ARP蜗牛

显示全部楼层 · 发表于 2008-4-15 12:44:32

ARP蜗牛病毒

显示全部楼层 · 发表于 2008-4-15 12:46:50

Starting the file scan:

Begin scan in 'E:\新建文件夹 (2)\ARP蜗牛'
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\QQgame.exe
   [DETECTION] Contains detection pattern of the rootkit RKIT/HideProcess.B
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\DbgHlp32.exe
   [DETECTION] Is the Trojan horse TR/Onlinegames.NVI
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\fmsbbqi.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\fobwdmjb.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\SHAProc.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aanw
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\AVPSrv.exE
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\LotusHlp.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\PTSShell.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\upxdnd.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\WSockDrv32.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\mfchlp32.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [NOTE]    The fund was classified as suspicious.
   [NOTE]    The file was moved to '48673404.qua'!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\msccrt.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\tciocp32.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [NOTE]    The fund was classified as suspicious.
   [NOTE]    The file was moved to '486d3402.qua'!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\ttQACQAC1035.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\txRJHRJH1021.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\msccrt.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\ttVUFVUF1011.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zds
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\tciocp32.dll
   [DETECTION] Contains suspicious code HEUR/Malware
   [NOTE]    The fund was classified as suspicious.
   [NOTE]    The file was moved to '49c9338b.qua'!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\msoscqit00.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\ttQACQAC1035.exe
  [0] Archive type: OVL
  --> Object
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\txRJHRJH1021.exe
  [0] Archive type: OVL
  --> Object
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\upxdnd.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\LotusHlp.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\mfchlp32.dll
   [DETECTION] Contains suspicious code HEUR/Malware
   [NOTE]    The fund was classified as suspicious.
   [NOTE]    The file was moved to '48673406.qua'!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\msosmnsf00.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aaem
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\qqxyd.dll
   [DETECTION] Is the Trojan horse TR/PSW.Agent.afw.1
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\qqxyd.exe
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\ttVUFVUF1011.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.yip.19
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\fmsbbqi.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\PTSShell.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\WSockDrv32.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\AVPSrv.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\DbgHlp32.dlL
   [DETECTION] Is the Trojan horse TR/Onlinegames.NVI
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\SHAProc.dat
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.xnu
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\ttNNBNNB1047.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zfe
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\kehbxmmm.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.12
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\ttNNBNNB1047.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zhy
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\ttEZZEZZ1046.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ZFE.3
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\ttEZZEZZ1046.dll
   [DETECTION] Is the Trojan horse TR/Agent.7807
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\msosmhfp00.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\msosdohs00.dll
   [DETECTION] Is the Trojan horse TR/PSW.Agent.agp
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\ayFKKFKK1055.exe
   [DETECTION] Is the Trojan horse TR/Drop.Agent.12134
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\ayFKKFKK1055.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.yjm
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\ARP蜗牛\ARP蜗牛\A.tmp
   [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.2
   [NOTE]    The file was deleted!

End of the scan: 2008年4月15日  12:48
Used time: 00:10 min

The scan has been done completely.

   2 Scanning directories
   55 Files were scanned
   40 viruses and/or unwanted programs were found
   4 Files were classified as suspicious:
   40 files were deleted
   0 files were repaired
   4 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   15 Files not concerned
   0 Archives were scanned
   0 Warnings
   44 Notes

3819080  CleanUp.exe  44 KB  CLEAN
3819081  msoscqit.dat  256 Byte  CLEAN
3819082  msosdohs.dat  256 Byte  CLEAN
3819083  msosmhfp.dat  256 Byte  CLEAN
3819084  msosmnsf.dat  128 Byte  CLEAN
3817086  npptools.dll  27.83 KB  DAMAGED FILE (UNKNOWN)
3817084  Packet.dll  35.86 KB  DAMAGED FILE (UNKNOWN)
3819085  tmp28.tmp  15.5 KB  CLEAN
3817078  WanPacket.dll  29.99 KB  DAMAGED FILE (UNKNOWN)
3819086  win.ini  73 Byte  CLEAN
3817085  wpcap.dll  90.55 KB  DAMAGED FILE (UNKNOWN)

[ 本帖最后由 Exia 于 2008-4-15 20:51 编辑 ]

显示全部楼层 · 发表于 2008-4-15 13:00:47

信息 2008-04-15  13:00:39 您此次查毒隔离了26个文件
信息 2008-04-15  13:00:39 您此次查毒清除了1个病毒
信息 2008-04-15  13:00:39 您此次查毒共查出27个病毒以及危险代码
信息 2008-04-15  13:00:39 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件88个
信息 2008-04-15  13:00:39 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒

显示全部楼层 · 发表于 2008-4-15 13:06:01

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.Win32.ArpCheat.fd
病毒： Trojan.PSW.Win32.GameOL.mxr
病毒： Trojan.PSW.Win32.GameOL.mfr
病毒： Trojan.PSW.Win32.SunOnline.nh
病毒： Trojan.PSW.Win32.GameOL.mxl
病毒： Trojan.PSW.Win32.GamesOnline.tr
病毒： Trojan.PSW.Win32.GamesOnline.th
病毒： Trojan.PSW.Win32.GameOL.mvc
病毒： Trojan.PSW.Win32.GameOL.mxc
病毒： Trojan.DL.Win32.Mnless.zbh
病毒： Trojan.PSW.Win32.GameOL.mvu
病毒： Trojan.PSW.Win32.GameOL.mvu
病毒： Trojan.PSW.Win32.GameOL.mzi
病毒： Trojan.PSW.Win32.GameOL.myq
病毒： Trojan.PSW.Win32.GameOL.mvg
病毒： Packer.Win32.Upack.a

MAC 地址：00:17:31:40:A3:57

用户来源：局域网

软件版本：20.40.02

显示全部楼层 · 发表于 2008-4-15 13:13:34

正在扫描日志
病毒库版本: 3026 (20080414)
日期: 2008-4-15 时间: 13:11:15
已扫描的磁盘、文件夹和文件: E:\VIRUS\ARP
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\A.tmp - Win32/HackTool.ArpSnoof.A 特洛伊木马
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\AVPSrv.dll - Win32/PSW.OnLineGames.NVW 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\AVPSrv.exE - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\ayFKKFKK1055.dll - Win32/PSW.OnLineGames.PBQ 特洛伊木马
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\ayFKKFKK1055.exe - Win32/PSW.OnLineGames.PBQ 特洛伊木马
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\DbgHlp32.dlL - Win32/PSW.OnLineGames.NVW 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\DbgHlp32.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\fmsbbqi.dll - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\fmsbbqi.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\fobwdmjb.exe - Win32/PSW.OnLineGames.NFL 特洛伊木马
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\kehbxmmm.dll - Win32/PSW.OnLineGames.HCV 特洛伊木马
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\LotusHlp.dll - Win32/PSW.OnLineGames.NVW 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\LotusHlp.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\mfchlp32.dll - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\mfchlp32.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\msccrt.dll - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\msccrt.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\msoscqit00.dll - Win32/PSW.OnLineGames.NVW 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\msosdohs00.dll - Win32/PSW.OnLineGames.NVW 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\msosmhfp00.dll - Win32/PSW.OnLineGames.NVW 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\msosmnsf00.dll - Win32/PSW.OnLineGames.NVW 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\PTSShell.dll - Win32/PSW.OnLineGames.NVW 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\PTSShell.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\QQgame.exe - Win32/TrojanDownloader.Agent.NWE 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\qqxyd.exe - 未查明的 NewHeur_PE 病毒 [7]
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\SHAProc.dat - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\SHAProc.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\tciocp32.dll - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\tciocp32.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\ttEZZEZZ1046.dll - Win32/PSW.OnLineGames.PBQ 特洛伊木马
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\ttEZZEZZ1046.exe - Win32/PSW.OnLineGames.PBQ 特洛伊木马
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\ttNNBNNB1047.dll - Win32/PSW.OnLineGames.PBQ 特洛伊木马
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\ttNNBNNB1047.exe - Win32/PSW.OnLineGames.PBQ 特洛伊木马
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\ttQACQAC1035.dll - Win32/PSW.OnLineGames.PBQ 特洛伊木马
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\ttQACQAC1035.exe - Win32/PSW.OnLineGames.PBQ 特洛伊木马
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\ttVUFVUF1011.dll - Win32/PSW.OnLineGames.PBQ 特洛伊木马
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\ttVUFVUF1011.exe - Win32/PSW.OnLineGames.PBQ 特洛伊木马
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\txRJHRJH1021.dll - Win32/PSW.OnLineGames.PBQ 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\txRJHRJH1021.exe - Win32/PSW.OnLineGames.PBQ 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\upxdnd.dll - Win32/PSW.OnLineGames.NVW 特洛伊木马
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\upxdnd.exe - Win32/PSW.OnLineGames.NFL 特洛伊木马
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\WSockDrv32.dll - Win32/PSW.OnLineGames.NVW 特洛伊木马的变种
E:\VIRUS\ARP\ARP蜗牛\ARP蜗牛\WSockDrv32.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
已扫描的对象数: 55
发现的威胁数: 43
已清除对象数:0
完成时间: 13:11:19 总扫描时间: 4 秒 (00:00:04)

备注:
[7] 对象可能感染了未知病毒。

显示全部楼层 · 发表于 2008-4-15 16:12:28

[Found possible security risk] <W32/Heuristic-CSU!Eldorado (dropper, damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\QQgame.exe->(embedded)
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\ARP蜗牛\ARP蜗牛\DbgHlp32.exe
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\ARP蜗牛\ARP蜗牛\fmsbbqi.exe
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\ARP蜗牛\ARP蜗牛\fobwdmjb.exe
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\ARP蜗牛\ARP蜗牛\SHAProc.exe
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\ARP蜗牛\ARP蜗牛\AVPSrv.exE->(FSG)
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\ARP蜗牛\ARP蜗牛\LotusHlp.exe
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\ARP蜗牛\ARP蜗牛\PTSShell.exe
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\ARP蜗牛\ARP蜗牛\upxdnd.exe
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\WSockDrv32.exe->(UPack)
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\ARP蜗牛\ARP蜗牛\mfchlp32.exe->(FSG)
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\ARP蜗牛\ARP蜗牛\msccrt.exe
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\ARP蜗牛\ARP蜗牛\tciocp32.exe->(FSG)
[Found possible virus] <W32/Threat-INLIB-based!Maximus> C:\test\ARP蜗牛\ARP蜗牛\Packet.dll->(NSPack)->(PE_Patch)
[Found possible security risk] <W32/Heuristic-162!Eldorado (not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\WanPacket.dll->(NSPack)->(PE_Patch)->(NSPack)
[Found possible virus] <W32/Threat-INLIB-based!Maximus> C:\test\ARP蜗牛\ARP蜗牛\wpcap.dll->(NSPack)->(PE_Patch)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\ttQACQAC1035.dll->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\txRJHRJH1021.dll->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\ttVUFVUF1011.dll->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\msoscqit00.dll->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\ttQACQAC1035.exe->exefile->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\txRJHRJH1021.exe->exefile->(UPack)
[Found possible security risk] <W32/Heuristic-KPP!Eldorado (not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\LotusHlp.dll
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\msosmnsf00.dll->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\qqxyd.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\ttVUFVUF1011.exe->exefile->(UPack)
[Found possible security risk] <W32/Heuristic-KPP!Eldorado (not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\PTSShell.dll
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\ttNNBNNB1047.exe->exefile->(UPack)
[Found possible security risk] <W32/Heuristic-KPP!Eldorado (not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\kehbxmmm.dll
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\ttNNBNNB1047.dll->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\ttEZZEZZ1046.exe->exefile->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\ttEZZEZZ1046.dll->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\msosmhfp00.dll->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\msosdohs00.dll->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\ayFKKFKK1055.exe->exefile->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\ARP蜗牛\ARP蜗牛\ayFKKFKK1055.dll->(UPack)

显示全部楼层 · 发表于 2008-4-15 17:24:41

Kaspersky Virus Scanner

Scanned file: 235436.rar - Infected

235436.rar/A.tmp - infected by HackTool.Win32.Agent.eh
235436.rar/AVPSrv.exE - infected by Trojan-PSW.Win32.OnLineGames.aafe
235436.rar/AVPSrv.dll - infected by Trojan-PSW.Win32.OnLineGames.aaff
235436.rar/ayFKKFKK1055.exe - infected by Trojan-PSW.Win32.OnLineGames.yip
235436.rar/ayFKKFKK1055.dll - infected by Trojan-PSW.Win32.OnLineGames.yjm
235436.rar/CleanUp.exe - OK
235436.rar/DbgHlp32.exe - infected by Trojan-PSW.Win32.OnLineGames.aaed
235436.rar/DbgHlp32.dlL - infected by Trojan-PSW.Win32.OnLineGames.aaee
235436.rar/fmsbbqi.exe - infected by Trojan-PSW.Win32.OnLineGames.aadz
235436.rar/fmsbbqi.dll - infected by Trojan-PSW.Win32.OnLineGames.aaea
235436.rar/fobwdmjb.exe - infected by Trojan-PSW.Win32.OnLineGames.aanv
235436.rar/kehbxmmm.dll - infected by Trojan-PSW.Win32.OnLineGames.aanu
235436.rar/LotusHlp.exe - infected by Trojan-PSW.Win32.OnLineGames.aaox
235436.rar/LotusHlp.dll - infected by Trojan-PSW.Win32.OnLineGames.aaow
235436.rar/mfchlp32.exe - OK
235436.rar/mfchlp32.exe - OK
235436.rar/mfchlp32.dll - OK
235436.rar/msccrt.exe - infected by Trojan-PSW.Win32.OnLineGames.aaeb
235436.rar/msccrt.dll - infected by Trojan-PSW.Win32.OnLineGames.aaec
235436.rar/msoscqit.dat - OK
235436.rar/msosdohs.dat - OK
235436.rar/msosmhfp.dat - OK
235436.rar/msosmnsf.dat - OK
235436.rar/npptools.dll - OK
235436.rar/npptools.dll - OK
235436.rar/Packet.dll - OK
235436.rar/Packet.dll - OK
235436.rar/Packet.dll - OK
235436.rar/PTSShell.exe - infected by Trojan-PSW.Win32.OnLineGames.aaei
235436.rar/PTSShell.dll - infected by Trojan-PSW.Win32.OnLineGames.aaej
235436.rar/QQgame.exe - infected by Trojan-PSW.Win32.OnLineGames.rxpi
235436.rar/qqxyd.exe - infected by Trojan-PSW.Win32.Agent.afw
235436.rar/qqxyd.dll - infected by Trojan-PSW.Win32.Agent.afw
235436.rar/SHAProc.dat - infected by Trojan-PSW.Win32.OnLineGames.xnu
235436.rar/SHAProc.exe - infected by Trojan-PSW.Win32.OnLineGames.aanw
235436.rar/tciocp32.exe - OK
235436.rar/tciocp32.exe - OK
235436.rar/tciocp32.dll - OK
235436.rar/tmp28.tmp - OK
235436.rar/ttEZZEZZ1046.exe - infected by Trojan-PSW.Win32.OnLineGames.zfe
235436.rar/ttEZZEZZ1046.dll - infected by Trojan-PSW.Win32.OnLineGames.zxr
235436.rar/ttNNBNNB1047.exe - infected by Trojan-PSW.Win32.OnLineGames.zfe
235436.rar/ttNNBNNB1047.dll - infected by Trojan-PSW.Win32.OnLineGames.zhy
235436.rar/ttQACQAC1035.exe - infected by Trojan-PSW.Win32.OnLineGames.aahg
235436.rar/ttQACQAC1035.dll - infected by Trojan-PSW.Win32.OnLineGames.aahf
235436.rar/ttVUFVUF1011.exe - infected by Trojan-PSW.Win32.OnLineGames.yip
235436.rar/ttVUFVUF1011.dll - infected by Trojan-PSW.Win32.OnLineGames.zds
235436.rar/txRJHRJH1021.exe/data0000.bin - OK
235436.rar/txRJHRJH1021.exe/data0000.bin - OK
235436.rar/txRJHRJH1021.exe - OK
235436.rar/txRJHRJH1021.exe - OK
235436.rar/txRJHRJH1021.exe - OK
235436.rar/txRJHRJH1021.dll - OK
235436.rar/txRJHRJH1021.dll - OK
235436.rar/upxdnd.exe - infected by Trojan-PSW.Win32.OnLineGames.aadv
235436.rar/upxdnd.dll - infected by Trojan-PSW.Win32.OnLineGames.aadw
235436.rar/WanPacket.dll - OK
235436.rar/WanPacket.dll - OK
235436.rar/WanPacket.dll - OK
235436.rar/win.ini - OK
235436.rar/wpcap.dll - OK
235436.rar/wpcap.dll - OK
235436.rar/wpcap.dll - OK
235436.rar/WSockDrv32.exe - infected by Trojan-PSW.Win32.OnLineGames.zsn
235436.rar/WSockDrv32.dll - infected by Trojan-PSW.Win32.OnLineGames.zsl

上报卡巴

显示全部楼层 · 发表于 2008-4-15 18:06:05

木马名称:Trojan-PSW.Win32.OnLineGame.nnf
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\QQGAME.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.Agent.fjj
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\QQXYD.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.can
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\TTNNBNNB1047.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.OL-Game.clj
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\TTNNBNNB1047.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:HackTool.Win32.Agent.bg
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\A.TMP
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\AVPSRV.EXE
木马程序生成以下文件:
1) C:\WINDOWS\AVPSRV.EXE
2) C:\WINDOWS\SYSTEM32\AVPSRV.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\AYFKKFKK1055.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\AYFKKFKK1055.EXE
2) C:\WINDOWS\SYSTEM32\AYFKKFKK1055.DLL
是否删除木马程序及其衍生物?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\AVPSRV.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\AYFKKFKK1055.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\DBGHLP32.EXE
木马程序生成以下文件:
1) C:\WINDOWS\DBGHLP32.EXE
2) C:\WINDOWS\SYSTEM32\DBGHLP32.DLL
是否删除木马程序及其衍生物?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\DBGHLP32.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\FMSBBQI.EXE
木马程序生成以下文件:
1) C:\WINDOWS\FMSBBQI.EXE
2) C:\WINDOWS\SYSTEM32\FMSBBQI.DLL
是否删除木马程序及其衍生物?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\FMSBBQI.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\FOBWDMJB.EXE
木马程序生成以下文件:
1) C:\WINDOWS\GWSMHXUQ.EXE
2) C:\WINDOWS\SYSTEM32\RZYSDHBX.DLL
是否删除木马程序及其衍生物?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\KEHBXMMM.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\LOTUSHLP.EXE
木马程序生成以下文件:
1) C:\WINDOWS\LOTUSHLP.EXE
2) C:\WINDOWS\SYSTEM32\LOTUSHLP.DLL
是否删除木马程序及其衍生物?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\LOTUSHLP.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\MFCHLP32.EXE
木马程序生成以下文件:
1) C:\WINDOWS\MFCHLP32.EXE
2) C:\WINDOWS\SYSTEM32\MFCHLP32.DLL
是否删除木马程序及其衍生物?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\MFCHLP32.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\MSCCRT.EXE
木马程序生成以下文件:
1) C:\WINDOWS\MSCCRT.EXE
2) C:\WINDOWS\SYSTEM32\MSCCRT.DLL
是否删除木马程序及其衍生物?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\MSCCRT.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\PTSSHELL.EXE
木马程序生成以下文件:
1) C:\WINDOWS\PTSSHELL.EXE
2) C:\WINDOWS\SYSTEM32\PTSSHELL.DLL
是否删除木马程序及其衍生物?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\PTSSHELL.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\SHAPROC.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SHAPROC.EXE
2) C:\WINDOWS\SYSTEM32\SHAPROC.DAT
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\TCIOCP32.EXE
木马程序生成以下文件:
1) C:\WINDOWS\TCIOCP32.EXE
2) C:\WINDOWS\SYSTEM32\TCIOCP32.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\TTEZZEZZ1046.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\TTEZZEZZ1046.EXE
2) C:\WINDOWS\SYSTEM32\TTEZZEZZ1046.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\TTQACQAC1035.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\TTQACQAC1035.EXE
2) C:\WINDOWS\SYSTEM32\TTQACQAC1035.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\TTVUFVUF1011.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\TTVUFVUF1011.EXE
2) C:\WINDOWS\SYSTEM32\TTVUFVUF1011.DLL
是否删除木马程序及其衍生物?

木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\TTVUFVUF1011.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\TTQACQAC1035.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\TXRJHRJH1021.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\TXRJHRJH1021.EXE
2) C:\WINDOWS\SYSTEM32\TXRJHRJH1021.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\UPXDND.EXE
木马程序生成以下文件:
1) C:\WINDOWS\UPXDND.EXE
2) C:\WINDOWS\SYSTEM32\UPXDND.DLL
是否删除木马程序及其衍生物?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\UPXDND.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\TXRJHRJH1021.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知间谍软件
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\TCIOCP32.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ARP蜗牛[1]\ARP蜗牛\ARP蜗牛\TTEZZEZZ1046.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2008-4-15 19:58:42

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.ArpCheat.fd
病毒： Trojan.PSW.Win32.GameOL.mxr
病毒： Trojan.PSW.Win32.GameOL.mpu
病毒： Trojan.PSW.Win32.SunOnline.nh
病毒： Trojan.PSW.Win32.GameOL.mxl
病毒： Trojan.PSW.Win32.GamesOnline.tr
病毒： Trojan.DL.Win32.Mnless.zbh
病毒： Trojan.PSW.Win32.GameOL.mvu
病毒： Trojan.PSW.Win32.GameOL.mvu
病毒： Trojan.PSW.Win32.GameOL.mzi
病毒： Trojan.PSW.Win32.GameOL.mvi
病毒： Trojan.PSW.Win32.GameOnlines.i
病毒： Trojan.PSW.Win32.GameOL.myq
病毒： Trojan.PSW.Win32.SunGame.l
病毒： Trojan.PSW.Win32.GameOL.mvg
病毒： Packer.Win32.Upack.a

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.40.11

[病毒样本] ARP蜗牛

本帖子中包含更多资源

44

99/31

36

本帖子中包含更多资源

92/29