一个流行病毒样本，红伞漏杀DLL文件

绅博周幸

病毒名：Trojan-PSW.Win32.Onlinegame

里面一个是EXE文件，执行后调用DLL文件，专门盗窃网游密码


红伞漏杀的已经上报。

Thank you for your submission. Below you can see the current status of the uploaded files.


We received the following archive files:

File ID	Filename	Size (Byte)	Result
209500	1.rar	3.534	OK

A listing of files contained inside archives alongside their results can be found below:

File ID	Filename	Size (Byte)	Result
209501	upxdnd.dll	7.168	UNDER ANALYSIS

Please find a detailed report concerning each individual sample below:

Filename	Result
upxdnd.dll	UNDER ANALYSIS

The file 'upxdnd.dll' has been determined to be 'UNDER ANALYSIS'.


Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

wadia

卡巴可以查杀

sbgg110

微点程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\UPXDND.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\UPXDND.EXE
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\UPXDND.DLL
是否删除木马程序及其衍生物?

jlennon

fs

鱼是一只我

驱逐舰 Trojan.PWS.Wsgame

野马

微点

zxy900906

C:\Documents and Settings\user\桌面\upxdnd.zip »ZIP »upxdnd.dll - Win32/PSW.Agent.NCC trojan
C:\Documents and Settings\user\桌面\upxdnd.zip »ZIP »upxdnd.exe - is OK
C:\Documents and Settings\user\桌面\upxdnd.zip - Win32/PSW.Agent.NCC trojan - quarantined - deleted

hsjj2005

卡巴下载报

风野胤

nod扫描杀dll文件
运行杀exe文件

worker321

反病毒专家 AntiVirusKit 2006 扫描病毒日志记录
版本 16.0.7
双引擎反病毒签名 2007-2-19
开始时间: 2007-2-23 15:37
引擎: KAV 引擎 (AVK 16.10153), BD 引擎 (BD 16.6079)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: upxdnd.dll
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\upxdnd.zip
        Status: 已发现病毒
        病毒: Trojan-PSW.Win32.OnLineGames.es (KAV 引擎)
对象: upxdnd.zip
        路径: C:\Documents and Settings\Administrator\桌面
        Status: 已发现病毒
        病毒: Trojan-PSW.Win32.OnLineGames.es (KAV 引擎)
扫描完成: 2007-2-23 15:37
    已检查 1 个文件
    已发现 1 个染毒文件
    发现 0 个可疑文件