今天发现的新病毒!很多杀软不报!

挪威的冬天

信息        2008-03-13  12:22:16        您此次查毒清除了1个病毒                       
信息        2008-03-13  12:22:16        您此次查毒共查出1个病毒以及危险代码                       
信息        2008-03-13  12:22:16        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件2个                       
信息        2008-03-13  12:22:16        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-03-13  12:22:16        D:\Desktop\explorer.rar\explorer.exe        Win32.Troj.DownloaderT.mi.15360        清除成功

sam.to

已刪除: 病毒 Worm.Win32.Downloader.fi        檔案: C:\Documents and Settings\kato9096\桌面\explorer.rar/explorer.exe
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Small.ivd        檔案: C:\Documents and Settings\kato9096\桌面\explorer.rar/explorer.exe//PE_Patch//UPack

Palkia

sam.to

原帖由 kiki 于 2008-3-13 12:13 发表
文件没报，生成物报了


[CONTROL]
VERSION=2008-2-3

[DOWN]
NEWVERSION=
1=http://www.52gol.com/xx/soc1.exe
2=http://www.52gol.com/xx/soc2.exe
3=http://www.52gol.com/xx/soc3.exe
4=http://www.5 ...

打包

已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.rwl        檔案: C:\Documents and Settings\kato9096\桌面\複製 -34r5tyuerdftghyjdfgh\soc10.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.rxps        檔案: C:\Documents and Settings\kato9096\桌面\複製 -34r5tyuerdftghyjdfgh\soc11.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.sem        檔案: C:\Documents and Settings\kato9096\桌面\複製 -34r5tyuerdftghyjdfgh\soc12.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.tct        檔案: C:\Documents and Settings\kato9096\桌面\複製 -34r5tyuerdftghyjdfgh\soc13.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.tct        檔案: C:\Documents and Settings\kato9096\桌面\複製 -34r5tyuerdftghyjdfgh\soc14.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.tmj        檔案: C:\Documents and Settings\kato9096\桌面\複製 -34r5tyuerdftghyjdfgh\soc15.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.rxps        檔案: C:\Documents and Settings\kato9096\桌面\複製 -34r5tyuerdftghyjdfgh\soc16.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.sem        檔案: C:\Documents and Settings\kato9096\桌面\複製 -34r5tyuerdftghyjdfgh\soc17.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.tzt        檔案: C:\Documents and Settings\kato9096\桌面\複製 -34r5tyuerdftghyjdfgh\soc18.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.tmj        檔案: C:\Documents and Settings\kato9096\桌面\複製 -34r5tyuerdftghyjdfgh\soc19.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.tmj        檔案: C:\Documents and Settings\kato9096\桌面\複製 -34r5tyuerdftghyjdfgh\soc20.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.rkf        檔案: C:\Documents and Settings\kato9096\桌面\217410-2\34r5tyuerdftghyjdfgh\34r5tyuerdftghyjdfgh.rar/soc9.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ryh        檔案: C:\Documents and Settings\kato9096\桌面\217410-2\34r5tyuerdftghyjdfgh\34r5tyuerdftghyjdfgh.rar/soc1.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.teb        檔案: C:\Documents and Settings\kato9096\桌面\217410-2\34r5tyuerdftghyjdfgh\34r5tyuerdftghyjdfgh.rar/soc5.exe//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.tzz        檔案: C:\Documents and Settings\kato9096\桌面\217410-2\34r5tyuerdftghyjdfgh\34r5tyuerdftghyjdfgh.rar/soc6.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.szv        檔案: C:\Documents and Settings\kato9096\桌面\217410-2\34r5tyuerdftghyjdfgh\34r5tyuerdftghyjdfgh.rar/soc7.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.soa        檔案: C:\Documents and Settings\kato9096\桌面\217410-2\34r5tyuerdftghyjdfgh\34r5tyuerdftghyjdfgh.rar/soc8.exe//PE_Patch//UPack


不报的上报卡巴

Hello,

soc2.exe_ - Trojan-PSW.Win32.OnLineGames.uch

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

soc3.exe_ - Trojan-PSW.Win32.OnLineGames.tzx,
soc4.exe_ - Trojan-PSW.Win32.OnLineGames.tcr

These files are already detected. Please update your antivirus bases.

Please quote all when answering.

--
Best regards, Namestnikov Yury
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-3-13 15:49 编辑 ]

HC303

Starting the file scan:

Begin scan in 'E:\virus test\25.rar'
E:\virus test\25.rar
  [0] Archive type: RAR
  --> 34r5tyuerdftghyjdfgh\soc1.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.djg.2
  --> 34r5tyuerdftghyjdfgh\soc10.exe
      [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
  --> 34r5tyuerdftghyjdfgh\soc11.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.olm.2
  --> 34r5tyuerdftghyjdfgh\soc12.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLin.8918.A
  --> 34r5tyuerdftghyjdfgh\soc13.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 34r5tyuerdftghyjdfgh\soc14.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.tds
  --> 34r5tyuerdftghyjdfgh\soc15.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
  --> 34r5tyuerdftghyjdfgh\soc16.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.rxqe
  --> 34r5tyuerdftghyjdfgh\soc17.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.sqb
  --> 34r5tyuerdftghyjdfgh\soc18.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 34r5tyuerdftghyjdfgh\soc19.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 34r5tyuerdftghyjdfgh\soc2.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 34r5tyuerdftghyjdfgh\soc20.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> 34r5tyuerdftghyjdfgh\soc21.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 34r5tyuerdftghyjdfgh\soc22.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 34r5tyuerdftghyjdfgh\soc23.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 34r5tyuerdftghyjdfgh\soc24.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 34r5tyuerdftghyjdfgh\soc25.exe
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
  --> 34r5tyuerdftghyjdfgh\soc3.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> 34r5tyuerdftghyjdfgh\soc4.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.tcq.4
  --> 34r5tyuerdftghyjdfgh\soc5.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.TJR.9
  --> 34r5tyuerdftghyjdfgh\soc6.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 34r5tyuerdftghyjdfgh\soc7.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.szv
  --> 34r5tyuerdftghyjdfgh\soc8.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.soa.11
  --> 34r5tyuerdftghyjdfgh\soc9.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGame.XO
      [WARNING]   The file was ignored!


End of the scan: 2008年3月13日  13:19
Used time: 00:16 min

The scan has been done completely.

      0 Scanning directories
     27 Files were scanned
     20 viruses and/or unwanted programs were found
      5 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      7 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes
启发的报红伞。

白玉箫

大哥 玩笑开大了
国产的都能杀了

qigang

rising20.35.31未杀！

qigang

13/6


瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.QQSG.cz
病毒： Trojan.DL.Win32.Mnless.zan

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.35.31

qigang

58/20

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GamesOnline.oe
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.GameOL.mks
病毒： Trojan.PSW.Win32.GameOL.mjq
病毒： Trojan.PSW.Win32.GameOL.mhi
病毒： Trojan.PSW.Win32.SunOnline.mu
病毒： Trojan.PSW.Win32.GameOL.mjf
病毒： Trojan.PSW.Win32.GameOL.min
病毒： Trojan.PSW.Win32.GamesOnline.oz
病毒： Trojan.PSW.Win32.OnlineGames.eop
病毒： Trojan.PSW.Win32.QQSG.cz

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.35.31

红心王子

木马名称:Trojan-PSW.Win32.OnLineGame.ixs

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\BINGDU\AVPSRV.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OnLineGame.rpy

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\新建文件夹\BINGDU\ATISRV.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?