可疑的

显示全部楼层 · 发表于 2008-5-16 14:36:16

用G DATA AntiVirus检测病毒
版本 18.5.8071.731
病毒特征库日期 2008/5/16
开始时间： 2008/5/16 14:30
引擎：引擎A (AVK 18.3800), 引擎B (AVKB 18.260)
启发式：开启
档案文件：开启
系统区域：开启
检测系统区域...
检测以下目录和文件：
C:\Documents and Settings\Administrator\桌面\hhh\
对象： ONLINE.tmp
路径: C:\Documents and Settings\Administrator\桌面\hhh
状态：病毒，文件被删除
病毒： Trojan-PSW.Win32.OnLineGames.afot (引擎A)
检测执行时间： 2008/5/16 14:31
2个文件已检测
1个受感染文件
0个可疑文件被发现

显示全部楼层 · 发表于 2008-5-16 14:37:34

Starting the file scan:

Begin scan in 'E:\AV\ONLINE.rar'
E:\AV\ONLINE.rar
  [0] Archive type: RAR
  --> ONLINE.tmp
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.WNZ.46
   [NOTE]    The file was deleted!
Begin scan in 'E:\AV\hhh.zip'
E:\AV\hhh.zip
  [0] Archive type: ZIP
--> ﾷￇﾪﾨﾪﾨﾻ￝ﾪﾾ.exe
   [1] Archive type: RAR SFX (self extracting)
   --> 44.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [NOTE]    The file was deleted!

End of the scan: 2008年5月16日  14:39
Used time: 00:11 min

The scan has been done completely.

   0 Scanning directories
   7 Files were scanned
   2 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   2 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   5 Files not concerned
   4 Archives were scanned
   0 Warnings
   2 Notes

显示全部楼层 · 发表于 2008-5-16 14:40:57

2008-05-16 14:36:43 文件保护(创建文件)    操作:阻止
进程路径:C:\program files\Internet Explorer\IEXPLORE.EXE
文件路径:C:\U.exe
2008-05-16 14:36:45 应用程序保护(运行应用程序)    操作:允许(自动创建规则)
进程路径:C:\program files\Internet Explorer\IEXPLORE.EXE
文件路径:C:\program files\Internet Explorer\iedw.exe
命令行:-h 680
2008-05-16 14:36:45 应用程序保护(结束/挂起线程)    操作:阻止
进程路径:C:\program files\Internet Explorer\iedw.exe
目标进程:C:\program files\Internet Explorer\IEXPLORE.EXE
2008-05-16 14:36:50 文件保护(修改文件)    操作:阻止
进程路径:C:\program files\Internet Explorer\iedw.exe
文件路径:C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx
2008-05-16 14:36:51 文件保护(修改文件)    操作:阻止
进程路径:C:\program files\Internet Explorer\iedw.exe
文件路径:C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx

显示全部楼层 · 发表于 2008-5-16 14:43:44

已检测到: 木马程序 Trojan-PSW.Win32.OnLineGames.afot URL: http://bbs.kafan.cn/attachment.p ... 0919993//ONLINE.tmp

第2个运行不了

显示全部楼层 · 发表于 2008-5-16 14:49:29

不好意思回错贴了

显示全部楼层 · 发表于 2008-5-16 15:02:16

Dr.web 0

显示全部楼层 · 发表于 2008-5-16 15:09:20

D:\Users\ekincheng\Desktop\ONLINE.rar » RAR » ONLINE.tmp - a variant of Win32/PSW.OnLineGames.NOA trojan

显示全部楼层 · 发表于 2008-5-16 17:53:59

The file '##########.exe' has been determined to be 'MALWARE'. Our analysts named the threat DR/Agent.SUS. The term "DR/" denotes a program that is able to place a virus or a malware discretely on a system.Detection will be added to our virus definition file (VDF) with one of the next updates.

显示全部楼层 · 发表于 2008-5-16 18:02:06

[Found password stealer] <W32/OnlineGames.AE.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\hhh.zip->非??惠?.exe->(RAR)->44.exe

显示全部楼层 · 发表于 2008-5-16 19:56:14

[病毒样本] 可疑的

本帖子中包含更多资源

F-Prot 6.0.9.0

本帖子中包含更多资源