某帖挖

显示全部楼层 · 发表于 2008-5-31 01:37:27

cmd download..

[DOWN]
1=http://163.kfjed.org.cn/vv/vv01.exe
2=http://163.kfjed.org.cn/vv/vv02.exe
3=http://163.kfjed.org.cn/vv/vv03.exe
4=http://163.kfjed.org.cn/vv/vv04.exe
5=http://163.kfjed.org.cn/vv/vv05.exe
6=http://163.kfjed.org.cn/vv/vv06.exe
7=http://163.kfjed.org.cn/vv/vv07.exe
8=http://163.kfjed.org.cn/vv/vv08.exe
9=http://263.kfjed.org.cn/vv/vv09.exe
10=http://263.kfjed.org.cn/vv/vv10.exe
11=http://263.kfjed.org.cn/vv/vv11.exe
12=http://263.kfjed.org.cn/vv/vv12.exe
13=http://263.kfjed.org.cn/vv/vv13.exe
14=http://263.kfjed.org.cn/vv/vv14.exe
15=http://263.kfjed.org.cn/vv/vv15.exe
16=http://263.kfjed.org.cn/vv/vv16.exe
17=http://263.kfjed.org.cn/vv/vv17.exe
18=http://263.kfjed.org.cn/vv/vv18.exe
19=http://263.kfjed.org.cn/vv/vv19.exe
20=http://263.kfjed.org.cn/vv/vv20.exe
21=http://263.kfjed.org.cn/vv/vv21.exe
22=http://363.kfjed.org.cn/vv/vv22.exe
23=http://363.kfjed.org.cn/vv/vv23.exe
24=http://363.kfjed.org.cn/vv/vv24.exe
25=http://363.kfjed.org.cn/vv/vv25.exe
26=http://363.kfjed.org.cn/vv/vv26.exe
27=http://363.kfjed.org.cn/vv/vv27.exe
28=http://363.kfjed.org.cn/vv/vv28.exe
29=http://363.kfjed.org.cn/vv/vv29.exe
30=http://363.kfjed.org.cn/vv/vv30.exe
31=http://363.kfjed.org.cn/vv/vv31.exe
32=http://363.kfjed.org.cn/vv/vv32.exe

显示全部楼层 · 发表于 2008-5-31 01:39:54

7个失效
剩下antivir全灭
Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\TDDOWNLOAD'
C:\Documents and Settings\morgan\My Documents\TDDOWNLOAD\
  vv01.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajus
         [WARNING] Infected files in archives cannot be repaired!
      --> Object
   [NOTE]    The file was deleted!
  vv02.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  vv03.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajtg
         [WARNING] Infected files in archives cannot be repaired!
      --> Object
         [DETECTION] Contains detection pattern of the worm WORM/Downloader.MM
         [WARNING] Infected files in archives cannot be repaired!
   [NOTE]    The file was deleted!
  vv04.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  vv05.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  vv06.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajtp
         [WARNING] Infected files in archives cannot be repaired!
      --> Object
   [NOTE]    The file was deleted!
  vv07.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: OVL
      --> Object
   [DETECTION] Contains suspicious code HEUR/Malware
   [NOTE]    The fund was classified as suspicious.
   [NOTE]    The file was moved to '48703c3d.qua'!
  vv08.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  vv09.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  vv10.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  vv11.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: Runtime Packed
      --> Object
      --> Object
         [DETECTION] Contains detection pattern of the worm WORM/Downloader.NF
         [WARNING] Infected files in archives cannot be repaired!
   [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
   [NOTE]    The file was deleted!
  vv12.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  vv13.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: OVL
      --> Object
   [DETECTION] Contains suspicious code HEUR/Malware
   [NOTE]    The fund was classified as suspicious.
   [NOTE]    The file was moved to '48713c3d.qua'!
  vv14.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.akwd
         [WARNING] Infected files in archives cannot be repaired!
      --> Object
         [DETECTION] Contains detection pattern of the worm WORM/Downloader.NF
         [WARNING] Infected files in archives cannot be repaired!
   [NOTE]    The file was deleted!
  vv15.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  vv16.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  vv17.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  vv19.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajtm
         [WARNING] Infected files in archives cannot be repaired!
      --> Object
         [DETECTION] Contains detection pattern of the worm WORM/Downloader.MM
         [WARNING] Infected files in archives cannot be repaired!
   [NOTE]    The file was deleted!
  vv20.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.210
   [NOTE]    The file was deleted!
  vv21.exe
   [DETECTION] Is the Trojan horse TR/PSW.18289
   [NOTE]    The file was deleted!
  vv22.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  vv24.exe
   [DETECTION] Is the Trojan horse TR/Drop.Cinmus.Z
   [NOTE]    The file was deleted!
  vv28.exe
[0] Archive type: Runtime Packed
   --> Object
      [1] Archive type: RSRC
      --> Object
      [2] Archive type: Runtime Packed
      --> Object
      --> Object
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
  vv31.exe
   [DETECTION] Is the Trojan horse TR/PSW.17853
   [NOTE]    The file was deleted!
  vv32.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!

End of the scan: 2008年5月30日  10:39
Used time: 00:04 min

The scan has been done completely.

   1 Scanning directories
   25 Files were scanned
   27 viruses and/or unwanted programs were found
   2 Files were classified as suspicious:
   23 files were deleted
   0 files were repaired
   2 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   -2 Files not concerned
   0 Archives were scanned
   9 Warnings
   25 Notes

显示全部楼层 · 发表于 2008-5-31 01:43:52

Dr.Web(R)大蜘蛛反病毒扫描程序 v4.44.5 (4.44.5.05200)
[扫描路径] E:\VIRUS\TDDOWNLOAD531
>E:\VIRUS\TDDOWNLOAD531\vv01.exe 已被病毒感染：  Trojan.PWS.Wsgame.5416
>E:\VIRUS\TDDOWNLOAD531\vv02.exe 已被病毒感染：  Trojan.PWS.Wsgame.5449
>E:\VIRUS\TDDOWNLOAD531\vv03.exe 已被病毒感染：  Trojan.PWS.Wsgame.5421
>E:\VIRUS\TDDOWNLOAD531\vv04.exe 已被病毒感染：  Trojan.PWS.Gamania.10413
>E:\VIRUS\TDDOWNLOAD531\vv05.exe 已被病毒感染：  Trojan.PWS.Wsgame.4894
>E:\VIRUS\TDDOWNLOAD531\vv06.exe 已被病毒感染：  Trojan.PWS.Wsgame.5420
>E:\VIRUS\TDDOWNLOAD531\vv07.exe 已被病毒感染：  Trojan.PWS.Gamania.origin
>E:\VIRUS\TDDOWNLOAD531\vv08.exe 已被病毒感染：  Trojan.PWS.Gamania.10669
>E:\VIRUS\TDDOWNLOAD531\vv09.exe 已被病毒感染：  Trojan.PWS.Wsgame.5364
>E:\VIRUS\TDDOWNLOAD531\vv10.exe 已被病毒感染：  Trojan.PWS.Wsgame.5362
>>>E:\VIRUS\TDDOWNLOAD531\vv11.exe\data001 - 确定
>>E:\VIRUS\TDDOWNLOAD531\vv11.exe\data002 - 确定
>E:\VIRUS\TDDOWNLOAD531\vv11.exe - 确定
>E:\VIRUS\TDDOWNLOAD531\vv12.exe 已被病毒感染：  Trojan.PWS.Wsgame.5363
>E:\VIRUS\TDDOWNLOAD531\vv13.exe - 确定
>>>E:\VIRUS\TDDOWNLOAD531\vv14.exe\data001 - 确定
>>E:\VIRUS\TDDOWNLOAD531\vv14.exe\data002 - 确定
>E:\VIRUS\TDDOWNLOAD531\vv14.exe - 确定
>E:\VIRUS\TDDOWNLOAD531\vv15.exe 已被病毒感染：  Trojan.PWS.Gamania.10667
>E:\VIRUS\TDDOWNLOAD531\vv16.exe 已被病毒感染：  Trojan.PWS.Gamania.10664
>E:\VIRUS\TDDOWNLOAD531\vv17.exe 已被病毒感染：  Trojan.PWS.Wsgame.5415
>E:\VIRUS\TDDOWNLOAD531\vv19.exe 已被病毒感染：  Trojan.PWS.Wsgame.5418
>E:\VIRUS\TDDOWNLOAD531\vv20.exe - 确定
>E:\VIRUS\TDDOWNLOAD531\vv21.exe - 确定
>E:\VIRUS\TDDOWNLOAD531\vv22.exe 已被病毒感染：  Trojan.PWS.Gamania.10673
>E:\VIRUS\TDDOWNLOAD531\vv24.exe 已被病毒感染：  Trojan.PWS.Gamania.10415
>>>E:\VIRUS\TDDOWNLOAD531\vv28.exe\data001 - 确定
>>E:\VIRUS\TDDOWNLOAD531\vv28.exe\data002 - 确定
>E:\VIRUS\TDDOWNLOAD531\vv28.exe - 确定
>E:\VIRUS\TDDOWNLOAD531\vv31.exe - 确定
>E:\VIRUS\TDDOWNLOAD531\vv32.exe 已被病毒感染：  Trojan.PWS.Gamania.10424

-----------------------------------------------------------------------------
扫描统计
-----------------------------------------------------------------------------
已扫描对象: 30
发现受感染对象: 18

显示全部楼层 · 发表于 2008-5-31 01:48:10

Gamania这种名字始终让我纳闷日本的游戏橘子？
wsgame也是都是类似于onlinegame的代理？

显示全部楼层 · 发表于 2008-5-31 01:49:32

IKARUS全灭

D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv01.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.ajsw' 被发现
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv02.exe - 特征码 'Trojan-PWS.OnlineGames.NVI' 被发现
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv03.exe - 可疑代码段被发现 (Level: 140)
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv04.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.ajtt' 被发现
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv05.exe - 可疑代码段被发现 (Level: 140)
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv06.exe - 特征码 'Trojan.Generic' 被发现
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv07.exe - 可疑代码段被发现 (Level: 140)
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv08.exe - 特征码 'Trojan-PWS.Win32.Lmir.awg' 被发现
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv09.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.ajsp' 被发现
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv10.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.ajsp' 被发现
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv11.exe - 特征码 'Trojan-Downloader.Win32.Delf.aam' 被发现
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv12.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.ajsp' 被发现
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv13.exe - 可疑代码段被发现 (Level: 140)
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv14.exe - 可疑代码段被发现 (Level: 140)
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv15.exe - 特征码 'Trojan-PWS.Win32.Lmir.awg' 被发现
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv16.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.ajsp' 被发现
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv17.exe - 可疑代码段被发现 (Level: 140)
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv19.exe - 特征码 'Trojan-Spy.Win32.Vagon.A' 被发现
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv20.exe - 可疑代码段被发现 (Level: 140)
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv21.exe - 可疑代码段被发现 (Level: 140)
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv22.exe - 特征码 'Generic.PWS.Games.4' 被发现
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv24.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.ajts' 被发现
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv28.exe - 可疑代码段被发现 (Level: 140)
D:\病毒测试\临时解压\TDDOWNLOAD.rar:\vv31.exe - 可疑代码段被发现 (Level: 140)
D:\病毒测试\临时解压\TDDOWNLOAD.rar

26 文件被扫描
(1 压缩档 25 文件)
14 特征码被侦测
11 可疑代码段被发现
耗时: 0:01.071

显示全部楼层 · 发表于 2008-5-31 02:18:03

在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv32.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv01.exe 中发现 Trojan/CallBeep.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv02.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv03.exe 中发现 Trojan/CallBeep.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv04.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv05.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv06.exe 中发现 Trojan/CallBeep.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv08.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv09.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv10.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv12.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv14.exe 中发现 Trojan/CallBeep.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv15.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv16.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv17.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv19.exe 中发现 Trojan/CallBeep.Gen 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv22.exe 中发现 Trojan/PSW.OnLineGames.adab 病毒, 已删除
在 C:\Documents and Settings\Administrator\桌面\TDDOWNLOAD.rar->vv24.exe 中发现 Trojan/Ck88866.Gen 病毒, 已删除
正常结束。

扫描结果:
               文件数 :27                               病毒体 :18
               删除 :18                                  解毒 :0
扫描速度(千字节/秒) :53                               扫描时间 :00:00:16
扫描文件速度(个/秒) :1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -    - - - - - - - - - - - -

显示全部楼层 · 发表于 2008-5-31 02:28:28

再见木马群............

显示全部楼层 · 发表于 2008-5-31 10:11:08

扫描系统区域...
扫描所选择的目录和文件...
对象: vv32.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Generic.PWS.Games.4.7D7374F4 (BD 引擎)
对象: vv01.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Dropped:Generic.PWS.Games.1.A52B5884 (BD 引擎)
对象: vv02.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Trojan.PWS.OnLineGames.NVI (BD 引擎)
对象: vv03.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Trojan.Generic.282693 (BD 引擎)
对象: vv04.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Trojan.PWS.OnLineGames.NVI (BD 引擎)
对象: vv05.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Generic.PWS.Games.4.C0E02797 (BD 引擎)
对象: vv06.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Trojan.Generic.282435 (BD 引擎)
对象: vv07.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: BehavesLike:Win32.ExplorerHijack (BD 引擎)
对象: vv08.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Generic.PWS.Games.4.27DF47D1 (BD 引擎)
对象: vv09.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Generic.PWS.Games.4.BA36237E (BD 引擎)
对象: vv10.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Generic.PWS.Games.4.C5BF71CF (BD 引擎)
对象: vv12.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Generic.PWS.Games.4.4A2B6F57 (BD 引擎)
对象: vv13.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Trojan.PWS.OnLineGames.NVI (BD 引擎)
对象: vv15.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Generic.PWS.Games.4.14EAA4E7 (BD 引擎)
对象: vv16.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Generic.PWS.Games.4.75E88C91 (BD 引擎)
对象: vv17.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Trojan.PWS.OnLineGames.NVI (BD 引擎)
对象: vv19.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Trojan.Generic.282861 (BD 引擎)
对象: vv20.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Trojan.PWS.OnLineGames.NVI (BD 引擎)
对象: vv21.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Generic.PWS.Games.4.2731D122 (BD 引擎)
对象: vv22.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Generic.PWS.Games.4.9EAC944C (BD 引擎)
对象: vv24.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Trojan.PWS.OnLineGames.NVI (BD 引擎)
对象: vv31.exe
在压缩档案里: F:\TDDOWNLOAD.rar
Status: 已发现病毒
病毒: Generic.PWS.Games.4.8CAEC834 (BD 引擎)

显示全部楼层 · 发表于 2008-5-31 10:16:07

诺顿23个

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.GameOL.nsq
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.GameOL.nsz
病毒： Trojan.PSW.Win32.GameOL.nsu

用户来源：互联网

软件版本：20.46.42

瑞星18个

显示全部楼层 · 发表于 2008-5-31 10:33:23

KIS8 32个

[病毒样本] 某帖挖

本帖子中包含更多资源

18

浏览过的版块