ARP蜗牛下载的马

显示全部楼层 · 发表于 2008-4-15 12:45:54

ARP蜗牛下载的马

显示全部楼层 · 发表于 2008-4-15 12:52:54

Starting the file scan:

Begin scan in 'E:\新建文件夹 (2)\xiazai'
E:\新建文件夹 (2)\xiazai\00001[1].exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zsy
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00005[1].exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aanw
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00016[1].exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00012[1].exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00031[1].exe
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00021[1].exe
  [0] Archive type: OVL
  --> Object
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\arp111[1].exe
  [0] Archive type: RSRC
--> Object
      [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.2
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\999[1].exe
   [DETECTION] Contains detection pattern of the worm WORM/Cekar.A
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\soundma[1].exe
   [DETECTION] Is the Trojan horse TR/Drop.Age.51042.B
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\host[1].exe
   [DETECTION] Is the Trojan horse TR/Qhost.aef
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00003[1].exe
   [DETECTION] Is the Trojan horse TR/Onlinegames.NVI
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00015[1].exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zfe
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00007[1].exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00030[1].exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [NOTE]    The fund was classified as suspicious.
   [NOTE]    The file was moved to '48343539.qua'!
E:\新建文件夹 (2)\xiazai\00019[1].exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [NOTE]    The fund was classified as suspicious.
   [NOTE]    The file was moved to '4996cbe2.qua'!
E:\新建文件夹 (2)\xiazai\00011[1].exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\game[1].exe
   [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00002[1].exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.Agent.agp
   --> Object
      [DETECTION] Contains detection pattern of the rootkit RKIT/OnLineGames.C.1
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00017[1].exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00014[1].exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00013[1].exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00036[1].exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.yip.19
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00010[1].exe
  [0] Archive type: OVL
  --> Object
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\lmmh[1].exe
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00004[1].exe
   [DETECTION] Is the Trojan horse TR/Drop.Agent.12134
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00006[1].exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ZFE.3
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00008[1].exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00035[1].exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aaem
   --> Object
      [DETECTION] Contains detection pattern of the rootkit RKIT/OnLineGames.C.1
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\00020[1].exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.ahy
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\新建文件夹 (2)\xiazai\qq[1].exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Contains detection pattern of the worm WORM/Autorun.FF.39
   [NOTE]    The file was deleted!

End of the scan: 2008年4月15日  12:54
Used time: 00:11 min

The scan has been done completely.

   1 Scanning directories
   30 Files were scanned
   32 viruses and/or unwanted programs were found
   2 Files were classified as suspicious:
   28 files were deleted
   0 files were repaired
   2 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   -2 Files not concerned
   0 Archives were scanned
   0 Warnings
   30 Notes

显示全部楼层 · 发表于 2008-4-15 12:53:40

信息 2008-04-15  12:53:34 您此次查毒隔离了18个文件
信息 2008-04-15  12:53:34 您此次查毒共查出18个病毒以及危险代码
信息 2008-04-15  12:53:34 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件58个
信息 2008-04-15  12:53:34 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒

显示全部楼层 · 发表于 2008-4-15 12:57:10

正在扫描日志
病毒库版本: 3026 (20080414)
日期: 2008-4-15 时间: 12:54:51
已扫描的磁盘、文件夹和文件: E:\VIRUS\xiazai
E:\VIRUS\xiazai\xiazai\00001[1].exe - 可能是 Win32/PSW.OnLineGames.NMQ 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\00002[1].exe - Win32/PSW.OnLineGames.NMQ 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\00003[1].exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\00004[1].exe - Win32/PSW.OnLineGames.PBQ 特洛伊木马
E:\VIRUS\xiazai\xiazai\00005[1].exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\00006[1].exe - Win32/PSW.OnLineGames.PBQ 特洛伊木马
E:\VIRUS\xiazai\xiazai\00007[1].exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\00008[1].exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\00010[1].exe - Win32/PSW.OnLineGames.PBQ 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\00011[1].exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\00012[1].exe - Win32/PSW.OnLineGames.NFL 特洛伊木马
E:\VIRUS\xiazai\xiazai\00013[1].exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\00014[1].exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\00015[1].exe - Win32/PSW.OnLineGames.PBQ 特洛伊木马
E:\VIRUS\xiazai\xiazai\00016[1].exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\00017[1].exe - Win32/PSW.OnLineGames.NFL 特洛伊木马
E:\VIRUS\xiazai\xiazai\00019[1].exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\00020[1].exe - 可能是 Win32/PSW.OnLineGames.NMQ 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\00021[1].exe - Win32/PSW.OnLineGames.PBQ 特洛伊木马
E:\VIRUS\xiazai\xiazai\00030[1].exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\00031[1].exe - 未查明的 NewHeur_PE 病毒 [7]
E:\VIRUS\xiazai\xiazai\00035[1].exe - 可能是 Win32/PSW.OnLineGames.NMQ 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\00036[1].exe - Win32/PSW.OnLineGames.PBQ 特洛伊木马
E:\VIRUS\xiazai\xiazai\999[1].exe - Win32/Anilogo.NAD 蠕虫
E:\VIRUS\xiazai\xiazai\arp111[1].exe - Win32/TrojanDropper.Agent.NJN 特洛伊木马
E:\VIRUS\xiazai\xiazai\game[1].exe - Win32/TrojanDownloader.Agent.NWE 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\host[1].exe - Win32/Qhost.AEF 特洛伊木马
E:\VIRUS\xiazai\xiazai\lmmh[1].exe - Win32/Spy.Delf.NGN 特洛伊木马
E:\VIRUS\xiazai\xiazai\qq[1].exe - Win32/PSW.QQPass.NCZ 特洛伊木马的变种
E:\VIRUS\xiazai\xiazai\soundma[1].exe - Win32/PSW.Delf.NKU 特洛伊木马
已扫描的对象数: 30
发现的威胁数: 30
已清除对象数:0
完成时间: 12:54:54 总扫描时间: 3 秒 (00:00:03)

备注:
[7] 对象可能感染了未知病毒。

显示全部楼层 · 发表于 2008-4-15 13:08:10

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Packer.Win32.Upack.a
病毒： Trojan.PSW.Win32.GameOL.myd
病毒： Trojan.PSW.Win32.GameOL.mxr
病毒： Trojan.PSW.Win32.SunOnline.nh
病毒： Trojan.PSW.Win32.GamesOnline.tr
病毒： Trojan.PSW.Win32.GameOL.mxl
病毒： Trojan.PSW.Win32.GameOL.mzi
病毒： RootKit.Win32.HideFiles.n
病毒： Trojan.PSW.Win32.GamesOnline.th
病毒： Trojan.PSW.Win32.GameOL.mvu
病毒： Win32.Logogo.z
病毒： Trojan.Win32.ArpCheat.ff
病毒： Trojan.Win32.QHost.abe
病毒： Trojan.PSW.Win32.XYOnline.ta
病毒： Trojan.DL.Win32.Agent.bxw

MAC 地址：00:17:31:40:A3:57

用户来源：局域网

软件版本：20.40.02

显示全部楼层 · 发表于 2008-4-15 16:16:12

[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\xiazai\00001[1].exe->(UPack)
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\xiazai\00005[1].exe
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\xiazai\00016[1].exe
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\xiazai\00012[1].exe
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\xiazai\00031[1].exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\xiazai\00021[1].exe->exefile->(UPack)
[Found backdoor] <W32/Backdoor2.PUR (exact)> C:\test\xiazai\arp111[1].exe
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\xiazai\999[1].exe->(UPack)
[Found Trojan] <W32/Trojan2.LUN (exact)> C:\test\xiazai\soundma[1].exe
[Found Trojan] <W32/Trojan2.TXF (exact)> C:\test\xiazai\host[1].exe
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\xiazai\00003[1].exe
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\xiazai\00015[1].exe->exefile->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\xiazai\00007[1].exe->(UPack)
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\xiazai\00030[1].exe->(FSG)
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\xiazai\00019[1].exe->(FSG)
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\xiazai\00011[1].exe
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\xiazai\game[1].exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\xiazai\00002[1].exe->(embedded)->(UPack)
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\xiazai\00017[1].exe
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\xiazai\00014[1].exe
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\xiazai\00013[1].exe
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\xiazai\00036[1].exe->exefile->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\xiazai\00010[1].exe->exefile->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\xiazai\lmmh[1].exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\xiazai\00004[1].exe->exefile->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\xiazai\00006[1].exe->exefile->(UPack)
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\test\xiazai\00008[1].exe->(FSG)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\xiazai\00035[1].exe->(embedded)->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\xiazai\00020[1].exe->(UPack)
[Found security risk] <W32/AutoRun.D.gen!Eldorado (not disinfectable, generic)> C:\test\xiazai\qq[1].exe->(UPX)

显示全部楼层 · 发表于 2008-4-15 20:01:23

TO KL

[病毒样本] ARP蜗牛下载的马

本帖子中包含更多资源

34

71/21

30