30

sam.to

已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.acfe        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/aitlasys.exe2//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.Lmir.bvh        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/_qosec2.msi2//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.zjk        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/_qosec3.msi2//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.adqo        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/anistio.exE2//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aigr        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/bincdwsa.exe2//PE_Patch.UPX//UPX
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ygb        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/dbhlp32.exe2//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aimb        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/dionpis.exe3//PE_Patch.UPX//UPX
已刪除: 特洛伊木馬程式 Backdoor.Win32.Small.dui        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/explorer.exe3//PE_Patch//UPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.acnp        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/fmbiost.exe3//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aibk        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/fmsbbqi.exe3//PE_Patch.UPX//UPX
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aiol        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/fmsiocps.exe3//PE_Patch.UPX//UPX
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aiaq        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/fmsjhif.exe3//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ahvj        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/gjlpfrtl.exe3//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aiij        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/hefcndy.exe3//PE_Patch.UPX//UPX
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aimc        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/huifitc.exe3//PE_Patch.UPX//UPX
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aikm        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/mfchlp64.exe2//PE_Patch.UPX//UPX
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aeka        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/ptshell.exe2//FSG
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aioh        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/ticisms.exe3//PE_Patch.UPX//UPX
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.aioi        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/WINSvr64.exe3//PE_Patch.UPX//UPX
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.ailf        檔案: C:\Documents and Settings\kato9096\桌面\bingdu3.rar/yuiabct.exe3//PE_Patch.UPX//UPX


卡巴报20个,不报的已上报

Hello,

exe2bin.exe2, expand.exe2, Explorer.EXE2

No malicious code were found in these files.

mpbyqu.dll - Backdoor.Win32.PcClient.doh,
msdtc.exe2 - Trojan.Win32.VB.dah,
ncrzvl.dll - Backdoor.Win32.PcClient.doi

These files are already detected. Please update your antivirus bases.

NOTEPAD.EXE2

This file is corrupted.

smss.exe2 - Backdoor.Win32.Bifrose.soy,
update[1].exe2, update[2].exe3 - Trojan-Downloader.Win32.Agent.qqd

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-5-26 00:42 编辑 ]

sam.to

Starting the file scan:

Begin scan in 'C:\Documents and Settings\kato9096\桌面\bingdu'
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\aitlasys.exe2
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\anistio.exE2
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\bincdwsa.exe2
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.104
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\dbhlp32.exe2
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\dionpis.exe3
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aikx
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\explorer.exe3
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\fmbiost.exe3
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\fmsbbqi.exe3
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.106
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\fmsiocps.exe3
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.117
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\fmsjhif.exe3
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aiaq
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\gjlpfrtl.exe3
      [DETECTION] Is the Trojan horse TR/Onlinegames.NVI
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\hefcndy.exe3
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.113
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\huifitc.exe3
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aimg
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\mfchlp64.exe2
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.25352
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\mpbyqu.dll
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Backdoor.Gen Backdoor server programs
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\ncrzvl.dll
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Backdoor.Gen Backdoor server programs
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\ptshell.exe2
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\smss.exe2
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\ticisms.exe3
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\update[1].exe2
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\update[2].exe3
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\WINSvr64.exe3
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aioi
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\yuiabct.exe3
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.108
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\_qosec2.msi2
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\kato9096\桌面\bingdu\bingdu\_qosec3.msi2
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.zjk
      [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
      [NOTE]      The file was deleted!


End of the scan: Saturday,24 May 2008  21:55
Used time: 00:08 min

The scan has been done completely.

      2 Scanning directories
     30 Files were scanned
     25 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
     25 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      5 Files not concerned
      0 Archives were scanned
      0 Warnings
     25 Notes



不报的已上报

sam.to

25027159          msdtc.exe2          68 KB          UNDER ANALYSIS
25027160          NOTEPAD.EXE2          65 KB          UNDER ANALYSIS
1044475          exe2bin.exe2          8.23 KB          KNOWN CLEAN
1044476          expand.exe2          18 KB          KNOWN CLEAN
226503          Explorer.EXE2          954 KB          KNOWN CLEAN

挪威的冬天

信息        2008-05-24  22:06:26        您此次查毒隔离了24个文件                       
信息        2008-05-24  22:06:26        您此次查毒共查出24个病毒以及危险代码                       
信息        2008-05-24  22:06:26        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件52个                       
信息        2008-05-24  22:06:26        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒

wangjay1980

其余的目测没几个毒

ykz1991

华丽的超过了N多

红心王子

Date,Virus Name,Virus Type,User,Filename,Scan Type
2008-5-24 22:11:27,TrojanPSW.OnLineGames.zjk.ldsd,木马,Administrator,D:\我的文档\桌面\vir\bingdu\_qosec3.msi2,Manual scan
2008-5-24 22:11:27,PWSteal.Lemir.bur.rcjy,木马,Administrator,D:\我的文档\桌面\vir\bingdu\_qosec2.msi2,Manual scan
2008-5-24 22:11:27,TrojanDropper.Gen.rkvj,木马,Administrator,D:\我的文档\桌面\vir\bingdu\yuiabct.exe3,Manual scan
2008-5-24 22:11:27,Trojan.Cap851818.vmuw,木马,Administrator,D:\我的文档\桌面\vir\bingdu\WINSvr64.exe3,Manual scan
2008-5-24 22:11:27,Trojan.Cap851818.mzil,木马,Administrator,D:\我的文档\桌面\vir\bingdu\ticisms.exe3,Manual scan
2008-5-24 22:11:27,Trojan.Cap85103.cyvt,木马,Administrator,D:\我的文档\桌面\vir\bingdu\ptshell.exe2,Manual scan
2008-5-24 22:11:27,TrojanDropper.Gen.cixa,木马,Administrator,D:\我的文档\桌面\vir\bingdu\mfchlp64.exe2,Manual scan
2008-5-24 22:11:27,Trojan.Cap851818.ysgu,木马,Administrator,D:\我的文档\桌面\vir\bingdu\huifitc.exe3,Manual scan
2008-5-24 22:11:27,TrojanDropper.Gen.rbwo,木马,Administrator,D:\我的文档\桌面\vir\bingdu\hefcndy.exe3,Manual scan
2008-5-24 22:11:27,Trojan.Ck88866.Gen.hgzo,木马,Administrator,D:\我的文档\桌面\vir\bingdu\gjlpfrtl.exe3,Manual scan
2008-5-24 22:11:27,TrojanPSW.GamesOnline.zh.grxz,木马,Administrator,D:\我的文档\桌面\vir\bingdu\fmsjhif.exe3,Manual scan
2008-5-24 22:11:27,TrojanDropper.Gen.oyim,木马,Administrator,D:\我的文档\桌面\vir\bingdu\fmsiocps.exe3,Manual scan
2008-5-24 22:11:27,TrojanPSW.OnLineGames.aibk.utvc,木马,Administrator,D:\我的文档\桌面\vir\bingdu\fmsbbqi.exe3,Manual scan
2008-5-24 22:11:27,TrojanPSW.OnLineGames.acnp.dyto,木马,Administrator,D:\我的文档\桌面\vir\bingdu\fmbiost.exe3,Manual scan
2008-5-24 22:11:27,TrojanDownloader.Nurech.bd.bmqk,木马,Administrator,D:\我的文档\桌面\vir\bingdu\explorer.exe3,Manual scan
2008-5-24 22:11:26,TrojanDropper.Gen.soqm,木马,Administrator,D:\我的文档\桌面\vir\bingdu\dionpis.exe3,Manual scan
2008-5-24 22:11:26,Trojan.Cap85623.opbb,木马,Administrator,D:\我的文档\桌面\vir\bingdu\dbhlp32.exe2,Manual scan
2008-5-24 22:11:26,TrojanDropper.Gen.olrr,木马,Administrator,D:\我的文档\桌面\vir\bingdu\bincdwsa.exe2,Manual scan
2008-5-24 22:11:26,Trojan.Cap85623.ukfw,木马,Administrator,D:\我的文档\桌面\vir\bingdu\anistio.exE2,Manual scan
2008-5-24 22:11:26,TrojanPSW.OnLineGames.acfe.qjqc,木马,Administrator,D:\我的文档\桌面\vir\bingdu\aitlasys.exe2,Manual scan

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.SunOnline.nx
病毒： Trojan.PSW.Win32.GameOL.gbk
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.DL.Win32.Mnless.acp
病毒： Trojan.PSW.Win32.GameOL.nkd
病毒： Trojan.PSW.Win32.GameOL.nlt
病毒： Trojan.PSW.Win32.GameOL.nka
病毒： Backdoor.Win32.PcClient.ehj
病毒： Trojan.DL.Win32.VB.ytl   
病毒： Trojan.PSW.Win32.GameOL.njz
病毒： Trojan.Win32.VB.fmb      
病毒： Trojan.Win32.VB.fmb      
病毒： Packer.Win32.Agent.f     
病毒： Trojan.PSW.Win32.LMir.bpl
病毒： Trojan.PSW.Win32.GameOL.myf

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.45.52

醉一生爱妍

在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\anistio.exE2 中发现 Trojan/PSW.OnLineGames.tvm 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\aitlasys.exe2 中发现 Trojan/PSW.OnlineGames.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\bincdwsa.exe2 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\dbhlp32.exe2 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\dionpis.exe3 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\explorer.exe3 中发现 Backdoor/Small.aft 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\fmbiost.exe3 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\fmsbbqi.exe3 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\fmsiocps.exe3 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\fmsjhif.exe3 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\gjlpfrtl.exe3 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\hefcndy.exe3 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\huifitc.exe3 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\mfchlp64.exe2 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\mpbyqu.dll 中发现 Backdoor/Agent.bhwp 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\ncrzvl.dll 中发现 Backdoor/Agent.bhwp 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\ticisms.exe3 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\WINSvr64.exe3 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\yuiabct.exe3 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\_qosec2.msi2 中发现 Trojan/PSW.Lmir.cuw 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\_qosec3.msi2 中发现 Trojan/PSW.OnLineGames.sss 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\bingdu\bingdu\ptshell.exe2 中发现 Trojan/Ck88866.Gen 病毒, 已删除

sam.to

Hello,

exe2bin.exe2, expand.exe2, Explorer.EXE2

No malicious code were found in these files.

mpbyqu.dll - Backdoor.Win32.PcClient.doh,
msdtc.exe2 - Trojan.Win32.VB.dah,
ncrzvl.dll - Backdoor.Win32.PcClient.doi

These files are already detected. Please update your antivirus bases.

NOTEPAD.EXE2

This file is corrupted.

smss.exe2 - Backdoor.Win32.Bifrose.soy,
update[1].exe2, update[2].exe3 - Trojan-Downloader.Win32.Agent.qqd

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

[ 本帖最后由 kato9096 于 2008-5-26 00:42 编辑 ]