[病毒样本] 23

显示全部楼层 · 发表于 2008-4-20 21:49:17

已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.abcw 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/19.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.zon 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/20.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aayo 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/21.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.yzt 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/22.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Delf.axx 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/1.exe2//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.yzt 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/3.exe2//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.zjk 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/5.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.yzt 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/6.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aajs 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/7.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.kbw 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/9.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aayo 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/8.exe2//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.kgy 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/10.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.abah 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/11.exe2//PE_Patch.UPX//UPX
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.kgy 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/12.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ztr 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/13.exe2//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.yzt 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/23.exe2//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.yzt 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/14.exe2//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.abag 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/15.exe3//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.abcw 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/16.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.yzt 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/17.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aayo 檔案: C:\Documents and Settings\kato9096\桌面\5222\複製 -22.rar/18.exe3//PE_Patch//UPack

２１，上报2

Hello,

2.exe2 - Trojan-PSW.Win32.OnLineGames.ably,
4.exe3 - Trojan-PSW.Win32.OnLineGames.abmx

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-4-20 22:46 编辑 ]

显示全部楼层 · 发表于 2008-4-20 21:51:07

kv 21

显示全部楼层 · 发表于 2008-4-20 21:52:02

又来

显示全部楼层 · 发表于 2008-4-20 21:52:04

全灭
Begin scan in 'E:\Virus Test\22'
E:\Virus Test\22\1.exe2
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\Virus Test\22\10.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
E:\Virus Test\22\11.exe2
   [DETECTION] Is the Trojan horse TR/Onlinegames.NVI
   [NOTE]    The file was deleted!
E:\Virus Test\22\12.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!
E:\Virus Test\22\13.exe2
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
E:\Virus Test\22\14.exe2
--> Object
   [1] Archive type: RSRC
   --> Object
         [DETECTION] Is the Trojan horse TR/PSW.Online.ddn.2
   [NOTE]    The file was deleted!
E:\Virus Test\22\15.exe3
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\Virus Test\22\16.exe3
--> Object
   [1] Archive type: RSRC
   --> Object
      --> Object
      [3] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aayo
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
   [NOTE]    The file was deleted!
E:\Virus Test\22\17.exe3
--> Object
   [1] Archive type: RSRC
   --> Object
         [DETECTION] Is the Trojan horse TR/PSW.Online.ddn.2
   [NOTE]    The file was deleted!
E:\Virus Test\22\18.exe3
--> Object
   [1] Archive type: RSRC
   --> Object
      --> Object
      [3] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aayo
   [NOTE]    The file was deleted!
E:\Virus Test\22\19.exe3
--> Object
   [1] Archive type: RSRC
   --> Object
      --> Object
      [3] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aayo
   [NOTE]    The file was deleted!
E:\Virus Test\22\2.exe2
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
   [NOTE]    The file was deleted!
E:\Virus Test\22\20.exe3
--> Object
   [1] Archive type: RSRC
   --> Object
      --> Object
      [3] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zop
   [NOTE]    The file was deleted!
E:\Virus Test\22\21.exe3
--> Object
   [1] Archive type: RSRC
   --> Object
      --> Object
      [3] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aayo
   [NOTE]    The file was deleted!
E:\Virus Test\22\22.exe3
--> Object
   [1] Archive type: RSRC
   --> Object
         [DETECTION] Is the Trojan horse TR/PSW.Online.ddn.2
   [NOTE]    The file was deleted!
E:\Virus Test\22\23.exe2
--> Object
   [1] Archive type: RSRC
   --> Object
         [DETECTION] Is the Trojan horse TR/PSW.Online.ddn.2
   [NOTE]    The file was deleted!
E:\Virus Test\22\3.exe2
--> Object
   [1] Archive type: RSRC
   --> Object
         [DETECTION] Is the Trojan horse TR/PSW.Online.ddn.2
   [NOTE]    The file was deleted!
E:\Virus Test\22\4.exe3
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
E:\Virus Test\22\5.exe3
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zjk
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [NOTE]    The file was deleted!
E:\Virus Test\22\6.exe3
--> Object
   [1] Archive type: RSRC
   --> Object
         [DETECTION] Is the Trojan horse TR/PSW.Online.ddn.2
   [NOTE]    The file was deleted!
E:\Virus Test\22\7.exe3
--> Object
   [1] Archive type: RSRC
   --> Object
      --> Object
      [3] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aajr
   [NOTE]    The file was deleted!
E:\Virus Test\22\8.exe2
--> Object
   [1] Archive type: RSRC
   --> Object
      --> Object
      [3] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aayo
   [NOTE]    The file was deleted!
E:\Virus Test\22\9.exe3
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-4-20 21:53:14

打包好啊~

显示全部楼层 · 发表于 2008-4-20 21:55:36

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Packer.Win32.Upack.a
病毒： Trojan.PSW.Win32.XYOnline.acy
病毒： Trojan.PSW.Win32.GameOL.myf
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.GameOL.mxu
病毒： Trojan.PSW.Win32.GameOL.nbd

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.40.62

显示全部楼层 · 发表于 2008-4-20 22:14:14

小红伞全干掉

显示全部楼层 · 发表于 2008-4-20 22:16:16

全灭

E:\病毒\22.rar > RAR > 19.exe3 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
E:\病毒\22.rar > RAR > 20.exe3 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
E:\病毒\22.rar > RAR > 21.exe3 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
E:\病毒\22.rar > RAR > 22.exe3 - Win32/PSW.OnLineGames.YZT 特洛伊木马
E:\病毒\22.rar > RAR > 1.exe2 - 可能是 Win32/PSW.WOW.WU 特洛伊木马的变种
E:\病毒\22.rar > RAR > 2.exe2 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
E:\病毒\22.rar > RAR > 3.exe2 - Win32/PSW.OnLineGames.MUG 特洛伊木马
E:\病毒\22.rar > RAR > 4.exe3 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
E:\病毒\22.rar > RAR > 5.exe3 - Win32/PSW.OnLineGames.ZJK 特洛伊木马的变种
E:\病毒\22.rar > RAR > 6.exe3 - Win32/PSW.OnLineGames.MUG 特洛伊木马
E:\病毒\22.rar > RAR > 7.exe3 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
E:\病毒\22.rar > RAR > 9.exe3 - Win32/PSW.OnLineGames.NML 特洛伊木马的变种
E:\病毒\22.rar > RAR > 8.exe2 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
E:\病毒\22.rar > RAR > 10.exe3 - Win32/PSW.OnLineGames.NML 特洛伊木马的变种
E:\病毒\22.rar > RAR > 11.exe2 - Win32/PSW.OnLineGames.NFL 特洛伊木马
E:\病毒\22.rar > RAR > 12.exe3 - Win32/PSW.OnLineGames.NML 特洛伊木马的变种
E:\病毒\22.rar > RAR > 13.exe2 - Win32/PSW.OnLineGames.NML 特洛伊木马的变种
E:\病毒\22.rar > RAR > 23.exe2 - Win32/PSW.OnLineGames.YZT 特洛伊木马
E:\病毒\22.rar > RAR > 14.exe2 - Win32/PSW.OnLineGames.YZT 特洛伊木马
E:\病毒\22.rar > RAR > 15.exe3 - Win32/PSW.OnLineGames.NFL 特洛伊木马
E:\病毒\22.rar > RAR > 16.exe3 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
E:\病毒\22.rar > RAR > 17.exe3 - Win32/PSW.OnLineGames.YZT 特洛伊木马
E:\病毒\22.rar > RAR > 18.exe3 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种

显示全部楼层 · 发表于 2008-4-20 22:24:43

Scan : completed
----------------
Scanned: 86
Detected: 23
Untreated: 22
Start time: 2008-4-20 22:23:14
Duration: 00:00:17
Finish time: 2008-4-20 22:23:31

Detected
--------
Status Object
------ ------
detected: Trojan program Trojan-PSW.Win32.OnLineGames.abcw File: C:\Documents and Settings\Administrator\桌面\22.rar/19.exe3//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.zon File: C:\Documents and Settings\Administrator\桌面\22.rar/20.exe3//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.aayo File: C:\Documents and Settings\Administrator\桌面\22.rar/21.exe3//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.yzt File: C:\Documents and Settings\Administrator\桌面\22.rar/22.exe3//PE_Patch//UPack
detected: Trojan program Trojan-Downloader.Win32.Delf.axx File: C:\Documents and Settings\Administrator\桌面\22.rar/1.exe2//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.yzt File: C:\Documents and Settings\Administrator\桌面\22.rar/3.exe2//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.zjk File: C:\Documents and Settings\Administrator\桌面\22.rar/5.exe3//PE_Patch//UPack
not found: Trojan program Trojan-PSW.Win32.OnLineGames.zuq File: C:\Documents and Settings\Administrator\桌面\22.rar/6.exe3//#//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.aajs File: C:\Documents and Settings\Administrator\桌面\22.rar/7.exe3//PE_Patch//UPack
detected: Trojan program Trojan.Win32.Agent.kbw File: C:\Documents and Settings\Administrator\桌面\22.rar/9.exe3//PE_Patch//UPack
detected: Trojan program Trojan.Win32.Agent.kgy File: C:\Documents and Settings\Administrator\桌面\22.rar/10.exe3//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.abah File: C:\Documents and Settings\Administrator\桌面\22.rar/11.exe2//PE_Patch.UPX//UPX
detected: Trojan program Trojan.Win32.Agent.kgy File: C:\Documents and Settings\Administrator\桌面\22.rar/12.exe3//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.ztr File: C:\Documents and Settings\Administrator\桌面\22.rar/13.exe2//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.zph File: C:\Documents and Settings\Administrator\桌面\22.rar/23.exe2//#
detected: Trojan program Trojan-PSW.Win32.OnLineGames.yzt File: C:\Documents and Settings\Administrator\桌面\22.rar/14.exe2//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.abag File: C:\Documents and Settings\Administrator\桌面\22.rar/15.exe3//FSG
detected: Trojan program Trojan-PSW.Win32.OnLineGames.abcw File: C:\Documents and Settings\Administrator\桌面\22.rar/16.exe3//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.zph File: C:\Documents and Settings\Administrator\桌面\22.rar/17.exe3//#
detected: Trojan program Trojan-PSW.Win32.OnLineGames.aayo File: C:\Documents and Settings\Administrator\桌面\22.rar/18.exe3//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.yzt File: c:\documents and settings\administrator\桌面\22.rar/6.exe3//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.yzt File: c:\documents and settings\administrator\桌面\22.rar/23.exe2//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.yzt File: c:\documents and settings\administrator\桌面\22.rar/17.exe3//PE_Patch//UPack

Events
------
Time Name Status Reason
---- ---- ------ ------
2008-4-20 22:23:14 File: C:\Documents and Settings\Administrator\桌面\22.rar archive RAR
2008-4-20 22:23:14 File: C:\Documents and Settings\Administrator\桌面\22.rar/19.exe3 packed file PE_Patch
2008-4-20 22:23:14 File: C:\Documents and Settings\Administrator\桌面\22.rar/19.exe3//PE_Patch packed file UPack
2008-4-20 22:23:14 File: C:\Documents and Settings\Administrator\桌面\22.rar/19.exe3//PE_Patch//UPack detected: Trojan program 'Trojan-PSW.Win32.OnLineGames.abcw'
2008-4-20 22:23:14 File: C:\Documents and Settings\Administrator\桌面\22.rar/19.exe3//PE_Patch//UPack not disinfected postponed

Statistics
----------
Object Scanned Dangerous objects Untreated Deleted Moved to Quarantine Archives Packed files Password protected Corrupted
------ ------- ----------------- --------- ------- ------------------- -------- ------------ ------------------ ---------

Settings
--------
Parameter Value
--------- -----
Security Level Custom
Action Prompt for action when the scan is complete
Run mode Manually
File types Scan all files
Scan only new and changed files No
Scan archives all
Scan embedded OLE objects all
Do not scan archives larger than No
Skip if scan takes longer than No
Parse email formats No
Scan password-protected archives Yes
Use iChecker technology Yes
Use iSwift technology Yes
Register information about dangerous objects in application statistics Yes
Rootkit scan Yes
Extended rootkit scan Yes
Use heuristic analyser Yes
Heuristic analyser level 10

显示全部楼层 · 发表于 2008-4-20 22:31:24

C:\Documents and Settings\shi\桌面\22.rar > RAR > 19.exe3 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
C:\Documents and Settings\shi\桌面\22.rar > RAR > 20.exe3 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
C:\Documents and Settings\shi\桌面\22.rar > RAR > 21.exe3 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
C:\Documents and Settings\shi\桌面\22.rar > RAR > 22.exe3 - Win32/PSW.OnLineGames.YZT 特洛伊木马
C:\Documents and Settings\shi\桌面\22.rar > RAR > 1.exe2 - 可能是 Win32/PSW.WOW.WU 特洛伊木马的变种
C:\Documents and Settings\shi\桌面\22.rar > RAR > 2.exe2 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
C:\Documents and Settings\shi\桌面\22.rar > RAR > 3.exe2 - Win32/PSW.OnLineGames.MUG 特洛伊木马
C:\Documents and Settings\shi\桌面\22.rar > RAR > 4.exe3 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
C:\Documents and Settings\shi\桌面\22.rar > RAR > 5.exe3 - Win32/PSW.OnLineGames.ZJK 特洛伊木马的变种
C:\Documents and Settings\shi\桌面\22.rar > RAR > 6.exe3 - Win32/PSW.OnLineGames.MUG 特洛伊木马
C:\Documents and Settings\shi\桌面\22.rar > RAR > 7.exe3 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
C:\Documents and Settings\shi\桌面\22.rar > RAR > 9.exe3 - Win32/PSW.OnLineGames.NML 特洛伊木马的变种
C:\Documents and Settings\shi\桌面\22.rar > RAR > 8.exe2 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
C:\Documents and Settings\shi\桌面\22.rar > RAR > 10.exe3 - Win32/PSW.OnLineGames.NML 特洛伊木马的变种
C:\Documents and Settings\shi\桌面\22.rar > RAR > 11.exe2 - Win32/PSW.OnLineGames.NFL 特洛伊木马
C:\Documents and Settings\shi\桌面\22.rar > RAR > 12.exe3 - Win32/PSW.OnLineGames.NML 特洛伊木马的变种
C:\Documents and Settings\shi\桌面\22.rar > RAR > 13.exe2 - Win32/PSW.OnLineGames.NML 特洛伊木马的变种
C:\Documents and Settings\shi\桌面\22.rar > RAR > 23.exe2 - Win32/PSW.OnLineGames.YZT 特洛伊木马
C:\Documents and Settings\shi\桌面\22.rar > RAR > 14.exe2 - Win32/PSW.OnLineGames.YZT 特洛伊木马
C:\Documents and Settings\shi\桌面\22.rar > RAR > 15.exe3 - Win32/PSW.OnLineGames.NFL 特洛伊木马
C:\Documents and Settings\shi\桌面\22.rar > RAR > 16.exe3 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
C:\Documents and Settings\shi\桌面\22.rar > RAR > 17.exe3 - Win32/PSW.OnLineGames.YZT 特洛伊木马
C:\Documents and Settings\shi\桌面\22.rar > RAR > 18.exe3 - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种

[病毒样本] 23

本帖子中包含更多资源

回复 3楼 wangjay1980 的帖子

40/19

浏览过的版块