红伞

显示全部楼层 · 发表于 2008-7-5 12:00:39

描系统区域...
扫描所选择的目录和文件...
对象: wow.exe
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\g2.rar
Status: 已发现病毒
病毒: Trojan-PSW.Win32.OnLineGames.ajnn (KAV 引擎), Trojan.PWS.OnlineGames.WPJ (BD 引擎)
对象: microsoft.exe
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\g2.rar
Status: 已发现病毒
病毒: Trojan-PSW.Win32.OnLineGames.ajxg (KAV 引擎), Generic.Malware.P!BPk!.586002A2 (BD 引擎)
对象: css.css
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\g2.rar
Status: 已发现病毒
病毒: Trojan.Win32.Delf.dal (KAV 引擎), Trojan.Crypt.Delf.C (BD 引擎)
对象: i1232.swf
在压缩档案里: C:\Documents and Settings\wangcheng\桌面\g2.rar
Status: 已发现病毒
病毒: Exploit.SWF.Downloader.a (KAV 引擎), Exploit.SWF.Gen (BD 引擎)

显示全部楼层 · 发表于 2008-7-5 12:10:31

2008-7-5 12:08:47 1215230927 Nerazzurri 4084 Sign of "Win32:OnLineGames-CYO [Trj]" has been found in "C:\Documents and Settings\Nerazzurri\桌面\g2.rar\wow.exe\[NsPack]\[Embedded#50c0]\[Upack]" file.
2008-7-5 12:08:54 1215230934 Nerazzurri 4084 Sign of "Win32:KillAV-GH [Trj]" has been found in "C:\Documents and Settings\Nerazzurri\桌面\g2.rar\microsoft.exe\[Embedded#05410]" file.
2008-7-5 12:08:57 1215230937 Nerazzurri 4084 Sign of "Win32:Delf-IOR [Trj]" has been found in "C:\Documents and Settings\Nerazzurri\桌面\g2.rar\microsoft.exe\[Embedded#06710]" file.
2008-7-5 12:08:59 1215230939 Nerazzurri 4084 Sign of "Win32:KillAV-GH [Trj]" has been found in "C:\Documents and Settings\Nerazzurri\桌面\g2.rar\microsoft.exe" file.
2008-7-5 12:09:01 1215230941 Nerazzurri 4084 Sign of "SWF:CVE-2007-0071 [Expl]" has been found in "C:\Documents and Settings\Nerazzurri\桌面\g2.rar\i1232.swf" file.
2008-7-5 12:09:04 1215230944 Nerazzurri 4084 Sign of "Win32:OnLineGames-DZY [Trj]" has been found in "C:\Documents and Settings\Nerazzurri\桌面\g2.rar\update.exe\[NsPack]\[Embedded#20a3]\[Upack]" file.

显示全部楼层 · 发表于 2008-7-5 12:11:10

红伞启发HEUR/HTML.Malware

显示全部楼层 · 发表于 2008-7-5 14:52:20

正在扫描日志
病毒库版本: 3244 (20080705)
日期: 2008-7-5 时间: 14:53:09
已扫描的磁盘、文件夹和文件: C:\Documents and Settings\Administrator\桌面\g2.rar
C:\Documents and Settings\Administrator\桌面\g2.rar > RAR > wow.exe - Win32/PSW.OnLineGames.ZJK 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\g2.rar > RAR > microsoft.exe - 可能是 Win32/TrojanDownloader.Agent.NWE 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\g2.rar > RAR > css.css - 可能是 Win32/Genetik 特洛伊木马的变种
C:\Documents and Settings\Administrator\桌面\g2.rar > RAR > i1232.swf - SWF/Exploit.CVE-2007-0071 特洛伊木马
C:\Documents and Settings\Administrator\桌面\g2.rar > RAR > update.exe - 未查明的 NewHeur_PE 病毒 [7]
已扫描的对象数: 7
发现的威胁数: 5
已清除对象数:0
完成时间: 14:53:15 总扫描时间: 6 秒 (00:00:06)

备注:
[7] 对象可能感染了未知病毒。

显示全部楼层 · 发表于 2008-7-5 14:58:55

Begin scan in 'C:\Documents and Settings\Administrator\桌面\g2'
C:\Documents and Settings\Administrator\桌面\g2\css.css
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [NOTE]    A backup was created as '48e21c10.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\g2\i1232.swf
   [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
   [NOTE]    A backup was created as '48a11bce.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\g2\microsoft.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGam.SEA
   [NOTE]    A backup was created as '48d21c06.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\g2\update.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    A backup was created as '48d31c0d.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\g2\wow.exe
--> Object
   [1] Archive type: RSRC
   --> Object
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajnn
   [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
   [NOTE]    A backup was created as '48e61c0c.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!

End of the scan: 2008年7月5日  14:58
Used time: 00:03 min

The scan has been done completely.

   1 Scanning directories
   7 Files were scanned
   6 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   5 files were deleted
   0 files were repaired
   5 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   5 Notes

显示全部楼层 · 发表于 2008-7-5 19:03:36

mcafee miss

显示全部楼层 · 发表于 2008-7-5 19:45:39

检测到：木马程序 Trojan-PSW.Win32.OnLineGames.ajnn URL: http://bbs.kafan.cn/attachment.p ... 14//wow.exe//NSPack

显示全部楼层 · 发表于 2008-7-5 21:28:42

RS20.51.52未杀！

显示全部楼层 · 发表于 2008-7-5 21:29:15

原帖由 shery0000 于 2008-7-5 11:36 发表

 http://tongji520.com.cn/count/js/i1232.swf
http://count.xj.cn/count/js/css.css
http://tongji520.com.cn/count/js/update/update.exe
http://tongji520.com.cn/count/js/update/hosts.exe
http: ...

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： RootKit.Win32.RESSDT.av
病毒： Trojan.PSW.Win32.SunOnline.op
病毒： Trojan.DL.Win32.Mnless.ahr
病毒： Trojan.DL.Win32.Mnless.ane
病毒： Hack.Exploit.Swf.a

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.51.52

显示全部楼层 · 发表于 2008-7-6 03:05:03

KAV7 报杀~~

[病毒样本] 红伞

3/0

14/5