-{'_'}- 32x =[-_-]= -(12.04 晚间)-

lingbo110120

你上报吧...

zhuyu14

NIS2009 29个！

xiaochi12

qianwenxiang

MalwareByte's AntiMalware

ashe_vaan

花间酒

驱逐艦 报10个。

深红的雪

MSCL06.exe是onlinegame

它首先会遍历进程查找elementclient.exe，如果找不到就退出了，当然没动作
找到的话会结束elementclient.exe并替换之，释放CPWGameRecord.dll等等

杀软查不出倒是说明这个质量不错

Kitman

Begin scan in 'C:\Users\Kitman\Downloads\MCLS\MCLS'
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS01.EXE
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '498540b7.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS02.EXE
      [DETECTION] Is the TR/PSW.Online.bir Trojan
    [NOTE]      A backup was created as '4a660490.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS03.EXE
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '498540b9.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS04.EXE
      --> Object
        [1] Archive type: RSRC
        --> Object
          [DETECTION] Is the TR/Agent.arym.2 Trojan
    [NOTE]      A backup was created as '4a660492.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS05.EXE
      [DETECTION] Is the TR/PSW.Wow.ngf Trojan
    [NOTE]      A backup was created as '498540b8.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS06.EXE
    [DETECTION] Is the TR/Spy.Gen Trojan
    [NOTE]      A backup was created as '4a660491.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS07.EXE
      [DETECTION] Is the TR/PSW.Online.bir Trojan
    [NOTE]      A backup was created as '498540ba.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS08.EXE
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a660493.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS09.EXE
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '498540bb.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS10.EXE
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a660494.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS11.EXE
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '498540bd.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS12.EXE
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '498540bc.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS13.EXE
      [DETECTION] Is the TR/PSW.Online.bin Trojan
    [NOTE]      A backup was created as '4a660495.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS14.EXE
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '498540be.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS15.EXE
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a660496.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS16.EXE
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '498540bf.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS17.EXE
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a6604e8.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS18.EXE
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a660497.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS19.EXE
      [DETECTION] Is the TR/PSW.Online.bir Trojan
    [NOTE]      A backup was created as '498540b0.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS20.EXE
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a660499.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS21.EXE
      [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '498540c1.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS22.EXE
      [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a6604ea.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS23.EXE
      [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '498540c3.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS24.EXE
      [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '498540b2.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS25.EXE
      [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '4a66049b.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS26.EXE
      [DETECTION] Is the TR/Dldr.BHOSta Trojan
    [NOTE]      A backup was created as '4a6604ec.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS27.EXE
      [DETECTION] Is the TR/PSW.Online.bir Trojan
    [NOTE]      A backup was created as '498540c5.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS28.EXE
    [DETECTION] Is the TR/Hijacker.Gen Trojan
    [NOTE]      A backup was created as '4a6604ee.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS29.EXE
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '498540c7.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS31.DLL
    [DETECTION] Is the TR/Inject.SJ.4 Trojan
    [NOTE]      A backup was created as '498540c0.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Users\Kitman\Downloads\MCLS\MCLS\MCLS32.SYS
    [DETECTION] Contains recognition pattern of the RKIT/Agent.AIWN.3 root kit
    [NOTE]      A backup was created as '4a6604e9.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!


End of the scan: 2008年12月5日  22:53
Used time: 00:11 Minute(s)

The scan has been done completely.

      1 Scanning directories
     32 Files were scanned
     31 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     31 files were deleted
      0 files were repaired
     31 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      0 Archives were scanned
      0 Warnings
     31 Notes

The file 'MCLS30.DLL' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

[ 本帖最后由 Kitman 于 2008-12-5 23:05 编辑 ]

挪威的冬天

为啥遍历的时候漏掉了最后那个 sys 乜...怪了

金山毒霸可信认证技术查询结果如下

MCLS01.EXE     -----------     分析中
MCLS02.EXE     -----------     分析中
MCLS03.EXE     -----------     分析中
MCLS04.EXE     -----------     未知
MCLS05.EXE     -----------     病毒
MCLS06.EXE     -----------     分析中
MCLS07.EXE     -----------     可疑的
MCLS08.EXE     -----------     分析中
MCLS09.EXE     -----------     分析中
MCLS10.EXE     -----------     分析中
MCLS11.EXE     -----------     分析中
MCLS12.EXE     -----------     分析中
MCLS13.EXE     -----------     分析中
MCLS14.EXE     -----------     可疑的
MCLS15.EXE     -----------     分析中
MCLS16.EXE     -----------     分析中
MCLS17.EXE     -----------     分析中
MCLS18.EXE     -----------     可疑的
MCLS19.EXE     -----------     分析中
MCLS20.EXE     -----------     分析中
MCLS21.EXE     -----------     可疑的
MCLS22.EXE     -----------     分析中
MCLS23.EXE     -----------     分析中
MCLS24.EXE     -----------     分析中
MCLS25.EXE     -----------     分析中
MCLS26.EXE     -----------     可疑的
MCLS27.EXE     -----------     分析中
MCLS28.EXE     -----------     分析中
MCLS29.EXE     -----------     分析中
MCLS30.DLL     -----------     安全(*)
MCLS31.DLL     -----------     分析中