[病毒样本] 13

显示全部楼层 · 发表于 2008-5-3 21:26:04

已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Agent.ntx 檔案: C:\Documents and Settings\kato9096\桌面\複製 -机器狗1(穿0329).rar/systemoo.exe
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.acqz 檔案: C:\Documents and Settings\kato9096\桌面\複製 -机器狗2.rar/dionpis.exe//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.abus 檔案: C:\Documents and Settings\kato9096\桌面\複製 -机器狗2.rar/fmsiocps.exe//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.accg 檔案: C:\Documents and Settings\kato9096\桌面\複製 -机器狗2.rar/anistio.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.acch 檔案: C:\Documents and Settings\kato9096\桌面\複製 -机器狗2.rar/anistio.exE//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.acai 檔案: C:\Documents and Settings\kato9096\桌面\複製 -机器狗2.rar/uqgqodbh.exe//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.acpy 檔案: C:\Documents and Settings\kato9096\桌面\複製 -机器狗2.rar/dbhlp32.dlL
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.acpy 檔案: C:\Documents and Settings\kato9096\桌面\複製 -机器狗2.rar/dbhlp32.exe//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.acsv 檔案: C:\Documents and Settings\kato9096\桌面\複製 -机器狗2.rar/WINSvr64.exe//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.acqe 檔案: C:\Documents and Settings\kato9096\桌面\複製 -机器狗2.rar/dionpis.dll
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.abut 檔案: C:\Documents and Settings\kato9096\桌面\複製 -机器狗2.rar/fmsiocps.dll

卡巴报十一个,已上报2个

卡巴:
tppoll.exe_

No malicious code were found in these files.

WINSvr64.dll - Trojan-Downloader.Win32.Agent.obt

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

[ 本帖最后由 kato9096 于 2008-5-4 19:23 编辑 ]

显示全部楼层 · 发表于 2008-5-3 21:33:40

显示全部楼层 · 发表于 2008-5-3 21:38:09

D:\Documents and Settings\EKINCHENG\桌面\13.rar » RAR » dionpis.exe2 - probably a variant of Win32/PSW.OnLineGames.NFL trojan
D:\Documents and Settings\EKINCHENG\桌面\13.rar » RAR » fmsiocps.exe2 - probably a variant of Win32/PSW.OnLineGames.NFL trojan
D:\Documents and Settings\EKINCHENG\桌面\13.rar » RAR » anistio.dll - probably a variant of Win32/PSW.OnLineGames.NFL trojan
D:\Documents and Settings\EKINCHENG\桌面\13.rar » RAR » anistio.exE2 - probably a variant of Win32/PSW.OnLineGames.NFL trojan
D:\Documents and Settings\EKINCHENG\桌面\13.rar » RAR » uqgqodbh.exe2 - probably a variant of Win32/PSW.OnLineGames.NFL trojan
D:\Documents and Settings\EKINCHENG\桌面\13.rar » RAR » dbhlp32.dlL - a variant of Win32/PSW.OnLineGames.NVW trojan
D:\Documents and Settings\EKINCHENG\桌面\13.rar » RAR » dbhlp32.exe2 - probably a variant of Win32/PSW.OnLineGames.NFL trojan
D:\Documents and Settings\EKINCHENG\桌面\13.rar » RAR » WINSvr64.dll - a variant of Win32/PSW.OnLineGames.NVW trojan
D:\Documents and Settings\EKINCHENG\桌面\13.rar » RAR » WINSvr64.exe2 - probably a variant of Win32/PSW.OnLineGames.NFL trojan
D:\Documents and Settings\EKINCHENG\桌面\13.rar » RAR » dionpis.dll - a variant of Win32/PSW.OnLineGames.NVW trojan
D:\Documents and Settings\EKINCHENG\桌面\13.rar » RAR » fmsiocps.dll - a variant of Win32/PSW.OnLineGames.NVW trojan

显示全部楼层 · 发表于 2008-5-3 23:22:21

Begin scan in 'E:\VIRUS\13.rar'
E:\VIRUS\13.rar
E:\VIRUS\13.rar
  [0] Archive type: RAR
  --> fmsiocps.exe2
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.50
  --> anistio.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
--> uqgqodbh.exe2
      [DETECTION] Is the Trojan horse TR/Onlinegames.NVI
  --> dbhlp32.dlL
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> WINSvr64.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
--> WINSvr64.exe2
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
  --> dionpis.dll
   [DETECTION] Is the Trojan horse TR/Spy.Gen
  --> fmsiocps.dll
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.51
  --> systemoo.exe2
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.ntx
   [WARNING] The file was ignored!

End of the scan: 2008年5月3日  23:19
Used time: 00:06 min

The scan has been done completely.

   0 Scanning directories
   14 Files were scanned
   12 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   2 Files not concerned
   1 Archives were scanned
   1 Warnings
   0 Notes

The file 'tppoll.exe' has been determined to be 'UNDER ANALYSIS'.

显示全部楼层 · 发表于 2008-5-3 23:24:27

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\13.rar<RAR>:fmsiocps.exe2<FSG>:fmsiocps.exe2 <- Trojan.Psw.Onlinegames.Abus : No action
C:\Documents and Settings\All Users\Documents\Test\13.rar<RAR>:fmsiocps.exe2<FSG>:fmsiocps.exe2<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Abut : No action
C:\Documents and Settings\All Users\Documents\Test\13.rar<RAR>:anistio.dll <- Trojan.Psw.Onlinegames.Accg : No action
C:\Documents and Settings\All Users\Documents\Test\13.rar<RAR>:anistio.exE2 <- Trojan.Psw.Onlinegames.Acch : No action
C:\Documents and Settings\All Users\Documents\Test\13.rar<RAR>:anistio.exE2<FSG>:anistio.exE2<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Accg : No action
C:\Documents and Settings\All Users\Documents\Test\13.rar<RAR>:uqgqodbh.exe2 <- Trojan.Psw.Onlinegames.Acai : No action
C:\Documents and Settings\All Users\Documents\Test\13.rar<RAR>:uqgqodbh.exe2<FSG>:uqgqodbh.exe2<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Ycl : No action
C:\Documents and Settings\All Users\Documents\Test\13.rar<RAR>:dbhlp32.dlL <- Trojan.Psw.Onlinegames.Acpy : No action
C:\Documents and Settings\All Users\Documents\Test\13.rar<RAR>:dbhlp32.exe2 <- Trojan.Psw.Onlinegames.Acpy : No action
C:\Documents and Settings\All Users\Documents\Test\13.rar<RAR>:dbhlp32.exe2<FSG>:dbhlp32.exe2<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Acpy : No action
C:\Documents and Settings\All Users\Documents\Test\13.rar<RAR>:fmsiocps.dll <- Trojan.Psw.Onlinegames.Abut : No action

Scanned objects : 28

Infected objects : 11

显示全部楼层 · 发表于 2008-5-3 23:25:08

[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\13.rar->dionpis.exe2->(FSG)
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\13.rar->fmsiocps.exe2->(FSG)
[Found password stealer] <W32/OnlineGames.AD.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\13.rar->anistio.dll
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\13.rar->anistio.exE2->(FSG)
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\13.rar->uqgqodbh.exe2->(FSG)
[Found password stealer] <W32/OnlineGames.AD.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\13.rar->dbhlp32.dlL
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\13.rar->dbhlp32.exe2->(FSG)
[Found password stealer] <W32/OnlineGames.AD.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\13.rar->WINSvr64.dll
[Found security risk] <W32/Injector.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\13.rar->WINSvr64.exe2->(FSG)
[Found password stealer] <W32/OnlineGames.AD.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\13.rar->dionpis.dll
[Found password stealer] <W32/OnlineGames.AD.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\13.rar->fmsiocps.dll
[Found virus] <W32/Downloader.gen10 (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\13.rar->systemoo.exe2->exefile

---------------------------------------------------------------------
Scan ended: 2008-5-3, 23:24:56
Duration: 0:00:02

Scan result:

Scanned files:    6
Infected objects:    12
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-5-4 10:20:04

13.rar\dionpis.exe2;C:\Documents and Settings\Administrator\桌面\13.rar;Trojan.PWS.Gamania.9729;;
13.rar\fmsiocps.exe2;C:\Documents and Settings\Administrator\桌面\13.rar;Trojan.PWS.Wsgame.origin;;
13.rar\anistio.exE2;C:\Documents and Settings\Administrator\桌面\13.rar;Trojan.PWS.Wsgame.origin;;
13.rar\uqgqodbh.exe2;C:\Documents and Settings\Administrator\桌面\13.rar;Trojan.PWS.Wsgame.4883;;
13.rar\dbhlp32.exe2;C:\Documents and Settings\Administrator\桌面\13.rar;Trojan.PWS.Wsgame.origin;;
13.rar\WINSvr64.dll;C:\Documents and Settings\Administrator\桌面\13.rar;Trojan.PWS.Wsgame.origin;;
13.rar\WINSvr64.exe2;C:\Documents and Settings\Administrator\桌面\13.rar;Trojan.PWS.Wsgame.origin;;
13.rar\fmsiocps.dll;C:\Documents and Settings\Administrator\桌面\13.rar;Trojan.PWS.Wsgame.origin;;
systemoo.exe2\data002;C:\Documents and Settings\Administrator\桌面\13.rar\systemoo.exe2;可能 DLOADER.Trojan;;
systemoo.exe2;C:\Documents and Settings\Administrator\桌面\13.rar;发现压缩文件中有被感染的对象;;
13.rar;C:\Documents and Settings\Administrator\桌面;发现压缩文件中有被感染的对象;;

显示全部楼层 · 发表于 2008-5-4 10:27:10

2008-5-4 10:34:37 文件感染: C:\Documents and Settings\zh\桌面\anistio.dll 为 Win32/Frethog!generic trojan。已删除
2008-5-4 10:34:38 文件感染: C:\Documents and Settings\zh\桌面\anistio.exE2 为 Win32/Frethog.ATB trojan。已删除
2008-5-4 10:34:38 文件感染: C:\Documents and Settings\zh\桌面\dbhlp32.dlL 为 Win32/Frethog!generic trojan。已删除
2008-5-4 10:34:38 文件感染: C:\Documents and Settings\zh\桌面\WINSvr64.dll 为 Win32/Frethog!generic trojan。已删除
2008-5-4 10:34:38 文件感染: C:\Documents and Settings\zh\桌面\dionpis.dll 为 Win32/Frethog!generic trojan。已删除
2008-5-4 10:34:38 文件感染: C:\Documents and Settings\zh\桌面\fmsiocps.dll 为 Win32/Frethog!generic trojan。已删除

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.GameOL.nfd
病毒： Trojan.PSW.Win32.GamesOnline.vp
病毒： Trojan.PSW.Win32.QQSG.dr

用户来源：互联网

软件版本：20.42.50
5个

显示全部楼层 · 发表于 2008-5-4 11:01:39

C:\Users\HP\Desktop\13.rar > RAR > dionpis.exe2 - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
C:\Users\HP\Desktop\13.rar > RAR > fmsiocps.exe2 - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
C:\Users\HP\Desktop\13.rar > RAR > anistio.dll - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
C:\Users\HP\Desktop\13.rar > RAR > anistio.exE2 - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
C:\Users\HP\Desktop\13.rar > RAR > uqgqodbh.exe2 - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
C:\Users\HP\Desktop\13.rar > RAR > dbhlp32.dlL - Win32/PSW.OnLineGames.NVW 特洛伊木马的变种
C:\Users\HP\Desktop\13.rar > RAR > dbhlp32.exe2 - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
C:\Users\HP\Desktop\13.rar > RAR > WINSvr64.dll - Win32/PSW.OnLineGames.NVW 特洛伊木马的变种
C:\Users\HP\Desktop\13.rar > RAR > WINSvr64.exe2 - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
C:\Users\HP\Desktop\13.rar > RAR > dionpis.dll - Win32/PSW.OnLineGames.NVW 特洛伊木马的变种
C:\Users\HP\Desktop\13.rar > RAR > fmsiocps.dll - Win32/PSW.OnLineGames.NVW 特洛伊木马的变种

ess3.0

显示全部楼层 · 发表于 2008-5-4 11:11:56

信息 2008-05-04  11:11:48 您此次查毒清除了6个病毒
信息 2008-05-04  11:11:48 您此次查毒共查出6个病毒以及危险代码
信息 2008-05-04  11:11:48 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件23个
信息 2008-05-04  11:11:48 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-05-04  11:11:48 D:\Desktop\13.rar\systemoo.exe2 Win32.TrojDownloader.Agent.26462 清除成功
病毒 2008-05-04  11:11:48 D:\Desktop\13.rar\fmsiocps.dll Win32.Troj.OnlineGameT.nl.31004 清除成功
病毒 2008-05-04  11:11:47 D:\Desktop\13.rar\uqgqodbh.exe2 Win32.Troj.GameOnlineT.nf.69897 清除成功
病毒 2008-05-04  11:11:47 D:\Desktop\13.rar\anistio.exE2 Win32.Troj.GameOnlineT.nf.69897 清除成功
病毒 2008-05-04  11:11:47 D:\Desktop\13.rar\anistio.dll Win32.PSWTroj.OnlineGames.24860 清除成功
病毒 2008-05-04  11:11:47 D:\Desktop\13.rar\fmsiocps.exe2 Win32.Troj.GameOnlineT.nf.69897 清除成功

[病毒样本] 13

本帖子中包含更多资源

本帖子中包含更多资源

ArcaVir

F-Prot 6.0.9.0

蜘蛛9个