呈上一包LYLOADER

一派胡言

杀！

soul20010

为解压缩扫描，BD10有31个。。。

欠妳緈諨

15个

caocao

KIS25个
已检测: 木马程序 Backdoor.Win32.Agent.ahj        URL: http://bbs.kafan.cn/attachment.php?aid=66266//rising.exe
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.nw        URL: http://bbs.kafan.cn/attachment.p ... ecBundle//PECompact
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.nw        URL: http://bbs.kafan.cn/attachment.p ... ecBundle//PECompact
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.qh        URL: http://bbs.kafan.cn/attachment.p ... YLOADER/winform.dll
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.es        URL: http://bbs.kafan.cn/attachment.php?aid=66403//LYLOADER/cmdbcs.exe
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.lc        URL: http://bbs.kafan.cn/attachment.p ... YLOADER/winform.exe
已检测: 木马程序 Trojan-Downloader.Win32.Small.czl        URL: http://bbs.kafan.cn/attachment.p ... DER/ctfnom.exe//FSG
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.nw        URL: http://bbs.kafan.cn/attachment.p ... LOADER/Winhttps.dat
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.es        URL: http://bbs.kafan.cn/attachment.php?aid=66403//LYLOADER/javavm.exe
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.nw        URL: http://bbs.kafan.cn/attachment.p ... LOADER/Winhttps.dll
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.nn        URL: http://bbs.kafan.cn/attachment.p ... XE//PE_Patch//UPack
已检测: 病毒 Worm.Win32.Viking.lh        URL: http://bbs.kafan.cn/attachment.php?aid=66404//LYLOADER/~tmp.tmp
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.nn        URL: http://bbs.kafan.cn/attachment.p ... YLOADER/LYMANGR.DLL
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.es        URL: http://bbs.kafan.cn/attachment.php?aid=66403//LYLOADER/mppds.dll
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.qy        URL: http://bbs.kafan.cn/attachment.php?aid=66403//LYLOADER/mppds.exe
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.es        URL: http://bbs.kafan.cn/attachment.php?aid=66403//LYLOADER/msccrt.dll
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.nb        URL: http://bbs.kafan.cn/attachment.php?aid=66403//LYLOADER/msccrt.exe
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.nw        URL: http://bbs.kafan.cn/attachment.p ... ecBundle//PECompact
已检测: 木马程序 Trojan-PSW.Win32.WOW.qp        URL: http://bbs.kafan.cn/attachment.p ... xe//PE_Patch//UPack
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.ql        URL: http://bbs.kafan.cn/attachment.p ... nwizqjsj.exe//UPack
已检测: 木马程序 Trojan-PSW.Win32.Nilage.bjp        URL: http://bbs.kafan.cn/attachment.p ... LOADER/nwiztlbu.dll
已检测: 木马程序 Trojan-PSW.Win32.Nilage.bjp        URL: http://bbs.kafan.cn/attachment.p ... xe//PE_Patch//UPack
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.rc        URL: http://bbs.kafan.cn/attachment.p ... YLOADER/qjsj100.dll
已检测: 木马程序 Trojan-PSW.Win32.Delf.qc        URL: http://bbs.kafan.cn/attachment.p ... /rising883.exe//UPX
已检测: 木马程序 Trojan-PSW.Win32.OnLineGames.sa        URL: http://bbs.kafan.cn/attachment.p ... YLOADER/shualai.exe

dyw1021

费尔杀了25个

小邪邪

jlennon

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-5-4
Start time: 2007-5-8 20:23
Engine(s): KAV engine (AVK 17.5061), BD-Engine (BD 17.4685)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: alg32.dat
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.nw (KAV engine), Trojan.PWS.OnLineGames.ASC (BD-Engine)
Object: alg32.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.nw (KAV engine), Trojan.PWS.OnLineGames.ASC (BD-Engine)
Object: cmdbcs.dll
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Generic.PWS.Games.F73C9754 (BD-Engine)
Object: cmdbcs.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.es (KAV engine), Trojan.PWS.OnLineGames.ARI (BD-Engine)
Object: ctfnom.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-Downloader.Win32.Small.czl (KAV engine), Trojan.PWS.Lmir.AII (BD-Engine)
Object: javavm.dll
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Generic.Malware.PWS.7A619E10 (BD-Engine)
Object: javavm.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.es (KAV engine), Generic.Malware.Sdld!gPWS.11911CA4 (BD-Engine)
Object: Kvsc3.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Generic.Malware.Sdld!gPWS.3CF39842 (BD-Engine)
Object: LYLOADER.EXE
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.nn (KAV engine), Trojan.PWS.OnLineGames.ASF (BD-Engine)
Object: LYMANGR.DLL
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.nn (KAV engine), Trojan.PWS.OnLineGames.ASF (BD-Engine)
Object: mppds.dll
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.es (KAV engine), Trojan.PWS.OnLineGames.ARJ (BD-Engine)
Object: mppds.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.qy (KAV engine), Generic.Malware.SdldgPWS.0C928B5E (BD-Engine)
Object: msccrt.dll
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.es (KAV engine), Generic.PWS.Games.4B2DD4A6 (BD-Engine)
Object: msccrt.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.nb (KAV engine), Generic.Malware.SdldgPWS.46002698 (BD-Engine)
Object: MSTCS.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.nw (KAV engine), Trojan.PWS.OnLineGames.ASC (BD-Engine)
Object: nwizAsktao.dll
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Generic.Malware.gPWS.E13ACEA3 (BD-Engine)
Object: nwizAsktao.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.WOW.qp (KAV engine)
Object: nwizqjsj.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.ql (KAV engine), Trojan.PWS.OnLineGames.ASE (BD-Engine)
Object: nwiztlbu.dll
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.Nilage.bjp (KAV engine), Generic.Malware.gPWS.0A10B377 (BD-Engine)
Object: nwiztlbu.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.Nilage.bjp (KAV engine)
Object: qjsj100.dll
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.rc (KAV engine), Trojan.PWS.OnLineGames.FF (BD-Engine)
Object: rising883.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.Delf.qc (KAV engine), Generic.PWStealer.3E162211 (BD-Engine)
Object: servet.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan.PWS.Onlinegames.EF (BD-Engine)
Object: serveter.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Generic.Malware.WBdld.D4E87332 (BD-Engine)
Object: shualai.dll
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Generic.PWS.Games.2F724471 (BD-Engine)
Object: shualai.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.sa (KAV engine), Generic.Malware.SdldPWS.BD42B1AE (BD-Engine)
Object: data.rar systemt.exe
        In archive: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER\SMSSS.exe
        Status: Virus detected
        Virus: Backdoor.Win32.Agent.alh (KAV engine)
Object: (RAR Sfx o) systemt.exe
        In archive: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER\SMSSS.exe
        Status: Virus detected
        Virus: Trojan.Spy.Agent.QP (BD-Engine)
Object: SMSSS.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Backdoor.Win32.Agent.alh (KAV engine), Trojan.Spy.Agent.QP (BD-Engine)
Object: svchost.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Generic.Malware.WBdld.D4E87332 (BD-Engine)
Object: winform.dll
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.qh (KAV engine), Generic.PWS.Games.5E8C9078 (BD-Engine)
Object: winform.exe
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.lc (KAV engine), Generic.Malware.SgPWS.0D5A49ED (BD-Engine)
Object: Winhttps.dat
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.nw (KAV engine), Trojan.PWS.OnLineGames.ASC (BD-Engine)
Object: Winhttps.dll
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Trojan-PSW.Win32.OnLineGames.nw (KAV engine), Trojan.PWS.OnLineGames.ASC (BD-Engine)
Object: ~tmp.tmp
        Path: C:\Documents and Settings\Administrator\桌面\LYLOADER[1]\LYLOADER
        Status: Move file into quarantine
        Virus: Worm.Win32.Viking.lh (KAV engine), Trojan.PWS.Onlinegames.EF (BD-Engine)
Analysis complete: 2007-5-8 20:23
    35 files checked
    33 infected files detected
    0 suspected files detected

金剑

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用
蜜罐检测:正常 OK!

===============================================
   ___________病毒查杀结果__________________


===============================================

2007年5月8日20时33分3秒 开始查杀C:\Documents and Settings\Administrator\桌面\0707\LYLOADER
威胁性文件：C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\alg32.exe
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\alg32.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\ctfnom.exe 操作:阻止运行
威胁性文件：C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\javavm.exe
威胁性文件：C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\MSTCS.exe
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\nwizAsktao.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\nwizqjsj.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\rising883.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\servet.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\serveter.exe 操作:阻止运行
威胁性文件：C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\SMSSS.exe
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\svchost.exe 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\LYMANGR.DLL 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\MSDEG32.DLL 操作:阻止运行
  未知的木马病毒(启发)C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\~tmp.tmp 操作:阻止运行
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。


C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\rising883.exe 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\servet.exe 带壳文件:UPX加壳
C:\Documents and Settings\Administrator\桌面\0707\LYLOADER\LYLOADER\~tmp.tmp 带壳文件:UPX加壳
-----------------------------------------

2007年5月8日20时33分8秒收起线程…100% 查杀完毕！
扫描文件：33查杀病毒：15

moonsilver

zane_xzz

小红伞搞定36个