机器狗+下载马

小白鼠

机器狗+下载马

The EQs

C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\11.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\12.exe - Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\13.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\14.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\15.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\7.exe - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\cmdbcs.dll - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\cmdbcs.exe - a variant of Win32/PSW.OnLineGames.YA trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\cuhad.dll - Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\DbgHlp32.dlL - probably a variant of Win32/PSW.OnLineGames.HCV trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\DbgHlp32.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\fobwdmjb.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\fyom.dll - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\gnolnait.dll - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\HHHCompress.dll - a variant of Win32/PSW.OnLineGames.GJV trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\hjiq.dll - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\iemnaw.dll - Win32/TrojanDownloader.Small.IVI trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\ijougiemnaw.dll - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\kehbxmmm.dll - a variant of Win32/PSW.OnLineGames.HCV trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\kiluw.dll - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\laixuhz.dll - Win32/PSW.OnLineGames.NLH trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\LotusHlp.dll - a variant of Win32/PSW.OnLineGames.HCV trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\LotusHlp.exe - a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\mseion.sys - Win32/PSW.OnLineGames.NFC trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\PTSShell.dll - a variant of Win32/PSW.OnLineGames.HCV trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\PTSShell.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\sve.dll - Win32/PSW.OnLineGames.NHF trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\sygoxelwow.dll - Win32/PSW.OnLineGames.GJV trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\taijoad.dll - a variant of Win32/PSW.OnLineGames.MUG trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\tsqc.dll - Win32/PSW.OnLineGames.NLH trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\upxdnd.dll - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\upxdnd.exe - probably a variant of Win32/PSW.OnLineGames.NFL trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\vdlsbipwow.dll - Win32/PSW.OnLineGames.GJV trojan
C:\Documents and Settings\Don johnson\桌面\机器狗+下载马\机器狗+下载马\zadnew.dll - a variant of Win32/PSW.OnLineGames.MUG trojan

llgiggs

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\机器狗+下载马'
C:\Documents and Settings\Administrator\My Documents\机器狗+下载马\机器狗+下载马\
  11.exe
      [DETECTION] Is the Trojan horse TR/Small.6910
      [NOTE]      The file was deleted!
  12.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
          [2] Archive type: Runtime Packed
          --> Object
            [3] Archive type: RSRC
            --> Object
                [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.seu.6
                [WARNING]   Infected files in archives cannot be repaired!
            --> Object
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [NOTE]      The file was deleted!
  13.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
          [2] Archive type: Runtime Packed
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.Online.olm.2
              [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
  14.exe
      [DETECTION] Is the Trojan horse TR/Small.6910
      [NOTE]      The file was deleted!
  15.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
          [2] Archive type: Runtime Packed
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.Online.olm.2
              [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
  7.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
          [2] Archive type: Runtime Packed
          --> Object
              [DETECTION] Is the Trojan horse TR/PSW.OnLin.8918.A
              [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!
  CDAC11BA.EXE
  cmdbcs.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The fund was classified as suspicious.
      [NOTE]      The file was moved to '48423048.qua'!
  cmdbcs.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
  cuhad.cfg
  cuhad.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [NOTE]      The file was deleted!
  DbgHlp32.dlL
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The fund was classified as suspicious.
      [NOTE]      The file was moved to '4845303d.qua'!
  DbgHlp32.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
  ESPI11.dll
  fobwdmjb.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
  fyom.cfg
  fyom.dll
    [0] Archive type: Runtime Packed
    --> Object
      [NOTE]      The file was deleted!
  gnolnait.cfg
  gnolnait.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.uew
      [NOTE]      The file was deleted!
  HHHCompress.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
          [2] Archive type: Runtime Packed
          --> Object
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
  hjiq.cfg
  hjiq.dll
    [0] Archive type: Runtime Packed
    --> Object
        [DETECTION] Is the Trojan horse TR/PSW.Online.olm.2
      [NOTE]      The file was deleted!
  iemnaw.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Small.ivi
      [NOTE]      The file was deleted!
  ijougiemnaw.cfg
  ijougiemnaw.dll
    [0] Archive type: Runtime Packed
    --> Object
        [DETECTION] Is the Trojan horse TR/PSW.Online.olm.2
      [NOTE]      The file was deleted!
  kehbxmmm.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The fund was classified as suspicious.
      [NOTE]      The file was moved to '48463040.qua'!
  kiluw.cfg
  kiluw.dll
    [0] Archive type: Runtime Packed
    --> Object
        [DETECTION] Is the Trojan horse TR/PSW.Online.olm.2
      [NOTE]      The file was deleted!
  laixuhz.cfg
  laixuhz.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.seu.6
            [WARNING]   Infected files in archives cannot be repaired!
        --> Object
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [NOTE]      The file was deleted!
  LotusHlp.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The fund was classified as suspicious.
      [NOTE]      The file was moved to '4852304a.qua'!
  LotusHlp.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
  mseion.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [NOTE]      The file was deleted!
  PTSShell.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The fund was classified as suspicious.
      [NOTE]      The file was moved to '4831302f.qua'!
  PTSShell.exe
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
  sve.cfg
  sve.dll
    [0] Archive type: Runtime Packed
    --> Object
        [DETECTION] Is the Trojan horse TR/PSW.OnLin.8918.A
      [NOTE]      The file was deleted!
  sygoxelwow.dll
    [0] Archive type: Runtime Packed
    --> Object
      [NOTE]      The file was deleted!
  taijoad.cfg
  taijoad.dll
    [0] Archive type: Runtime Packed
    --> Object
        [DETECTION] Is the Trojan horse TR/PSW.OnLin.8918.A
      [NOTE]      The file was deleted!
  tsqc.cfg
  tsqc.dll
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.rjh.2
            [WARNING]   Infected files in archives cannot be repaired!
        --> Object
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [NOTE]      The file was deleted!
  upxdnd.dll
      [DETECTION] Is the Trojan horse TR/Onlinegames.rxt
      [NOTE]      The file was deleted!
  upxdnd.exe
    [0] Archive type: Runtime Packed
    --> Object
        [DETECTION] Is the Trojan horse TR/Onlinegames.rxt
      [NOTE]      The file was deleted!
  vdlsbipwow.dll
    [0] Archive type: Runtime Packed
    --> Object
      [NOTE]      The file was deleted!
  WIN.INI
  zadnew.cfg
  zadnew.dll
    [0] Archive type: Runtime Packed
    --> Object
      [NOTE]      The file was deleted!


End of the scan: 2008年3月17日  00:46
Used time: 00:04 min

The scan has been done completely.

      2 Scanning directories
     48 Files were scanned
     31 viruses and/or unwanted programs were found
      6 Files were classified as suspicious:
     29 files were deleted
      0 files were repaired
      5 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     17 Files not concerned
      0 Archives were scanned
      6 Warnings
     34 Notes

凉水冰凉

经测试 360可以查杀

The EQs

将文件名改成系统文件名。。。看看会不会报

挪威的冬天

信息        2008-03-17  17:56:31        您此次查毒清除了33个病毒                       
信息        2008-03-17  17:56:31        您此次查毒共查出33个病毒以及危险代码                       
信息        2008-03-17  17:56:31        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件72个                       
信息        2008-03-17  17:56:31        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-03-17  17:56:31        D:\Desktop\机器狗+下载马\机器狗+下载马\zadnew.dll        Win32.Troj.OnlineGameT.82153        清除成功       
病毒        2008-03-17  17:56:30        D:\Desktop\机器狗+下载马\机器狗+下载马\vdlsbipwow.dll        Win32.PSWTroj.WowT.my.17831        清除成功       
病毒        2008-03-17  17:56:30        D:\Desktop\机器狗+下载马\机器狗+下载马\upxdnd.exe        Win32.Troj.OnlineGamesT.ty.98304        清除成功       
病毒        2008-03-17  17:56:30        D:\Desktop\机器狗+下载马\机器狗+下载马\upxdnd.dll        Win32.Troj.OnlineGameT.33792        清除成功       
病毒        2008-03-17  17:56:30        D:\Desktop\机器狗+下载马\机器狗+下载马\tsqc.dll        Win32.Troj.OnlineGamesT.ty.90112        清除成功       
病毒        2008-03-17  17:56:30        D:\Desktop\机器狗+下载马\机器狗+下载马\taijoad.dll        Win32.Troj.OnlineGames.yf.73728        清除成功       
病毒        2008-03-17  17:56:30        D:\Desktop\机器狗+下载马\机器狗+下载马\sygoxelwow.dll        Win32.PSWTroj.WowT.my.17831        清除成功       
病毒        2008-03-17  17:56:30        D:\Desktop\机器狗+下载马\机器狗+下载马\sve.dll        Win32.Troj.OnlineGamesT.zy.90112        清除成功       
病毒        2008-03-17  17:56:30        D:\Desktop\机器狗+下载马\机器狗+下载马\PTSShell.exe        Win32.Troj.OnlineGamesT.ty.98304        清除成功       
病毒        2008-03-17  17:56:30        D:\Desktop\机器狗+下载马\机器狗+下载马\PTSShell.dll        Win32.Troj.OnlineGameT.33792        清除成功       
病毒        2008-03-17  17:56:30        D:\Desktop\机器狗+下载马\机器狗+下载马\mseion.sys        Win32.Hack.GameHack.10368        清除成功       
病毒        2008-03-17  17:56:30        D:\Desktop\机器狗+下载马\机器狗+下载马\LotusHlp.exe        Win32.Troj.OnlineGamesT.ty.98304        清除成功       
病毒        2008-03-17  17:56:30        D:\Desktop\机器狗+下载马\机器狗+下载马\LotusHlp.dll        Win32.Troj.OnlineGameT.33792        清除成功       
病毒        2008-03-17  17:56:30        D:\Desktop\机器狗+下载马\机器狗+下载马\laixuhz.dll        Win32.Troj.GameHackT.ge.118784        清除成功       
病毒        2008-03-17  17:56:29        D:\Desktop\机器狗+下载马\机器狗+下载马\kiluw.dll        Win32.Troj.OnlineGameT.82153        清除成功       
病毒        2008-03-17  17:56:29        D:\Desktop\机器狗+下载马\机器狗+下载马\kehbxmmm.dll        Win32.Troj.OnlineGameT.33792        清除成功       
病毒        2008-03-17  17:56:29        D:\Desktop\机器狗+下载马\机器狗+下载马\ijougiemnaw.dll        Win32.Troj.OnlineGameT.82153        清除成功       
病毒        2008-03-17  17:56:29        D:\Desktop\机器狗+下载马\机器狗+下载马\hjiq.dll        Win32.Troj.OnlineGames.yk.73728        清除成功       
病毒        2008-03-17  17:56:29        D:\Desktop\机器狗+下载马\机器狗+下载马\HHHCompress.dll        Win32.Troj.WoWT.zy.110592        清除成功       
病毒        2008-03-17  17:56:29        D:\Desktop\机器狗+下载马\机器狗+下载马\gnolnait.dll        Win32.Troj.OnlineGameT.82153        清除成功       
病毒        2008-03-17  17:56:28        D:\Desktop\机器狗+下载马\机器狗+下载马\fyom.dll        Win32.Troj.OnlineGames.yf.73728        清除成功       
病毒        2008-03-17  17:56:28        D:\Desktop\机器狗+下载马\机器狗+下载马\fobwdmjb.exe        Win32.PSWTroj.GameOL.106496        清除成功       
病毒        2008-03-17  17:56:28        D:\Desktop\机器狗+下载马\机器狗+下载马\DbgHlp32.exe        Win32.Troj.OnlineGamesT.e.94315        清除成功       
病毒        2008-03-17  17:56:28        D:\Desktop\机器狗+下载马\机器狗+下载马\DbgHlp32.dlL        Win32.Troj.OnLineGamesT.li.34304        清除成功       
病毒        2008-03-17  17:56:28        D:\Desktop\机器狗+下载马\机器狗+下载马\cuhad.dll        Win32.Troj.OnlineGameT.82153        清除成功       
病毒        2008-03-17  17:56:28        D:\Desktop\机器狗+下载马\机器狗+下载马\cmdbcs.exe        Win32.Troj.OnlineGamesT.ty.98304        清除成功       
病毒        2008-03-17  17:56:28        D:\Desktop\机器狗+下载马\机器狗+下载马\cmdbcs.dll        Win32.Troj.OnlineGameT.33792        清除成功       
病毒        2008-03-17  17:56:28        D:\Desktop\机器狗+下载马\机器狗+下载马\7.exe        Win32.Troj.OnlineGameT.am.107664        清除成功       
病毒        2008-03-17  17:56:28        D:\Desktop\机器狗+下载马\机器狗+下载马\15.exe        Win32.Troj.OnlineGamesT.zy.32923        清除成功       
病毒        2008-03-17  17:56:28        D:\Desktop\机器狗+下载马\机器狗+下载马\14.exe        Win32.Troj.GamesHackT.gu.94304        清除成功       
病毒        2008-03-17  17:56:28        D:\Desktop\机器狗+下载马\机器狗+下载马\13.exe        Win32.Troj.OnlineGamesT.zy.32923        清除成功       
病毒        2008-03-17  17:56:28        D:\Desktop\机器狗+下载马\机器狗+下载马\12.exe        Win32.Troj.OnlineGameT.am.107664        清除成功       
病毒        2008-03-17  17:56:28        D:\Desktop\机器狗+下载马\机器狗+下载马\11.exe        Win32.Troj.GamesHackT.gu.94304        清除成功

solcroft

avast!对付批量病毒总是惨不忍睹
alwil的一帮懒人啊~

byxxdrls

原帖由 EQ2 于 2008-3-17 15:49 发表
将文件名改成系统文件名。。。看看会不会报

大家都知道凉水冰凉是３６０的人。呵呵。

不知这个机器狗样本是不是最新的。

Palkia

清除病毒种类列表：
病毒： Trojan.PSW.Win32.OnlineGames.eop
病毒： Trojan.PSW.Win32.GameOL.mjf
病毒： Trojan.PSW.Win32.GameOL.min
病毒： Trojan.PSW.Win32.GamesOnline.oz
病毒： Trojan.PSW.Win32.SO2Game.n
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.SO2Games.a
病毒： Trojan.PSW.Win32.GameOL.lxg
病毒： Trojan.DL.Win32.Mnless.zcn
病毒： Trojan.PSW.Win32.QQSG.cr
病毒： Trojan.PSW.Win32.QQSG.cu
病毒： Trojan.PSW.Win32.QQGame.GEN
病毒： RootKit.Win32.GameHack.GEN
病毒： Trojan.PSW.Win32.SO2Game.i