[病毒样本] 68

显示全部楼层 · 发表于 2008-4-29 15:25:29

Scanned file: 2.rar - Infected
2.rar/yuiabct.exe3 - infected by Trojan-PSW.Win32.OnLineGames.abwp
2.rar/dqHADHAD1067.exe3 - infected by Trojan-PSW.Win32.OnLineGames.acfw
2.rar/eacynbuz.exe2 - infected by Trojan-PSW.Win32.OnLineGames.acai
2.rar/fiosectc.dll - infected by Trojan-PSW.Win32.OnLineGames.yao
2.rar/fiosectc.exe3 - infected by Trojan-PSW.Win32.OnLineGames.abzs
2.rar/fmbiost.dll - infected by Trojan-PSW.Win32.OnLineGames.ybi
2.rar/fmbiost.exe2 - infected by Trojan-PSW.Win32.OnLineGames.abzn
2.rar/fmsbbqi.dll - infected by Trojan-PSW.Win32.OnLineGames.abtw
2.rar/fmsbbqi.exe3 - infected by Trojan-PSW.Win32.OnLineGames.abto
2.rar/fmsjhif.dll - infected by Trojan-PSW.Win32.OnLineGames.ybx
2.rar/fmsjhif.exe3 - infected by Trojan-PSW.Win32.OnLineGames.acbx
2.rar/GDIPFONTCACHEV1.DAT - OK
2.rar/mfchlp64.dll - infected by Trojan-PSW.Win32.OnLineGames.abxm
2.rar/mfchlp64.exe2 - infected by Trojan-PSW.Win32.OnLineGames.abum
2.rar/msosmhfp.dat - OK
2.rar/msosping.dat - OK
2.rar/nfacbkrb.dll - infected by Trojan-PSW.Win32.OnLineGames.ycl
2.rar/nvapps.xml - OK
2.rar/pedadt.dll - infected by Trojan-PSW.Win32.OnLineGames.aaqh
2.rar/Rar$LS45.031 - OK
2.rar/REGLOCS.OLD - OK
2.rar/ReloadAnti.sys - infected by Rootkit.Win32.Agent.ajv
2.rar/SysWoWa8.dll - OK
2.rar/SysWoWa8.dll - OK
2.rar/TASKMAN.EXE3 - OK
2.rar/XNGAnti.sys - infected by Rootkit.Win32.Agent.ajv

Statistics:
Scanned file: 1.rar - Infected
1.rar/anistio.exE3 - infected by Trojan-PSW.Win32.OnLineGames.acch
1.rar/beep.sys - infected by Backdoor.Win32.Agent.gfh
1.rar/bincdwsa.dll - infected by Trojan-PSW.Win32.OnLineGames.xzy
1.rar/bincdwsa.exe3 - infected by Trojan-PSW.Win32.OnLineGames.abtp
1.rar/bootstet.dat - OK
1.rar/dbhlp32.dlL - infected by Trojan-PSW.Win32.OnLineGames.yai
1.rar/dbhlp32.exe3 - infected by Trojan-PSW.Win32.OnLineGames.abtl
1.rar/dndsioc.dll - infected by Trojan-PSW.Win32.OnLineGames.yaj
1.rar/dndsioc.exe3 - infected by Trojan-PSW.Win32.OnLineGames.abud
1.rar/dqHADHAD1067.dll - infected by Trojan-PSW.Win32.OnLineGames.acfw
1.rar/~DF9A2A.tmp - OK
1.rar/~DFCBF9.tmp - OK
1.rar/2E21AD02.DLL - OK
1.rar/5.exe3 - infected by Trojan-PSW.Win32.OnLineGames.acfk
1.rar/6.exe4 - infected by Trojan.Win32.Agent.kqv
1.rar/8.exe2 - infected by Trojan.Win32.Agent.kqv
1.rar/9DABBE9A.EXE3 - infected by Backdoor.Win32.Popwin.bdl
1.rar/14.exe3 - infected by Trojan.Win32.Agent.krs
1.rar/15.exe3 - infected by Backdoor.Win32.Agent.hau
1.rar/17.exe3 - infected by Trojan-PSW.Win32.OnLineGames.acgv
1.rar/18.exe3 - infected by Trojan.Win32.Agent.kmo
1.rar/20.exe4 - infected by Trojan-PSW.Win32.QQPass.bsi
1.rar/21.exe4 - infected by Trojan.Win32.Agent.ktp
1.rar/22.exe4 - infected by Trojan.Win32.Agent.kuw
1.rar/25.exe4 - infected by Trojan.Win32.Agent.kuw
1.rar/29.exe4 - infected by Trojan-PSW.Win32.OnLineGames.zvr
1.rar/30.exe4 - infected by Trojan.Win32.Agent.kuw
1.rar/33.exe4 - infected by Trojan.Win32.Agent.kuw
1.rar/1323.dll - OK
1.rar/anistio.dll - infected by Trojan-PSW.Win32.OnLineGames.accg

不报的已上报卡巴

Hello,

1323.dll, bootstet.dat, GDIPFONTCACHEV1.DAT, msosmhfp.dat, msosping.dat, nvapps.xml, Rar$LS45.031, REGLOCS.OLD, TASKMAN.exe_, ~DF9A2A.tmp_, ~DFCBF9.tmp_

No malicious code were found in these files.

2E21AD02.DLL - Trojan-Downloader.Win32.Flux.ft,
SysWoWa8.dll - Trojan-PSW.Win32.OnLineGames.acjo

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

anistio.dll - Trojan-PSW.Win32.OnLineGames.accg

This file is already detected. Please update your antivirus bases.

Please quote all when answering.

--
Best regards, Yury Nesmachny
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-4-29 19:25 编辑 ]

显示全部楼层 · 发表于 2008-4-29 15:34:40

解压时，微点报这么多。
时间处理结果木马名称木马进程名木马文件创建者
2008-04-29 15:31:38 处理成功 Trojan-PSW.Win32.OL-Game.hmx E:\ \VIRUS TEST\2\PEDADT.DLL D:\WINRAR\WINRAR.EXE
2008-04-29 15:31:36 处理成功 Trojan-PSW.Win32.OL-Game.knb E:\ \VIRUS TEST\2\MFCHLP64.EXE2 D:\WINRAR\WINRAR.EXE
2008-04-29 15:31:34 处理成功 Trojan-PSW.Win32.OL-Game.kiy E:\ \VIRUS TEST\2\FMSJHIF.EXE3 D:\WINRAR\WINRAR.EXE
2008-04-29 15:31:32 处理成功 Trojan-PSW.Win32.OL-Game.kpb E:\ \VIRUS TEST\2\FMSJHIF.DLL D:\WINRAR\WINRAR.EXE
2008-04-29 15:31:30 处理成功 Trojan-PSW.Win32.OL-Game.hvy E:\ \VIRUS TEST\2\FMSBBQI.EXE3 D:\WINRAR\WINRAR.EXE
2008-04-29 15:31:28 处理成功 Trojan-PSW.Win32.OL-Game.kjh E:\ \VIRUS TEST\2\FMBIOST.EXE2 D:\WINRAR\WINRAR.EXE
2008-04-29 15:31:26 处理成功 Trojan-PSW.Win32.OL-Game.klv E:\ \VIRUS TEST\2\FIOSECTC.EXE3 D:\WINRAR\WINRAR.EXE
2008-04-29 15:31:24 处理成功 Trojan-PSW.Win32.OL-Game.klh E:\ \VIRUS TEST\2\EACYNBUZ.EXE2 D:\WINRAR\WINRAR.EXE
2008-04-29 15:31:21 处理成功 Trojan.Win32.Genetik.hon E:\ \VIRUS TEST\2\DQHADHAD1067.EXE3 D:\WINRAR\WINRAR.EXE
2008-04-29 15:31:19 处理成功 Trojan-PSW.Win32.OL-Game.jet E:\ \VIRUS TEST\2\YUIABCT.EXE3 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:45 处理成功 Trojan.Win32.Agent.mlb E:\ \VIRUS TEST\1\33.EXE4 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:43 处理成功 Trojan.Win32.Agent.mmg E:\ \VIRUS TEST\1\30.EXE4 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:41 处理成功 Trojan-PSW.Win32.OL-Game.djb E:\ \VIRUS TEST\1\29.EXE4 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:39 处理成功 Trojan.Win32.Agent.mkn E:\ \VIRUS TEST\1\25.EXE4 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:36 处理成功 Trojan.Win32.Agent.mkc E:\ \VIRUS TEST\1\22.EXE4 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:34 处理成功 Trojan.Win32.Agent.mlq E:\ \VIRUS TEST\1\21.EXE4 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:32 处理成功 Trojan-PSW.Win32.QQPass.jlc E:\ \VIRUS TEST\1\20.EXE4 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:29 处理成功 Trojan.Win32.Agent.mij E:\ \VIRUS TEST\1\18.EXE3 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:27 处理成功 Backdoor.Win32.Agent.glr E:\ \VIRUS TEST\1\15.EXE3 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:25 处理成功 Trojan.Win32.Agent.miz E:\ \VIRUS TEST\1\14.EXE3 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:23 处理成功 Backdoor.Win32.Popwin.ew E:\ \VIRUS TEST\1\9DABBE9A.EXE3 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:20 处理成功 Trojan.Win32.Agent.min E:\ \VIRUS TEST\1\8.EXE2 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:17 处理成功 Trojan.Win32.Agent.mio E:\ \VIRUS TEST\1\6.EXE4 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:15 处理成功 Trojan-PSW.Win32.OL-Game.kof E:\ \VIRUS TEST\1\5.EXE3 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:13 处理成功 Trojan-PSW.Win32.OL-Game.jib E:\ \VIRUS TEST\1\DNDSIOC.EXE3 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:10 处理成功 Trojan-PSW.Win32.OL-Game.jgq E:\ \VIRUS TEST\1\DBHLP32.EXE3 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:07 处理成功 Trojan-PSW.Win32.OL-Game.jgg E:\ \VIRUS TEST\1\BINCDWSA.EXE3 D:\WINRAR\WINRAR.EXE
2008-04-29 15:30:03 处理成功 Trojan-PSW.Win32.OL-Game.kgw E:\ \VIRUS TEST\1\ANISTIO.EXE3 D:\WINRAR\WINRAR.EXE

显示全部楼层 · 发表于 2008-4-29 15:37:11

总数只有55个，红伞余下11个，上报。微点余下27个。

[ 本帖最后由 HC303 于 2008-4-29 15:38 编辑 ]

显示全部楼层 · 发表于 2008-4-29 15:39:20

25003831  1323.dll  64 KB  UNDER ANALYSIS
25003832  ~DF9A2A.tmp  32 KB  UNDER ANALYSIS
25003833  GDIPFONTCACHEV1.DAT  19.6 KB  UNDER ANALYSIS
25003834  msosmhfp.dat  256 Byte  UNDER ANALYSIS
25003835  msosping.dat  128 Byte  UNDER ANALYSIS
25003836  nvapps.xml  79.29 KB  UNDER ANALYSIS
25003837  Rar$LS45.031  323 Byte  UNDER ANALYSIS
25003838  REGLOCS.OLD  8 KB  UNDER ANALYSIS
1084443  bootstet.dat  2 KB  KNOWN CLEAN
539573  ~DFCBF9.tmp  16 KB  KNOWN CLEAN
206786  TASKMAN.EXE3  15 KB  KNOWN CLEAN

显示全部楼层 · 发表于 2008-4-29 19:24:51

Hello,

1323.dll, bootstet.dat, GDIPFONTCACHEV1.DAT, msosmhfp.dat, msosping.dat, nvapps.xml, Rar$LS45.031, REGLOCS.OLD, TASKMAN.exe_, ~DF9A2A.tmp_, ~DFCBF9.tmp_

No malicious code were found in these files.

2E21AD02.DLL - Trojan-Downloader.Win32.Flux.ft,
SysWoWa8.dll - Trojan-PSW.Win32.OnLineGames.acjo

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

anistio.dll - Trojan-PSW.Win32.OnLineGames.accg

This file is already detected. Please update your antivirus bases.

Please quote all when answering.

--
Best regards, Yury Nesmachny
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

显示全部楼层 · 发表于 2008-4-29 19:30:33

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.GamesOnline.vp
病毒： RootKit.Win32.Undef.ex
病毒： Trojan.PSW.Win32.GameOL.nei
病毒： Trojan.PSW.Win32.GameOL.nee
病毒： Trojan.PSW.Win32.GameOL.ndv
病毒： Trojan.PSW.Win32.GameOL.nga
病毒： Backdoor.Win32.Popwin.azv
病毒： Trojan.PSW.Win32.SunOnline.nt
病毒： Trojan.PSW.Win32.GameOL.nfx
病毒： Backdoor.Win32.Popwin.azu
病毒： Trojan.PSW.Win32.GameOL.nas
病毒： Trojan.PSW.Win32.GameOL.ngm
病毒： Worm.Win32.PaBug.gfg
病毒： Trojan.PSW.Win32.GameOL.nfw
病毒： Trojan.PSW.Win32.GameOL.nhx
病毒： Trojan.PSW.Win32.GameOL.mxu
病毒： Trojan.PSW.Win32.SunOnline.np
病毒： Suspicious.Trojan.Win32.DelSelf.a
病毒： Trojan.PSW.Win32.QQSG.dr
病毒： Trojan.PSW.Win32.GamesOnline.vq
病毒： Trojan.PSW.Win32.SO2Game.x
病毒： Trojan.PSW.Win32.GameOL.ndw
病毒： Trojan.PSW.Win32.GameOL.neh
病毒： Trojan.PSW.Win32.GameOL.neh
病毒： Trojan.PSW.Win32.GameOL.muo
病毒： RootKit.Win32.Mnless.np

MAC 地址：00:17:31:40:A3:57

用户来源：局域网

软件版本：20.42.12

显示全部楼层 · 发表于 2008-4-29 20:51:19

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GamesOnline.vp
病毒： RootKit.Win32.Undef.ex
病毒： Trojan.PSW.Win32.GameOL.nei
病毒： Trojan.PSW.Win32.GameOL.nee
病毒： Trojan.PSW.Win32.GameOL.ndv
病毒： Trojan.PSW.Win32.GameOL.nga
病毒： Backdoor.Win32.Popwin.azv
病毒： Trojan.PSW.Win32.SunOnline.nt
病毒： Trojan.PSW.Win32.GameOL.nfx
病毒： Backdoor.Win32.Popwin.azu
病毒： Trojan.PSW.Win32.GameOL.nas
病毒： Trojan.PSW.Win32.GameOL.ngm
病毒： Worm.Win32.PaBug.gfg
病毒： Trojan.PSW.Win32.GameOL.nfw
病毒： Trojan.PSW.Win32.GameOL.nhx
病毒： Trojan.PSW.Win32.GameOL.mxu
病毒： Trojan.PSW.Win32.SunOnline.np
病毒： Suspicious.Trojan.Win32.DelSelf.a
病毒： Trojan.PSW.Win32.QQSG.dr
病毒： Trojan.PSW.Win32.GamesOnline.vq
病毒： Trojan.PSW.Win32.SO2Game.x
病毒： Trojan.PSW.Win32.GameOL.ndw
病毒： Trojan.PSW.Win32.GameOL.neh
病毒： Trojan.PSW.Win32.GameOL.neh
病毒： Trojan.PSW.Win32.GameOL.muo
病毒： RootKit.Win32.Mnless.np

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.42.12

显示全部楼层 · 发表于 2008-4-29 21:02:08

[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\1.rar->anistio.exE3->(FSG)
[Found backdoor] <W32/Backdoor2.AMXC (exact, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\1.rar->beep.sys
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\1.rar->bincdwsa.exe3->(FSG)
[Found password stealer] <W32/OnlineGames.AD.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\1.rar->dbhlp32.dlL
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\1.rar->dbhlp32.exe3->(FSG)
[Found password stealer] <W32/OnlineGames.AD.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\1.rar->dndsioc.dll
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\1.rar->dndsioc.exe3->(FSG)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\1.rar->dqHADHAD1067.dll->(UPack)
[Found downloader] <W32/Downloader.C.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\1.rar->2E21AD02.DLL
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\1.rar->5.exe3
[Found possible security risk] <W32/Heuristic-210!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\1.rar->6.exe4->(UPack)
[Found possible security risk] <W32/Heuristic-210!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\1.rar->8.exe2->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\1.rar->9DABBE9A.EXE3->(UPack)
[Found possible security risk] <W32/Heuristic-210!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\1.rar->14.exe3->(UPack)
[Found virus] <W32/Downloader.gen10 (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\1.rar->15.exe3
[Found possible security risk] <W32/Heuristic-210!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\1.rar->17.exe3->(UPack)
[Found possible security risk] <W32/Heuristic-210!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\1.rar->18.exe3->(UPack)
[Found security risk] <W32/AutoRun.D.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\1.rar->20.exe4->(UPX)
[Found possible security risk] <W32/Heuristic-210!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\1.rar->21.exe4->(UPack)
[Found possible security risk] <W32/Heuristic-210!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\1.rar->22.exe4->(UPack)
[Found possible security risk] <W32/Heuristic-210!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\1.rar->25.exe4->(UPack)
[Found possible security risk] <W32/Heuristic-210!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\1.rar->29.exe4->(embedded)->(UPack)
[Found possible security risk] <W32/Heuristic-210!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\1.rar->30.exe4->(UPack)
[Found possible security risk] <W32/Heuristic-210!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\1.rar->33.exe4->(UPack)
[Found password stealer] <W32/OnlineGames.AD.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\1.rar->anistio.dll
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.rar->yuiabct.exe3->(FSG)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.rar->dqHADHAD1067.exe3->exefile->(UPack)
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.rar->eacynbuz.exe2->(FSG)
[Found password stealer] <W32/OnlineGames.AD.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.rar->fiosectc.dll
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.rar->fiosectc.exe3->(FSG)
[Found password stealer] <W32/OnlineGames.AD.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.rar->fmbiost.dll
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.rar->fmbiost.exe2->(FSG)
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.rar->fmsbbqi.exe3->(FSG)
[Found password stealer] <W32/OnlineGames.AD.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.rar->fmsjhif.dll
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.rar->fmsjhif.exe3->(FSG)
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.rar->mfchlp64.exe2->(FSG)
[Found password stealer] <W32/OnlineGames.AD.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\2.rar->nfacbkrb.dll
[Found possible security risk] <W32/Heuristic-210!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\2.rar->pedadt.dll->(UPack)
[Found possible security risk] <W32/Heuristic-210!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\2.rar->SysWoWa8.dll->(UPack)

---------------------------------------------------------------------
Scan ended: 2008-4-29, 21:01:33
Duration: 0:00:22

Scan result:

Scanned files:    7
Infected objects:    39
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-4-29 21:02:44

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:anistio.exE3 <- Trojan.Psw.Onlinegames.Acch : No action
C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:anistio.exE3<FSG>:anistio.exE3<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Accg : No action
C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:bincdwsa.dll <- Trojan.Psw.Onlinegames.Xzy : No action
C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:bincdwsa.exe3<FSG>:bincdwsa.exe3 <- Trojan.Psw.Onlinegames.Abtp : No action
C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:bincdwsa.exe3<FSG>:bincdwsa.exe3<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Xzy : No action
C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:dbhlp32.dlL <- Trojan.Psw.Onlinegames.Yai : No action
C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:dbhlp32.exe3<FSG>:dbhlp32.exe3 <- Trojan.Psw.Onlinegames.Abtl : No action
C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:dbhlp32.exe3<FSG>:dbhlp32.exe3<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Abtl : No action
C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:dndsioc.dll <- Trojan.Psw.Onlinegames.Yaj : No action
C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:dndsioc.exe3<FSG>:dndsioc.exe3 <- Trojan.Psw.Onlinegames.Abud : No action
C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:9DABBE9A.EXE3<UPack>:9DABBE9A.EXE3 <- Trojan.Popwin.Bdl : No action
C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:15.exe3 <- Trojan.Agent.Hau : No action
C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:15.exe3<UPX>:15.exe3 <- Variant:Trojan.Spy.Delf.Vk : No action
C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:20.exe4 <- Trojan.Psw.Qqpass.Bsi : No action
C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:20.exe4<UPX>:20.exe4<DLLRES>:FILE0.exe <- Trojan.Psw.Qqpass.Bsj : No action
C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:anistio.dll <- Trojan.Psw.Onlinegames.Accg : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:yuiabct.exe3 <- Trojan.Psw.Onlinegames.Abwp : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:yuiabct.exe3<FSG>:yuiabct.exe3<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Abwn : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:eacynbuz.exe2 <- Trojan.Psw.Onlinegames.Acai : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:eacynbuz.exe2<FSG>:eacynbuz.exe2<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Ycl : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:fiosectc.dll <- Trojan.Psw.Onlinegames.Yao : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:fiosectc.exe3 <- Trojan.Psw.Onlinegames.Abzs : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:fiosectc.exe3<FSG>:fiosectc.exe3<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Yao : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:fmbiost.dll <- Trojan.Psw.Onlinegames.Ybi : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:fmbiost.exe2 <- Trojan.Psw.Onlinegames.Abzn : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:fmbiost.exe2<FSG>:fmbiost.exe2<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Ybi : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:fmsbbqi.dll <- Trojan.Psw.Onlinegames.Abtw : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:fmsbbqi.exe3<FSG>:fmsbbqi.exe3<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Abtw : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:fmsjhif.dll <- Trojan.Psw.Onlinegames.Ybx : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:fmsjhif.exe3 <- Trojan.Psw.Onlinegames.Acbx : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:fmsjhif.exe3<FSG>:fmsjhif.exe3<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Ybx : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:mfchlp64.dll <- Trojan.Psw.Onlinegames.Abxm : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:mfchlp64.exe2<FSG>:mfchlp64.exe2 <- Trojan.Psw.Onlinegames.Abum : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:mfchlp64.exe2<FSG>:mfchlp64.exe2<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Abxm : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:nfacbkrb.dll <- Trojan.Psw.Onlinegames.Ycl : No action
C:\Documents and Settings\All Users\Documents\Test\2.rar<RAR>:pedadt.dll<UPack>:pedadt.dll <- Trojan.Psw.Onlinegames.Aaqh : No action

Scanned objects : 103

Infected objects : 36

显示全部楼层 · 发表于 2008-4-30 08:09:30

25003831  1323.dll  64 KB  CLEAN
25003832  ~DF9A2A.tmp  32 KB  DAMAGED FILE (UNKNOWN)
25003833  GDIPFONTCACHEV1.DAT  19.6 KB  DAMAGED FILE (UNKNOWN)
25003834  msosmhfp.dat  256 Byte  CLEAN
25003835  msosping.dat  128 Byte  CLEAN
25003836  nvapps.xml  79.29 KB  CLEAN
25003837  Rar$LS45.031  323 Byte  CLEAN
25003838  REGLOCS.OLD  8 KB  CLEAN
1084443  bootstet.dat  2 KB  KNOWN CLEAN
539573  ~DFCBF9.tmp  16 KB  KNOWN CLEAN
206786  TASKMAN.EXE3  15 KB  KNOWN CLEAN

[病毒样本] 68

本帖子中包含更多资源

98/41

98/41