE        a variant of Win32/PSW.OnLineGames.NFL trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 12:06:32        Real-time file system protection        file        D:\firefox download\机器狗新变种\DbgHlp32.exe        a variant of Win32/PSW.OnLineGames.NFL trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 12:06:14        Real-time file system protection        file        D:\firefox download\机器狗新变种\cmdbcs.exe        a variant of Win32/PSW.OnLineGames.YA trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 12:05:48        Real-time file system protection        file        D:\firefox download\机器狗新变种\AtiSrv.exe        Win32/TrojanDownloader.Agent.NWB trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 12:05:31        Real-time file system protection        file        D:\firefox download\机器狗新变种\Ns_Sys55.Sys        a variant of Win32/PSW.QQPass.NCZ trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 12:05:15        Real-time file system protection        file        D:\firefox download\机器狗新变种\AuToRUN.Inf        Win32/AutoRun.FK worm        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.

clc78223

这个病毒在我弄过的电脑中，一个星期内看到3次了，会自动结束杀毒软件进程。

挪威的冬天

病毒        2008-03-12  12:49:58        病毒在文件D:\Desktop\机器狗新变种\Kvsc3.dll中        Win32.Troj.OnlineGameT.136192        处理成功（操作：删除）       
病毒        2008-03-12  12:49:58        病毒在文件D:\Desktop\机器狗新变种\DbgHlp32.dlL中        Win32.Troj.OnlineGameT.33792        处理成功（操作：删除）       
病毒        2008-03-12  12:49:58        病毒在文件D:\Desktop\机器狗新变种\cmdbcs.dll中        Win32.Troj.OnlineGamesT.ty.30720        处理成功（操作：删除）       
病毒        2008-03-12  12:49:58        病毒在文件D:\Desktop\机器狗新变种\soS.Exe中        Win32.TrojDownloader.Agent.57856        处理成功（操作：删除）       
病毒        2008-03-12  12:49:58        病毒在文件D:\Desktop\机器狗新变种\msccrt.exe中        Win32.Troj.OnlineGamesT.e.94315        处理成功（操作：删除）       
病毒        2008-03-12  12:49:58        病毒在文件D:\Desktop\机器狗新变种\Kvsc3.exE中        Win32.Troj.OnlineGamesT.ty.98304        处理成功（操作：删除）       
病毒        2008-03-12  12:49:57        病毒在文件D:\Desktop\机器狗新变种\DbgHlp32.exe中        Win32.Troj.OnlineGamesT.e.94315        处理成功（操作：删除）       
病毒        2008-03-12  12:49:57        病毒在文件D:\Desktop\机器狗新变种\cmdbcs.exe中        Win32.Troj.OnlineGamesT.ty.98304        处理成功（操作：删除）       
病毒        2008-03-12  12:49:57        病毒在文件D:\Desktop\机器狗新变种\AtiSrv.exe中        Win32.Troj.OnlineGameT.a.90112        处理成功（操作：删除）       
病毒        2008-03-12  12:49:56        病毒在文件D:\Desktop\机器狗新变种\AuToRUN.Inf中        BAT.AutoRun.ed.74        处理成功（操作：删除）

jick117

杀了12个:

tanlimo

2008-3-12 13:02:56        文件系统实时防护        文件        D:\Documents and Settings\xx\桌面\机器狗新变种[1]\Kvsc3.dll        可能是 Win32/PSW.OnLineGames.HCV 特洛伊木马 的变种        通过删除清除 - 已隔离        NT AUTHORITY\SYSTEM        在应用程序新建的文件上发生事件: E:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 13:02:52        文件系统实时防护        文件        D:\Documents and Settings\xx\桌面\机器狗新变种[1]\DbgHlp32.dlL        可能是 Win32/PSW.OnLineGames.HCV 特洛伊木马 的变种        通过删除清除 - 已隔离        NT AUTHORITY\SYSTEM        在应用程序新建的文件上发生事件: E:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 13:02:48        文件系统实时防护        文件        D:\Documents and Settings\xx\桌面\机器狗新变种[1]\cmdbcs.dll        Win32/PSW.OnLineGames.HCV 特洛伊木马        通过删除清除 - 已隔离        NT AUTHORITY\SYSTEM        在应用程序新建的文件上发生事件: E:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 13:02:44        文件系统实时防护        文件        D:\Documents and Settings\xx\桌面\机器狗新变种[1]\soS.Exe        未查明的 NewHeur_PE 病毒        通过删除清除 - 已隔离        NT AUTHORITY\SYSTEM        在应用程序新建的文件上发生事件: E:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 13:02:42        文件系统实时防护        文件        D:\Documents and Settings\xx\桌面\机器狗新变种[1]\msccrt.exe        可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种        通过删除清除 - 已隔离        NT AUTHORITY\SYSTEM        在应用程序新建的文件上发生事件: E:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 13:02:38        文件系统实时防护        文件        D:\Documents and Settings\xx\桌面\机器狗新变种[1]\Kvsc3.exE        Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种        通过删除清除 - 已隔离        NT AUTHORITY\SYSTEM        在应用程序新建的文件上发生事件: E:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 13:02:34        文件系统实时防护        文件        D:\Documents and Settings\xx\桌面\机器狗新变种[1]\DbgHlp32.exe        Win32/PSW.OnLineGames.NFL 特洛伊木马 的变种        通过删除清除 - 已隔离        NT AUTHORITY\SYSTEM        在应用程序新建的文件上发生事件: E:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 13:02:30        文件系统实时防护        文件        D:\Documents and Settings\xx\桌面\机器狗新变种[1]\cmdbcs.exe        Win32/PSW.OnLineGames.YA 特洛伊木马 的变种        通过删除清除 - 已隔离        NT AUTHORITY\SYSTEM        在应用程序新建的文件上发生事件: E:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 13:02:25        文件系统实时防护        文件        D:\Documents and Settings\xx\桌面\机器狗新变种[1]\AtiSrv.exe        Win32/TrojanDownloader.Agent.NWB 特洛伊木马        通过删除清除 - 已隔离        NT AUTHORITY\SYSTEM        在应用程序新建的文件上发生事件: E:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 13:02:22        文件系统实时防护        文件        D:\Documents and Settings\xx\桌面\机器狗新变种[1]\Ns_Sys55.Sys        Win32/PSW.QQPass.NCZ 特洛伊木马 的变种        通过删除清除 - 已隔离        NT AUTHORITY\SYSTEM        在应用程序新建的文件上发生事件: E:\Program Files\WinRAR\WinRAR.exe.
2008-3-12 13:02:19        文件系统实时防护        文件        D:\Documents and Settings\xx\桌面\机器狗新变种[1]\AuToRUN.Inf        Win32/AutoRun.FK 蠕虫        通过删除清除 - 已隔离        NT AUTHORITY\SYSTEM        在应用程序新建的文件上发生事件: E:\Program Files\WinRAR\WinRAR.exe.

无尽藏海

E:\VIRUS\机器狗新变种\AtiSrv.exe        TrojanPSW.OnLineGames.sbg.clyo        木马        还未处理
E:\VIRUS\机器狗新变种\AuToRUN.Inf        INF.Autorun.d        病毒        还未处理
E:\VIRUS\机器狗新变种\cmdbcs.dll        TrojanPSW.GameOL.mfb.mxnv.dll        木马        还未处理
E:\VIRUS\机器狗新变种\cmdbcs.exe        W32.Viking.k        病毒        还未处理
E:\VIRUS\机器狗新变种\DbgHlp32.dlL        TrojanPSW.OnLineGames.tjr.gifj.dll        木马        还未处理
E:\VIRUS\机器狗新变种\DbgHlp32.exe        W32.Viking.k        病毒        还未处理
E:\VIRUS\机器狗新变种\Kvsc3.dll        Trojan.Vaklik.pd.nsac.dll        木马        还未处理
E:\VIRUS\机器狗新变种\Kvsc3.exE        W32.Viking.k        病毒        还未处理
E:\VIRUS\机器狗新变种\msccrt.exe        W32.Viking.k        病毒        还未处理
E:\VIRUS\机器狗新变种\soS.Exe        TrojanDownloader.Delf.hlx.fyui        木马        还未处理

sam.to

已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.sbg        檔案: C:\Documents and Settings\kato9096\桌面\216951\AtiSrv.exe//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.hw        檔案: C:\Documents and Settings\kato9096\桌面\216951\AuToRUN.Inf
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.spf        檔案: C:\Documents and Settings\kato9096\桌面\216951\cmdbcs.dll
已刪除: 特洛伊木馬程式 Trojan.Win32.Vaklik.nz        檔案: C:\Documents and Settings\kato9096\桌面\216951\cmdbcs.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.tjr        檔案: C:\Documents and Settings\kato9096\桌面\216951\DbgHlp32.dlL
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.teb        檔案: C:\Documents and Settings\kato9096\桌面\216951\DbgHlp32.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Small.ivi        檔案: C:\Documents and Settings\kato9096\桌面\216951\iemnaw.dll
已刪除: 特洛伊木馬程式 Trojan.Win32.Vaklik.pd        檔案: C:\Documents and Settings\kato9096\桌面\216951\Kvsc3.dll
已刪除: 特洛伊木馬程式 Trojan.Win32.Vaklik.pd        檔案: C:\Documents and Settings\kato9096\桌面\216951\Kvsc3.exE//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.tyf        檔案: C:\Documents and Settings\kato9096\桌面\216951\msccrt.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.kvr        檔案: C:\Documents and Settings\kato9096\桌面\216951\soS.Exe

11，上报４