某帖挖。。

显示全部楼层 · 发表于 2008-5-4 02:14:53

清空
Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\virus\virus'
C:\Documents and Settings\Administrator\My Documents\virus\virus\
  js0.exe
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
   [NOTE]    The file was deleted!
  js1.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
  js10.exe
[0] Archive type: OVL
   --> Object
      [1] Archive type: Runtime Packed
      --> Object
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.acqi.1
         [WARNING] Infected files in archives cannot be repaired!
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    The file was deleted!
  js2.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.QQpass.btc
         [WARNING] Infected files in archives cannot be repaired!
   [NOTE]    The file was deleted!
  js3.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [NOTE]    The file was deleted!
  js4.exe
[0] Archive type: OVL
   --> Object
      [1] Archive type: Runtime Packed
      --> Object
   --> Object
      [1] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    The file was deleted!
  js5.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
  js6.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
  js7.exe
[0] Archive type: OVL
   --> Object
      [1] Archive type: Runtime Packed
      --> Object
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.acqi.1
         [WARNING] Infected files in archives cannot be repaired!
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    The file was deleted!
  js8.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!

End of the scan: 2008年5月3日  11:14
Used time: 00:05 min

The scan has been done completely.

   1 Scanning directories
   10 Files were scanned
   12 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   10 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   -2 Files not concerned
   0 Archives were scanned
   3 Warnings
   10 Notes

显示全部楼层 · 发表于 2008-5-4 02:44:44

Z:\virus.rar>>virus\js0.exe Trojan.Hbykmt.futh Trojan Waiting for actions
Z:\virus.rar>>virus\js1.exe TrojanPSW.GameOL.nfl.unpj Trojan Waiting for actions
Z:\virus.rar>>virus\js10.exe TrojanPSW.OnLineGames.wlu.kjdk Trojan Waiting for actions
Z:\virus.rar>>virus\js2.exe Trojan.Delphi.Gen.xzgl Trojan Waiting for actions
Z:\virus.rar>>virus\js3.exe Heuri.Possible/Packed Heuristic Scan Waiting for actions
Z:\virus.rar>>virus\js4.exe TrojanPSW.OnLineGames.wlu.kjdk Trojan Waiting for actions
Z:\virus.rar>>virus\js5.exe TrojanPSW.GamesOnline.uf.eohy Trojan Waiting for actions
Z:\virus.rar>>virus\js6.exe TrojanSpy.Gen.hfje Trojan Waiting for actions
Z:\virus.rar>>virus\js7.exe TrojanPSW.OnLineGames.wlu.kjdk Trojan Waiting for actions
Z:\virus.rar>>virus\js8.exe TrojanPSW.OnLineGames.abqj.qpqq Trojan Waiting for actions

显示全部楼层 · 发表于 2008-5-4 13:40:55

Roboon

显示全部楼层 · 发表于 2008-5-4 14:08:37

发现OnlineGames特征字符串【模糊】...
是否清除？
Y_
OK.

显示全部楼层 · 发表于 2008-5-4 15:43:41

2008-5-4 15:50:12 文件感染: C:\Documents and Settings\zh\桌面\virus\js4.exe 为 Win32/PerroldStealer!generic trojan。已删除
2008-5-4 15:50:13 文件感染: C:\Documents and Settings\zh\桌面\virus\js2.exe 为 Win32/QQPass!generic trojan。已删除
2008-5-4 15:50:14 文件感染: C:\Documents and Settings\zh\桌面\virus\js10.exe 为 Win32/PerroldStealer!generic trojan。已删除
2008-5-4 15:50:14 文件感染: C:\Documents and Settings\zh\桌面\virus\js7.exe 为 Win32/PerroldStealer!generic trojan。已删除

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.SunOnline.nx
病毒： Trojan.PSW.Win32.SunOnline.nw

用户来源：互联网

软件版本：20.42.60
4个

显示全部楼层 · 发表于 2008-5-4 16:54:43

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\VIRUS\JS0.EXE
是可疑程序!
试图修改系统时间!
是否阻止该进程继续运行?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\VIRUS\JS1.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\ZXMSAWIN.DLL
2) C:\WINDOWS\SYSTEM32\AXMSAWIN.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\VIRUS\JS2.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\VIRUS\JS3.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\VMVREG32.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\VIRUS\JS4.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\DRIVERS\XNGANTI.SYS
2) C:\WINDOWS\SYSTEM32\TTMYSMYS1053.EXE
3) C:\WINDOWS\SYSTEM32\TTMYSMYS1053.DLL
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\VIRUS\JS5.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\MPWDBAPI.DLL
2) C:\WINDOWS\SYSTEM32\SIWDAAPI.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\VIRUS\JS6.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\YPCQCHLP.DLL
2) C:\WINDOWS\SYSTEM32\ZSCQAHLP.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\VIRUS\JS8.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\PTJHCHLP.DLL
2) C:\WINDOWS\SYSTEM32\SPJHAHLP.EXE
是否删除木马程序及其衍生物?

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\VIRUS\VIRUS\JS10.EXE
木马程序生成以下文件:
1) C:\WINDOWS\SYSTEM32\TTQACQAC1046.EXE
2) C:\WINDOWS\SYSTEM32\TTQACQAC1046.DLL
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2008-5-4 17:05:47

Avira AntiVir Personal
Report file date: 2008年5月4日  17:01

Scanning for 1248213 virus strains and unwanted programs.

Licensed to:    Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform:       Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:       Normally booted
Username:       Administrator
Computer name: CHINA-76D9BB363

Version information:
BUILD.DAT    : 8.1.00.295    16479 Bytes 2008-4-9 16:24:00
AVSCAN.EXE : 8.1.2.12    311553 Bytes 2008-3-18 03:02:56
AVSCAN.DLL : 8.1.1.0       53505 Bytes 2008-2-7 02:43:37
LUKE.DLL    : 8.1.2.9       151809 Bytes 2008-2-28 02:41:23
LUKERES.DLL : 8.1.2.1       12033 Bytes 2008-2-21 02:28:40
ANTIVIR0.VDF  : 6.40.0.0    11030528 Bytes 2007-7-18 04:33:34
ANTIVIR1.VDF  : 7.0.3.2    5447168 Bytes 2008-3-7 07:08:58
ANTIVIR2.VDF  : 7.0.3.197    1260032 Bytes 2008-4-22 03:25:14
ANTIVIR3.VDF  : 7.0.3.243    276992 Bytes 2008-5-2 00:09:53
Engineversion : 8.1.0.37
AEVDF.DLL    : 8.1.0.5       102772 Bytes 2008-2-25 03:58:21
AESCRIPT.DLL  : 8.1.0.28    233851 Bytes 2008-5-4 00:09:59
AESCN.DLL    : 8.1.0.15    119157 Bytes 2008-5-4 00:09:58
AERDL.DLL    : 8.1.0.20    418165 Bytes 2008-4-30 03:26:11
AEPACK.DLL : 8.1.1.4       364918 Bytes 2008-4-30 03:26:05
AEOFFICE.DLL  : 8.1.0.18    192890 Bytes 2008-4-30 03:25:55
AEHEUR.DLL : 8.1.0.21    1196407 Bytes 2008-5-4 00:09:57
AEHELP.DLL : 8.1.0.14    115063 Bytes 2008-4-30 03:25:38
AEGEN.DLL    : 8.1.0.18    299381 Bytes 2008-4-30 03:25:34
AEEMU.DLL    : 8.1.0.5       430450 Bytes 2008-4-7 09:34:43
AECORE.DLL : 8.1.0.27    168310 Bytes 2008-4-30 03:25:26
AVWINLL.DLL : 1.0.0.7       14593 Bytes 2008-1-23 11:07:53
AVPREF.DLL : 8.0.0.1       25857 Bytes 2008-2-18 04:37:50
AVREP.DLL    : 7.0.0.1       155688 Bytes 2007-4-16 07:26:47
AVREG.DLL    : 8.0.0.0       30977 Bytes 2008-1-23 11:07:49
AVARKT.DLL : 1.0.0.23    307457 Bytes 2008-2-12 02:29:23
AVEVTLOG.DLL  : 8.0.0.11    114945 Bytes 2008-2-28 02:31:31
SQLITE3.DLL : 3.3.17.1    339968 Bytes 2008-1-22 11:28:02
SMTPLIB.DLL : 1.2.0.19       28929 Bytes 2008-1-23 11:08:39
NETNT.DLL    : 8.0.0.1       7937 Bytes 2008-1-25 06:05:10
RCIMAGE.DLL : 8.0.0.35    2371841 Bytes 2008-3-10 08:37:25
RCTEXT.DLL : 8.0.32.0       86273 Bytes 2008-3-6 06:02:11

Configuration settings for the scan:
Jobname..........................: ShlExt
Configuration file...............: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c75219c8.avp
Logging..........................: low
Primary action...................: repair
Secondary action.................: delete
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: off
Scan registry....................: off
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: 2008年5月4日  17:01

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\virus.rar'
C:\Documents and Settings\Administrator\桌面\virus.rar
  [0] Archive type: RAR
  --> virus\js0.exe
   [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
  --> virus\js3.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
--> virus\js2.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.QQpass.btc
--> virus\js10.exe
   [1] Archive type: OVL
   --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.acqi.1
--> virus\js7.exe
   [1] Archive type: OVL
   --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.acqi.1
   [NOTE]    A backup was created as '488f7bdd.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!

End of the scan: 2008年5月4日  17:01
Used time: 00:02 min

The scan has been done completely.

   0 Scanning directories
   11 Files were scanned
   12 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   -1 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

以上是小红伞P版

显示全部楼层 · 发表于 2008-5-4 20:05:50

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.SunOnline.nx
病毒： RootKit.Win32.XNGAnti.a
病毒： RootKit.Win32.XNGAnti.a
病毒： Worm.Win32.PaBug.gy
病毒： Trojan.PSW.Win32.SunOnline.nw

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.42.62

显示全部楼层 · 发表于 2008-5-4 21:39:57

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:js1.exe<UPack>:js1.exe<DLLRES>:MAIN0.exe <- Trojan.Psw.Onlinegames.Achh : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:js5.exe <- Trojan.Psw.Onlinegames.Acfe : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:js5.exe<UPack>:js5.exe<DLLRES>:MAIN0.exe <- Trojan.Psw.Onlinegames.Acbt : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:js8.exe <- Trojan.Psw.Onlinegames.Abqj : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:js8.exe<UPack>:js8.exe<DLLRES>:MAIN0.exe <- Trojan.Psw.Onlinegames.Acbr : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:js2.exe <- Trojan.Psw.Qqpass.Btb : No action
C:\Documents and Settings\All Users\Documents\Test\virus.rar<RAR>:js2.exe<UPX>:js2.exe<DLLRES>:FILE0.exe <- Trojan.Psw.Qqpass.Btc : No action

Scanned objects : 30

Infected objects : 7

显示全部楼层 · 发表于 2008-5-4 21:40:56

[Found possible security risk] <W32/Heuristic-210!Eldorado (damaged, not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->virus\js0.exe->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->virus\js1.exe->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->virus\js5.exe->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->virus\js8.exe->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->virus\js4.exe->exefile->(UPack)
[Found security risk] <W32/AutoRun.D.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->virus\js2.exe->(UPX)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->virus\js10.exe->exefile->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->virus\js7.exe->exefile->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->virus\js6.exe->(UPack)

---------------------------------------------------------------------
Scan ended: 2008-5-4, 21:40:45
Duration: 0:00:05

Scan result:

Scanned files:    6
Infected objects:    9
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

[病毒样本] 某帖挖。。

发现OnlineGames...

本帖子中包含更多资源

28/11

ArcaVir2008

F-Prot 6.0.9.0