wsock32.dll变种？

欠妳緈諨

以前论坛好像有朋友发过这个东东，今天闲来无事用AVG扫描系统盘，居然惊奇发现我的电脑上也有这个东东，都不知道什么时候混进来的 难怪前几天打开火狐时avast！拦截器提示火狐要编写什么wsock32.dll（在ie目录下） ，另外还有个webcint.dll(在system32目录下），avast！拦截器也提示了！当时没多想居然点了允许，汗！数字鹰 也毫无反应！不知道这个东东有什么危害，反正目前电脑电脑一切正常！

小邪邪

2007-4-15        22:14:38        err\err        
PWS-LegMir.dll(特洛伊)

2007-4-15        22:14:38        webcint.dll\webcint.dll        
PWS-LegMir.dll(特洛伊)

2007-4-15        22:14:38        wsock32.dll\wsock32.dll        
PWS-LegMir.dll(特洛伊)

扫描器：

[webcint.dll]
BD标准引擎 |  没有发现病毒
卡巴标准引擎|   Trojan-PSW.Win32.Lmir.bfc
大蜘蛛标准引擎|  没有发现病毒
VBA32标准引擎|  ected   : 0       - infected    : 0     

[err]
BD标准引擎 |  没有发现病毒
卡巴标准引擎|   Trojan-PSW.Win32.Lmir.bfc
大蜘蛛标准引擎|  没有发现病毒
VBA32标准引擎|  ected   : 0       - infected    : 0     

[wsock32.dll]
BD标准引擎 |  没有发现病毒
卡巴标准引擎|   Trojan-PSW.Win32.Lmir.bfc
大蜘蛛标准引擎|  没有发现病毒
VBA32标准引擎|  ected   : 0       - infected    : 0

[ 本帖最后由 小邪邪 于 2007-4-15 22:19 编辑 ]

solcroft

解压时AVG连报三个

欠妳緈諨

金山可以杀

欠妳緈諨

看到PSW我就头皮发麻 ，难道是盗号的木马

aoyang

估计是木马之类的
费尔扫描报告
Date,Virus Name,Virus Type,User,Filename,Scan Type
2007-4-15 22:22:36,Trojan.Lemir.jazd.dll,木马,BEYOND,C:\Documents and Settings\BEYOND\桌面\WSOCK变种.rar>>wsock32.dll,Manual scan
2007-4-15 22:22:36,Trojan.Lemir.jazd.dll,木马,BEYOND,C:\Documents and Settings\BEYOND\桌面\WSOCK变种.rar>>webcint.dll,Manual scan
2007-4-15 22:22:36,Trojan.Lemir.jazd.dll,木马,BEYOND,C:\Documents and Settings\BEYOND\桌面\WSOCK变种.rar>>err,Manual scan

kp2006

avast!不报

蓝色牛仔裤

Check system areas...
Check selected directories and files...
Object: webcint.dll
        In archive: C:\Documents and Settings\Administrator\桌面\WSOCK变种.rar
        Status: Virus detected
        Virus: Trojan-PSW.Win32.Lmir.bfc (KAV engine)
Object: err
        In archive: C:\Documents and Settings\Administrator\桌面\WSOCK变种.rar
        Status: Virus detected
        Virus: Trojan-PSW.Win32.Lmir.bfc (KAV engine)
Object: wsock32.dll
        In archive: C:\Documents and Settings\Administrator\桌面\WSOCK变种.rar
        Status: Virus detected
        Virus: Trojan-PSW.Win32.Lmir.bfc (KAV engine)
Object: WSOCK变种.rar
        Path: C:\Documents and Settings\Administrator\桌面
        Status: Virus, file deleted
        Virus: Trojan-PSW.Win32.Lmir.bfc (3x) (KAV engine)

The EQs

Scan performed at: 2007-4-16 0:21:32
Scanning Log
NOD32 version 2190 (20070415) NT
Command line: C:\Documents and Settings\EQ2\桌面\WSOCK变种.rar
Operating memory - is OK

Date: 16.4.2007  Time: 00:21:37
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\WSOCK变种.rar
C:\Documents and Settings\EQ2\桌面\WSOCK变种.rar ?RAR ?webcint.dll - Win32/PSW.Legendmir.BFC trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\WSOCK变种.rar ?RAR ?err - Win32/PSW.Legendmir.BFC trojan - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\WSOCK变种.rar ?RAR ?wsock32.dll - Win32/PSW.Legendmir.BFC trojan - was a part of the deleted object
Number of scanned files: 4
Number of threats found: 3
Number of files cleaned: 1
Time of completion: 00:21:37 Total scanning time: 0 sec (00:00:00)

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\WSOCK����.rar'
C:\Documents and Settings\morgan\My Documents\
  WSOCK����.rar
    [0] Archive type: RAR
    --> webcint.dll
        [DETECTION] Is the Trojan horse TR/PSW.Lmir.bfc.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> err
        [DETECTION] Is the Trojan horse TR/PSW.Lmir.bfc.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> wsock32.dll
        [DETECTION] Is the Trojan horse TR/PSW.Lmir.bfc.1
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!