费尔报 萤火从论坛有毒请帮忙确认下

28654621

病毒(JS.Decoder.v): D:\Sandbox\Administrator\Software\drive\D\Program Files\Opera\profile\cache4\opr0215X.js

Palkia

在 C:\Documents and Settings\Administrator\桌面\mm.exe 中发现 TrojanDownloader.Agent.aamj 病毒, 已删除

allinwonderi

红伞报

tanlimo

http://www.laidown.com.cn/js/js0.exe
http://www.laidown.com.cn/js/js.exe
http://www.laidown.com.cn/js/js1.exe
http://www.laidown.com.cn/js/js2.exe
http://www.laidown.com.cn/js/js3.exe
http://www.laidown.com.cn/js/js4.exe
http://www.laidown.com.cn/js/js5.exe
http://www.laidown.com.cn/js/js6.exe
http://www.laidown.com.cn/js/js7.exe
http://www.laidown.com.cn/js/js8.exe
http://www.laidown.com.cn/js/js9.exe
http://www.laidown.com.cn/js/js10.exe
http://ww1.laidown.com.cn/js/js11.exe
http://ww1.laidown.com.cn/js/js12.exe
http://ww1.laidown.com.cn/js/js13.exe
http://ww1.laidown.com.cn/js/js14.exe
http://ww1.laidown.com.cn/js/js15.exe
http://ww1.laidown.com.cn/js/js16.exe
http://ww1.laidown.com.cn/js/js17.exe
http://ww1.laidown.com.cn/js/js18.exe
http://ww1.laidown.com.cn/js/js19.exe
http://ww1.laidown.com.cn/js/js20.exe
http://ww2.laidown.com.cn/js/js21.exe
http://ww2.laidown.com.cn/js/js22.exe
http://ww2.laidown.com.cn/js/js23.exe
http://ww2.laidown.com.cn/js/js24.exe
http://ww2.laidown.com.cn/js/js25.exe
http://ww2.laidown.com.cn/js/js26.exe
http://ww2.laidown.com.cn/js/js27.exe
http://ww2.laidown.com.cn/js/js28.exe
http://ww2.laidown.com.cn/js/js29.exe
http://ww2.laidown.com.cn/js/js30.exe
http://ww3.laidown.com.cn/js/js31.exe
http://ww3.laidown.com.cn/js/js32.exe
http://ww3.laidown.com.cn/js/js33.exe
http://ww3.laidown.com.cn/js/js34.exe
http://ww3.laidown.com.cn/js/js35.exe

[ 本帖最后由 tanlimo 于 2008-5-10 19:09 编辑 ]

Starting the file scan:
Begin scan in 'E:\AV\新建文件夹'
E:\AV\新建文件夹\js0.exe
      [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js1.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js2.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.Steal.44657
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js3.exe
      [DETECTION] Is the Trojan horse TR/Downloader.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js4.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js5.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js6.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js7.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js8.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js9.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
        [2] Archive type: RSRC
        --> Object
            [DETECTION] Is the Trojan horse TR/PSW.Wow.axk.1
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js10.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js11.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js12.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js13.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js14.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js15.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js16.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js17.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js18.exe
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js20.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js21.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js22.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js23.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js24.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js25.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js26.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js27.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js28.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js29.exe
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js30.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js31.exe
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js32.exe
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js33.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js34.exe
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js35.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
E:\AV\新建文件夹\js19.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [NOTE]      The file was deleted!

End of the scan: 2008年5月10日  19:17
Used time: 00:40 min
The scan has been done completely.
      1 Scanning directories
     36 Files were scanned
     37 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     36 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     -1 Files not concerned
      0 Archives were scanned
      0 Warnings
     36 Notes

[ 本帖最后由 Exia 于 2008-5-10 19:15 编辑 ]

sbbdms

Kaspersky miss a lot
TO KL
PS：这事似乎弄大了..

Hello,

js0.exe_ - Trojan-Dropper.Win32.VB.aon,
js10.exe_, js19.exe_, js4.exe_ - Trojan-PSW.Win32.OnLineGames.aens,
js18.exe_, js27.exe_, js29.exe_ - Trojan-PSW.Win32.OnLineGames.aeoy,
js24.exe_ - Trojan-PSW.Win32.OnLineGames.aepa,
js31.exe_ - Trojan-PSW.Win32.OnLineGames.aepe,
js32.exe_ - Trojan-PSW.Win32.OnLineGames.aepf,
js33.exe_ - Trojan-PSW.Win32.OnLineGames.aepg,
js34.exe_ - Trojan-PSW.Win32.OnLineGames.aeph,
js35.exe_ - Trojan-PSW.Win32.OnLineGames.aepi,
js5.exe_ - Trojan-PSW.Win32.OnLineGames.aepj,
js6.exe_ - Trojan-PSW.Win32.OnLineGames.aeol

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Kirill Erakhtin
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: ??.rar

[ 本帖最后由 sbbdms 于 2008-5-10 22:22 编辑 ]

Anycall-D908

疯了...右键扫描下没反应.执行后大概一分钟后......ESS的放火墙狂报.还有微点也一起凑热闹.

Anycall-D908

都不知道谁说ESS的防火墙没用的...至少,对付这个下载者很有成效的嘛.

qigang

RS20.43.52未杀！

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Worm.Win32.PaBug.hb      
病毒： Trojan.PSW.Win32.QQGame.bz
病毒： Trojan.PSW.Win32.GamesOnline.yi
病毒： Trojan.PSW.Win32.GameOL.ja
病毒： Trojan.PSW.Win32.GameOL.ja
病毒： Trojan.PSW.Win32.SunOnline.nx
病毒： Trojan.PSW.Win32.GamesOnline.yk
病毒： RootKit.Win32.Mnless.oi  
病毒： Trojan.PSW.Win32.GameOL.gbs
病毒： Trojan.PSW.Win32.GameOL.gce
病毒： Trojan.PSW.Win32.XYOnline.adn
病毒： Trojan.PSW.Win32.GameOL.if
病毒： Packer.Win32.Upack.a     

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.43.52