木马群

显示全部楼层 · 发表于 2008-6-6 20:29:20

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\aa26.rar<RAR>:aa3.exe<UPack>:aa3.exe<DLLRES>:res0.exe <- Trojan.Psw.Onlinegames.Alae : No action
C:\Documents and Settings\All Users\Documents\Test\aa26.rar<RAR>:aa15.exe <- Trojan.Psw.Onlinegames.Akkg : No action
C:\Documents and Settings\All Users\Documents\Test\aa26.rar<RAR>:aa15.exe<UPack>:aa15.exe<DLLRES>:MAIN0.exe <- Trojan.Psw.Onlinegames.Akkd : No action
C:\Documents and Settings\All Users\Documents\Test\aa26.rar<RAR>:aa18.exe <- Trojan.Psw.Onlinegames.Ajpd : No action
C:\Documents and Settings\All Users\Documents\Test\aa26.rar<RAR>:aa18.exe<UPack>:aa18.exe<DLLRES>:MAIN0.exe <- Trojan.Psw.Onlinegames.Aind : No action
C:\Documents and Settings\All Users\Documents\Test\aa26.rar<RAR>:aa19.exe <- Trojan.Psw.Onlinegames.Ajod : No action
C:\Documents and Settings\All Users\Documents\Test\aa26.rar<RAR>:aa19.exe<UPack>:aa19.exe<DLLRES>:MAIN0.exe <- Trojan.Psw.Onlinegames.Affc : No action
C:\Documents and Settings\All Users\Documents\Test\aa26.rar<RAR>:aa20.exe <- Trojan.Psw.Onlinegames.Amrj : No action

Scanned objects : 71

Infected objects : 8

显示全部楼层 · 发表于 2008-6-6 20:30:42

全部命中

[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa26.exe->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa1.exe->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa2.exe->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa3.exe->(UPack)
[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa4.exe->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa5.exe
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa6.exe->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa7.exe
[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa8.exe->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa9.exe->(UPack)
[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa10.exe->(UPack)
[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa11.exe->(UPack)
[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa12.exe->(UPack)
[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa13.exe->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa14.exe
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa15.exe->(UPack)
[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa16.exe->(UPack)
[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa17.exe->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa18.exe->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa19.exe->(UPack)
[Found security risk] <W32/Agent.L.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa20.exe->(UPack)
[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa21.exe->(UPack)
[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa22.exe->(UPack)
[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa23.exe->(UPack)
[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa24.exe->(UPack)
[Found security risk] <W32/Nilage.gen!GSA (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\aa26.rar->aa25.exe->(UPack)

---------------------------------------------------------------------
Scan ended: 2008-6-6, 20:30:08
Duration: 0:00:41

Scan result:

Scanned files:    6
Infected objects:    26
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-6-6 20:34:22

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GameOL.nxy
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.Win32.Mnless.drt
病毒： Trojan.PSW.Win32.GameOL.nwk
病毒： Trojan.PSW.Win32.GamesOnline.afv
病毒： RootKit.Win32.RESSDT.au
病毒： Trojan.PSW.Win32.SunOnline.oq
病毒： Trojan.PSW.Win32.GamesOnline.afn
病毒： Trojan.PSW.Win32.GameOL.nvc
病毒： RootKit.Win32.RESSDT.bf
病毒： Trojan.PSW.Win32.GameOL.nxf
病毒： Trojan.PSW.Win32.SunGame.u
病毒： Trojan.PSW.Win32.GameOL.nrv

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.47.42

显示全部楼层 · 发表于 2008-6-6 20:47:22

rs全杀！

显示全部楼层 · 发表于 2008-6-6 21:24:51

红伞报了29个

显示全部楼层 · 发表于 2008-6-6 22:15:06

kis8，无法下载，关闭防护后下载后杀毒，aa6漏网，其余杀掉。

显示全部楼层 · 发表于 2008-6-10 08:41:39

木马名称:Trojan-PSW.Win32.OL-Games.iie

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\AA26.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2008-6-10 08:44:05

Starting the file scan:

Begin scan in 'E:\病毒\aa26.rar'
E:\病毒\aa26.rar
  [0] Archive type: RAR
--> aa26.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> aa3.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.alae
--> aa4.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> aa5.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.amdt
--> aa7.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.YC.4
--> aa8.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> aa9.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.amvv
--> aa10.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> aa11.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> aa12.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> aa13.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> aa14.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.amdt
--> aa16.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> aa17.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> aa21.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> aa22.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> aa23.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> aa24.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> aa25.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
   [NOTE]    The file was deleted!

End of the scan: 2008年6月10日  08:44
Used time: 00:10 min

The scan has been done completely.

   0 Scanning directories
   27 Files were scanned
   29 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   -2 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2008-6-10 11:39:02

手动杀毒（按时间降序排列）
信息 2008-06-10 11:39:29 金山毒霸主程序退出
信息 2008-06-10 11:39:29 金山毒霸主程序退出
信息 2008-06-10 11:38:50 您此次查毒清除了16个病毒
信息 2008-06-10 11:38:50 您此次查毒共查出16个病毒以及危险代码
信息 2008-06-10 11:38:50 您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件50个
信息 2008-06-10 11:38:50 金山毒霸主程序查毒过程结束，查毒方式：命令行查毒
病毒 2008-06-10 11:38:49 C:\Documents and Settings\Administrator\桌面\aa26.rar\aa23.exe Win32.Troj.OnlineGamesT.ak.110799 清除成功
病毒 2008-06-10 11:38:49 C:\Documents and Settings\Administrator\桌面\aa26.rar\aa22.exe Win32.PSWTroj.GameOL.106639 清除成功
病毒 2008-06-10 11:38:49 C:\Documents and Settings\Administrator\桌面\aa26.rar\aa21.exe Win32.Troj.OnlineGamesT.ak.110799 清除成功
病毒 2008-06-10 11:38:49 C:\Documents and Settings\Administrator\桌面\aa26.rar\aa20.exe Win32.Troj.OnlineGamesT.ny.102456 清除成功
病毒 2008-06-10 11:38:48 C:\Documents and Settings\Administrator\桌面\aa26.rar\aa19.exe Win32.Troj.OnlineGamesT.ny.102456 清除成功
病毒 2008-06-10 11:38:48 C:\Documents and Settings\Administrator\桌面\aa26.rar\aa18.exe Win32.Troj.OnlineGamesT.ny.102456 清除成功
病毒 2008-06-10 11:38:48 C:\Documents and Settings\Administrator\桌面\aa26.rar\aa17.exe Win32.Troj.OnlineGamesT.ak.110799 清除成功
病毒 2008-06-10 11:38:48 C:\Documents and Settings\Administrator\桌面\aa26.rar\aa16.exe Win32.Troj.OnlineGamesT.ak.110799 清除成功
病毒 2008-06-10 11:38:47 C:\Documents and Settings\Administrator\桌面\aa26.rar\aa15.exe Win32.Troj.OnlineGamesT.ny.102456 清除成功
病毒 2008-06-10 11:38:46 C:\Documents and Settings\Administrator\桌面\aa26.rar\aa13.exe Win32.Troj.OnlineGamesT.ak.110799 清除成功
病毒 2008-06-10 11:38:45 C:\Documents and Settings\Administrator\桌面\aa26.rar\aa9.exe Win32.Troj.MapwdT.fc.20628 清除成功
病毒 2008-06-10 11:38:44 C:\Documents and Settings\Administrator\桌面\aa26.rar\aa7.exe Win32.Troj.OnlineGamesT.xe.106496 清除成功
病毒 2008-06-10 11:38:44 C:\Documents and Settings\Administrator\桌面\aa26.rar\aa6.exe Win32.Troj.MapwdT.fc.20628 清除成功
病毒 2008-06-10 11:38:43 C:\Documents and Settings\Administrator\桌面\aa26.rar\aa3.exe Win32.Troj.MapwdT.fc.20628 清除成功
病毒 2008-06-10 11:38:42 C:\Documents and Settings\Administrator\桌面\aa26.rar\aa2.exe Win32.Troj.OnlineGamesT.ny.102456 清除成功
病毒 2008-06-10 11:38:42 C:\Documents and Settings\Administrator\桌面\aa26.rar\aa1.exe Win32.Troj.OnlineGamesT.ny.102456 清除成功
信息 2008-06-10 11:38:24 金山毒霸主程序启动查毒过程，查毒方式：命令行查毒
信息 2008-06-10 11:38:22 金山毒霸主程序启动

显示全部楼层 · 发表于 2008-6-10 11:42:41

Scan Started Tue Jun 10 11:41:30 2008
-------------------------------------------------------------------------------

C:\Documents and Settings\Administrator\桌面\aa26.rar: Trojan.Spy-38696 FOUND
----------- SCAN SUMMARY -----------
Known viruses: 310946
Engine version: 0.93
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 0.08 MB
Time: 10.986 sec (0 m 10 s)
--------------------------------------
Completed
--------------------------------------

[病毒样本] 木马群

ArcaVir2008

F-Prot 4.4.4

52/28

回复 2楼 sbbdms 的帖子