roger友情提供----unknow virus

显示全部楼层 · 发表于 2008-5-11 15:49:02

bitdefender日志文件!!!!!
产品 : BitDefender Antivirus 2008
版本 : BitDefenderUI扫描机v.11
日志日期 : 15:48:56 11/05/2008
日志路径: : C:\Documents and Settings\Administrator\Application Data\BitDefender\Desktop\Profiles\Logs\contextual\1210492136_1_02.xml

扫描路径 : 路径0000: C:\Documents and Settings\Administrator\桌面\virus

扫描选项扫描寻找病毒 : 是
扫描广告软件 : 是
扫描间谍软件 : 是
选择应用程序: : 是
扫描寻找病毒 : 是
扫描 rootkits : 否

目标选择选项扫描注册表密钥 : 否
扫描cookies : 否
扫描启动扇区 : 否
扫描内存进程 : 否
扫描存档 : 是
扫描时间运行器 : 是
扫描电子邮件 : 是
扫描所有文件 : 是
启发式扫描 : 是
扫描拥有用户所指定的扩展名的文件 :
不包括扩展名 :

针对加工受感染对象的默认操作 : 未受感染的
可疑的对象默认操作 : 无
隐藏对象的默认操作 : 无

扫描引擎摘要病毒有效更新的时间 : 1191077
存档插件 : 42
邮件插件 : 6
扫描插件 : 12
存档插件 : 42
系统插件 : 4
解压插件 : 7

整体扫描摘要扫描过的项目 : 21
被感染的文件 : 18
可疑的对象 : 0
已被解决的项目 : 6
发现个别病毒 : 14
扫描过的目录 : 1
扫描启动扇区 : 0
扫描存档 : 0
输入输出错误 : 0
扫描时间: : 00:00:00:08
每秒扫描过的文件: : 2

已扫描的进程扫描过的文件 : 0
被感染的: : 0

扫描过的注册表项密钥扫描过的文件 : 0
被感染的: : 0

扫描过的cookies扫描过的文件 : 0
被感染的: : 0

剩下的问题：对象名称威胁的名称: 最终的状态
C:\Documents and Settings\Administrator\桌面\virus\soft10.exe Generic.PWS.Games.2.29DEC3F5 清除失败
C:\Documents and Settings\Administrator\桌面\virus\soft02.exe Generic.PWS.Games.4.2738FE77 清除失败
C:\Documents and Settings\Administrator\桌面\virus\soft18.exe Generic.PWS.Games.4.2ACA54C9 清除失败
C:\Documents and Settings\Administrator\桌面\virus\soft07.exe Generic.PWS.Games.4.6085C9F2 清除失败
C:\Documents and Settings\Administrator\桌面\virus\soft08.exe Generic.PWS.Games.4.8BF62EA4 清除失败
C:\Documents and Settings\Administrator\桌面\virus\soft17.exe Generic.PWS.Games.4.A34BC64D 清除失败
C:\Documents and Settings\Administrator\桌面\virus\soft19.exe Generic.PWS.Games.4.AB4055B8 清除失败
C:\Documents and Settings\Administrator\桌面\virus\soft12.exe Generic.PWS.Games.4.E2361DBF 清除失败
C:\Documents and Settings\Administrator\桌面\virus\soft03.exe Trojan.PWS.OnLineGames.NVI 清除失败
C:\Documents and Settings\Administrator\桌面\virus\soft05.exe Trojan.PWS.OnLineGames.NVI 清除失败
C:\Documents and Settings\Administrator\桌面\virus\soft04.exe Trojan.PWS.OnLineGames.NVI 清除失败
C:\Documents and Settings\Administrator\桌面\virus\soft16.exe Trojan.PWS.OnLineGames.NVI 清除失败

解决的问题：对象名称威胁的名称: 最终的状态
C:\Documents and Settings\Administrator\桌面\virus\soft13.exe Trojan.Agent.AGBN 被删除的
C:\Documents and Settings\Administrator\桌面\virus\soft00.exe Trojan.PWS.Agent.SCW 被删除的
C:\Documents and Settings\Administrator\桌面\virus\soft21.exe Trojan.PWS.Delf.IJJ 被删除的
C:\Documents and Settings\Administrator\桌面\virus\soft06.exe Trojan.PWS.OnLineGames.WGF 被删除的
C:\Documents and Settings\Administrator\桌面\virus\soft01.exe Trojan.PWS.OnlineGames.WNY 被删除的
C:\Documents and Settings\Administrator\桌面\virus\soft11.exe Trojan.PWS.OnlineGames.WNY 被删除的

无法扫描的对象对象名称原因最终的状态

显示全部楼层 · 发表于 2008-5-11 15:50:51

Starting the file scan:

Begin scan in 'E:\AV\virus'
E:\AV\virus\soft17.exe
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\soft19.exe
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\soft18.exe
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\soft20.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.adxc
   --> Object
      [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.aks.1
   [NOTE]    The file was deleted!
E:\AV\virus\soft21.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.QQpass.btc
   [NOTE]    The file was deleted!
E:\AV\virus\soft00.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\soft01.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.abzd.15
   [NOTE]    The file was deleted!
E:\AV\virus\soft02.exe
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\soft03.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.17
   [NOTE]    The file was deleted!
E:\AV\virus\soft05.exe
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\soft04.exe
   [DETECTION] Is the Trojan horse TR/Onlinegames.NVI
   [NOTE]    The file was deleted!
E:\AV\virus\soft06.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      --> Object
      [3] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aayo
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\soft07.exe
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\soft08.exe
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\soft09.exe
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\soft10.exe
   [DETECTION] Is the Trojan horse TR/PSW.Online.ddm.1
   [NOTE]    The file was deleted!
E:\AV\virus\soft11.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.abzd.2
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\soft15.exe
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\soft12.exe
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\soft16.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
E:\AV\virus\soft13.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [NOTE]    The file was deleted!

End of the scan: 2008年5月11日  15:52
Used time: 00:14 min

The scan has been done completely.

   1 Scanning directories
   21 Files were scanned
   24 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   21 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   -3 Files not concerned
   0 Archives were scanned
   0 Warnings
   21 Notes

显示全部楼层 · 发表于 2008-5-11 15:54:03

全灭

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\virus'
C:\Documents and Settings\morgan\My Documents\virus\
  soft00.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: Runtime Packed
      --> Object
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
  soft01.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.abzd.15
            [WARNING] Infected files in archives cannot be repaired!
   [NOTE]    The file was deleted!
  soft02.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  soft03.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.17
   [NOTE]    The file was deleted!
  soft04.exe
[0] Archive type: Runtime Packed
--> Object
      [DETECTION] Is the Trojan horse TR/Onlinegames.NVI
   [NOTE]    The file was deleted!
  soft05.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  soft06.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: Runtime Packed
      --> Object
         [3] Archive type: RSRC
         --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aayo
            [WARNING] Infected files in archives cannot be repaired!
         --> Object
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
   [NOTE]    The file was deleted!
  soft07.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  soft08.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  soft09.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: Runtime Packed
      --> Object
      --> Object
   [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
   [NOTE]    The file was deleted!
  soft10.exe
[0] Archive type: Runtime Packed
--> Object
      [DETECTION] Is the Trojan horse TR/PSW.Online.ddm.1
   [NOTE]    The file was deleted!
  soft11.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.abzd.2
            [WARNING] Infected files in archives cannot be repaired!
      --> Object
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
   [NOTE]    The file was deleted!
  soft12.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  soft13.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [NOTE]    The file was deleted!
  soft15.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: RSRC
      --> Object
      --> Object
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    The file was deleted!
  soft16.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [NOTE]    The file was deleted!
  soft17.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  soft18.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  soft19.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  soft20.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.adxc
         [WARNING] Infected files in archives cannot be repaired!
      --> Object
         [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.aks.1
         [WARNING] Infected files in archives cannot be repaired!
   [NOTE]    The file was deleted!
  soft21.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.QQpass.btc
         [WARNING] Infected files in archives cannot be repaired!
   [NOTE]    The file was deleted!

End of the scan: 2008年5月11日  00:53
Used time: 00:05 min

The scan has been done completely.

   1 Scanning directories
   21 Files were scanned
   24 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   21 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   -3 Files not concerned
   0 Archives were scanned
   6 Warnings
   21 Notes

显示全部楼层 · 发表于 2008-5-11 16:08:50

Kaspersky kill all

显示全部楼层 · 发表于 2008-5-11 16:09:29

all...

Sign of "Win32:Agent-BQC [Trj]" has been found in "F:\virus\virus\soft09.exe\[FSG]\[Embedded#3000]\[Upack]" file.
Sign of "Win32:Generic-FC" has been found in "F:\virus\virus\soft10.exe\[UPX]" file.
Sign of "Win32:Lmir-RC [Trj]" has been found in "F:\virus\virus\soft13.exe" file.
Sign of "Win32:OnLineGames-BBH [Trj]" has been found in "F:\virus\virus\soft01.exe\[UPX]" file.
Sign of "Win32:OnLineGames-BSI [Trj]" has been found in "F:\virus\virus\soft15.exe\[UPX]" file.
Sign of "Win32:OnLineGames-BSI [Trj]" has been found in "F:\virus\virus\soft21.exe\[UPX]" file.
Sign of "Win32:OnLineGames-CDA [Trj]" has been found in "F:\virus\virus\soft03.exe\[FSG]" file.
Sign of "Win32:OnLineGames-CYJ [Trj]" has been found in "F:\virus\virus\soft20.exe\[FSG]" file.
Sign of "Win32:OnLineGames-DAB [Trj]" has been found in "F:\virus\virus\soft18.exe\[FSG]" file.
Sign of "Win32:OnLineGames-DJV [Trj]" has been found in "F:\virus\virus\soft06.exe\[Upack]\[Embedded#7060]\[Upack]\[Embedded#0c0b0]\[Upack]" file.
Sign of "Win32:OnLineGames-DJX [Trj]" has been found in "F:\virus\virus\soft04.exe\[FSG]" file.
Sign of "Win32:OnLineGames-DNU [Trj]" has been found in "F:\virus\virus\soft07.exe\[FSG]" file.
Sign of "Win32:OnLineGames-DOO [Trj]" has been found in "F:\virus\virus\soft12.exe\[FSG]" file.
Sign of "Win32:OnLineGames-DQS [Trj]" has been found in "F:\virus\virus\soft02.exe\[FSG]" file.
Sign of "Win32:OnLineGames-DQS [Trj]" has been found in "F:\virus\virus\soft05.exe\[FSG]" file.
Sign of "Win32:OnLineGames-DQS [Trj]" has been found in "F:\virus\virus\soft08.exe\[FSG]" file.
Sign of "Win32:OnLineGames-DQS [Trj]" has been found in "F:\virus\virus\soft16.exe\[FSG]" file.
Sign of "Win32:OnLineGames-DQS [Trj]" has been found in "F:\virus\virus\soft17.exe\[FSG]" file.
Sign of "Win32:OnLineGames-DQS [Trj]" has been found in "F:\virus\virus\soft19.exe\[FSG]" file.
Sign of "Win32:Rootkit-gen [Rtk]" has been found in "F:\virus\virus\soft00.exe\[Upack]\[Embedded#307c]\[UPX]\[Embedded#419c]\[Embedded#15c0]\[Upack]\[Embedded#2044]\[UPX]" file.
Sign of "Win32:Wow-FXJ [Trj]" has been found in "F:\virus\virus\soft11.exe\[UPX]" file.

显示全部楼层 · 发表于 2008-5-11 16:22:09

在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft17.exe 中发现 Trojan/PSW.OnLineGames.tvf 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft19.exe 中发现 Trojan/PSW.OnLineGames.tvb 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft18.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft20.exe 中发现 Trojan/CallBeep.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft21.exe 中发现 Trojan/PSW.QQPass.swu 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft00.exe 中发现 Trojan/PSW.Agent.fql 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft01.exe 中发现 TrojanDownloader.Small.ackx 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft02.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft03.exe 中发现 Trojan/PSW.OnLineGames.ackm 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft05.exe 中发现 Trojan/PSW.OnLineGames.tvm 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft04.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft06.exe 中发现 Trojan/PSW.OnLineGames.acrk 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft07.exe 中发现 Trojan/PSW.OnLineGames.tvl 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft08.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft10.exe 中发现 Trojan/PSW.GamePass.advd 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft11.exe 中发现 TrojanDownloader.Small.ackx 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft12.exe 中发现 Trojan/PSW.OnLineGames.tvn 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft16.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\virus(1).rar->virus\soft13.exe 中发现 Trojan/PSW.Lmir.cuw 病毒, 已删除

显示全部楼层 · 发表于 2008-5-11 20:16:24

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GameOL.gbk
病毒： Trojan.PSW.Win32.GamesOnline.yp
病毒： Harm.Win32.AntiSig.a
病毒： Trojan.PSW.Win32.GameOL.ka
病毒： Worm.Win32.PaBug.gy
病毒： Trojan.PSW.Win32.XYOnline.acy
病毒： Trojan.PSW.Win32.GameOL.nfp
病毒： Packer.Win32.Upack.a
病毒： Trojan.Win32.AvKiller.as
病毒： Trojan.PSW.Win32.GameOnline.zzy
病毒： RootKit.Win32.Mnless.jz
病毒： RootKit.Win32.Mnless.oi
病毒： Trojan.PSW.Win32.GamesOnline.ym
病毒： Trojan.PSW.Win32.LMir.bpj

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.43.62

显示全部楼层 · 发表于 2008-5-11 21:36:51

[病毒样本] roger友情提供----unknow virus

本帖子中包含更多资源

全灭

kv 19

59/24

本帖子中包含更多资源