呈上一包LYLOADER

promised

Scan performed at: 2007-5-8 21:18:49
Scanning Log
NOD32 version 2249 (20070508) NT
Command line: D:\LYLOADER[1]
Operating memory - is OK

Date: 8.5.2007  Time: 21:18:57
Anti-Stealth technology is enabled.
Scanned disks, folders and files: D:\LYLOADER[1]\
D:\LYLOADER[1]\LYLOADER\cmdbcs.dll - a variant of Win32/PSW.Agent.NCC trojan
D:\LYLOADER[1]\LYLOADER\cmdbcs.exe - a variant of Win32/PSW.Agent.NCC trojan
D:\LYLOADER[1]\LYLOADER\ctfnom.exe - probably unknown NewHeur_PE virus [7]
D:\LYLOADER[1]\LYLOADER\javavm.exe - probably unknown NewHeur_PE virus [7]
D:\LYLOADER[1]\LYLOADER\Kvsc3.dll - Win32/PSW.Agent.NCC trojan - deleted
D:\LYLOADER[1]\LYLOADER\Kvsc3.exe - a variant of Win32/PSW.Agent.NCC trojan
D:\LYLOADER[1]\LYLOADER\LYLOADER.EXE - a variant of Win32/PSW.Agent.NEC trojan
D:\LYLOADER[1]\LYLOADER\LYMANGR.DLL - a variant of Win32/PSW.Agent.NEC trojan
D:\LYLOADER[1]\LYLOADER\mppds.dll - Win32/PSW.Agent.NCC trojan - deleted
D:\LYLOADER[1]\LYLOADER\mppds.exe - a variant of Win32/PSW.Agent.NCC trojan
D:\LYLOADER[1]\LYLOADER\msccrt.exe - a variant of Win32/PSW.Agent.NCC trojan
D:\LYLOADER[1]\LYLOADER\MSDEG32.DLL - a variant of Win32/PSW.Agent.NEC trojan
D:\LYLOADER[1]\LYLOADER\nwizqjsj.exe - probably a variant of Win32/Genetik trojan
D:\LYLOADER[1]\LYLOADER\servet.exe - Win32/Pacex.Gen virus
D:\LYLOADER[1]\LYLOADER\serveter.exe - a variant of Win32/TrojanDownloader.Delf.BHO trojan
D:\LYLOADER[1]\LYLOADER\shualai.dll - a variant of Win32/Agent.NHN trojan
D:\LYLOADER[1]\LYLOADER\shualai.exe - Win32/Agent.NHN trojan - deleted
D:\LYLOADER[1]\LYLOADER\SMSSS.exe - Win32/Agent.ALH trojan - deleted
D:\LYLOADER[1]\LYLOADER\svchost.exe - a variant of Win32/TrojanDownloader.Delf.BHO trojan
D:\LYLOADER[1]\LYLOADER\winform.exe - probably a variant of Win32/PSW.Agent.NCC trojan
D:\LYLOADER[1]\LYLOADER\~tmp.tmp - Win32/Pacex.Gen virus
Number of scanned files: 35
Number of threats found: 21
Number of files cleaned: 21
Time of completion: 21:19:23 Total scanning time: 26 sec (00:00:26)

Notes:
[7] File is probably infected with an unknown virus.

mr_zhj

熊猫卫士2007杀了18个，报3个启发

wangjay1980

detected: Trojan program Trojan-PSW.Win32.OnLineGames.nw        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\alg32.dat//PE_Patch.PECompact//PecBundle//PECompact
detected: Trojan program Trojan-PSW.Win32.OnLineGames.nw        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\alg32.exe//PE_Patch.PECompact//PecBundle//PECompact
detected: Trojan program Trojan-PSW.Win32.OnLineGames.es        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\cmdbcs.exe
detected: Trojan program Trojan-Downloader.Win32.Small.czl        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\ctfnom.exe//FSG
detected: Trojan program Trojan-PSW.Win32.OnLineGames.es        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\javavm.exe
detected: virus Invader (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\Kvsc3.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.nn        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\LYLOADER.EXE//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.nn        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\LYMANGR.DLL
detected: Trojan program Trojan-PSW.Win32.OnLineGames.es        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\mppds.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.qy        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\mppds.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.es        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\msccrt.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.nb        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\msccrt.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.nw        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\MSTCS.exe//PE_Patch.PECompact//PecBundle//PECompact
detected: Trojan program Trojan-PSW.Win32.WOW.qp        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\nwizAsktao.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.ql        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\nwizqjsj.exe//UPack
detected: Trojan program Trojan-PSW.Win32.Nilage.bjp        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\nwiztlbu.dll
detected: Trojan program Trojan-PSW.Win32.Nilage.bjp        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\nwiztlbu.exe//PE_Patch//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.rc        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\qjsj100.dll
detected: Trojan program Trojan-PSW.Win32.Delf.qc        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\rising883.exe//UPX
detected: virus Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\servet.exe
detected: virus Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\serveter.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.sa        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\shualai.exe
detected: Trojan program Backdoor.Win32.Agent.alh        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\SMSSS.exe//data.rar/systemt.exe//UPack
detected: virus Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\svchost.exe//UPack
detected: Trojan program Trojan-PSW.Win32.OnLineGames.qh        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\winform.dll
detected: Trojan program Trojan-PSW.Win32.OnLineGames.lc        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\winform.exe
detected: Trojan program Trojan-PSW.Win32.OnLineGames.nw        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\Winhttps.dat
detected: Trojan program Trojan-PSW.Win32.OnLineGames.nw        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\Winhttps.dll
detected: virus Worm.Win32.Viking.lh        File: C:\Documents and Settings\Owner\×ÀÃæ\LYLOADER\~tmp.tmp

promised

原帖由 mr_zhj 于 2007-5-8 21:20 发表
熊猫卫士2007杀了18个，报3个启发

NOD32基本都在那里启发

hj5abc

NOD32 4个不是启发的..不过撑死才21个..

tracydk

Starting the file scan:

Begin scan in 'F:\样本\LYLOADER.part1.rar'
F:\样本\LYLOADER.part1.rar
  [0] Archive type: RAR
  --> LYLOADER\alg32.dat
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW.10
  --> LYLOADER\alg32.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW.10
  --> LYLOADER\cmdbcs.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> LYLOADER\cmdbcs.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ARI.223
  --> LYLOADER\ctfnom.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> LYLOADER\javavm.dll
      [DETECTION] Is the Trojan horse TR/Agent.6656.54
  --> LYLOADER\javavm.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.2061
  --> LYLOADER\Kvsc3.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> LYLOADER\Kvsc3.exe
      [DETECTION] Is the Trojan horse TR/Agent.12288.33
  --> LYLOADER\LYLOADER.EXE
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NN.34
  --> LYLOADER\LYMANGR.DLL
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NN.34
  --> LYLOADER\mppds.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.1934
  --> LYLOADER\mppds.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.QY.68
  --> LYLOADER\msccrt.dll
      [DETECTION] Is the Trojan horse TR/PSW.10752.10
  --> LYLOADER\msccrt.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> LYLOADER\MSDEG32.DLL
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
  --> LYLOADER\MSTCS.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW.10
  --> LYLOADER\nwizAsktao.dll
      [DETECTION] Is the Trojan horse TR/Agent.7680.57
  --> LYLOADER\nwizAsktao.exe
      [DETECTION] Is the Trojan horse TR/Agent.7680.57
  --> LYLOADER\nwizqjsj.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.QL.32
  --> LYLOADER\nwiztlbu.dll
      [DETECTION] Is the Trojan horse TR/PSW.Nilage.bjp.1
  --> LYLOADER\nwiztlbu.exe
      [DETECTION] Is the Trojan horse TR/PSW.Nilage.bjp.1
  --> LYLOADER\qjsj100.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.RC.13
  --> LYLOADER\rising883.exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.QC.24
  --> LYLOADER\servet.exe
      [DETECTION] Is the Trojan horse TR/Drop.Ag.344576.B
  --> LYLOADER\serveter.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> LYLOADER\shualai.dll
      [DETECTION] Contains suspicious code HEUR/Malware
  --> LYLOADER\shualai.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.SA.20
      [INFO]      The file was deleted!
Begin scan in 'F:\样本\LYLOADER.part2.rar'
F:\样本\LYLOADER.part2.rar
  [0] Archive type: RAR
  --> LYLOADER\svchost.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> LYLOADER\winform.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.QH.24
  --> LYLOADER\winform.exe
      [DETECTION] Is the Trojan horse TR/Agent.18432.32
  --> LYLOADER\Winhttps.dat
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW.18
  --> LYLOADER\Winhttps.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW.18
  --> LYLOADER\~tmp.tmp
      [DETECTION] Is the Trojan horse TR/Drop.Ag.344576.B
      [INFO]      The file was deleted!

yinxuchina

北京江民新科技术有限公司

        扫描引擎 10.00.600
        病毒库日期 2007-05-08
        更新日期 2007-05-08

扫描目标 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\

开始时间 2007-05-08 22:39:06

在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\alg32.dat 中发现 Trojan/PSW.OnLineGames.atp 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\alg32.exe 中发现 Trojan/PSW.OnLineGames.atp 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\cmdbcs.exe 中发现 Trojan/PSW.GamePass.hzg 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\ctfnom.exe 中发现 Trojan/PSW.GamePass.hvi 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\javavm.dll 中发现 Trojan/PSW.Agent.dap 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\javavm.exe 中发现 Trojan/PSW.GamePass.gts 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\Kvsc3.dll 中发现 Trojan/Agent.hsm 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\Kvsc3.exe 中发现 Trojan/PSW.GamePass.hzh 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\mppds.dll 中发现 Trojan/PSW.Moshou.ym 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\LYLOADER.EXE 中发现 Trojan/PSW.GamePass.gyd 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\mppds.exe 中发现 Trojan/PSW.GamePass.hyd 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\msccrt.exe 中发现 Trojan/PSW.OnLineGames.avk 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\MSDEG32.DLL 中发现 Trojan/PSW.Xiyou.lx.Dll 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\MSTCS.exe 中发现 Trojan/PSW.OnLineGames.atp 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\nwizAsktao.dll 中发现 Trojan/Agent.hoo 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\nwizAsktao.exe 中发现 Trojan/PSW.GamePass.hvs 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\nwiztlbu.dll 中发现 Trojan/PSW.Nilage.adc 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\nwiztlbu.exe 中发现 TrojanDownloader.Adload.lp 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\nwizqjsj.exe 中发现 Trojan/Agent.hhp 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\qjsj100.dll 中发现 Trojan/Agent.hlh 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\SMSSS.exe->systemt.exe 中发现 Trojan/Agent.crd 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\winform.dll 中发现 Trojan/PSW.OnLineGames.avh 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\winform.exe 中发现 Trojan/PSW.GamePass.hnx 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\virus\LYLOADER\~tmp.tmp 中发现 TrojanDropper.Agent.bbq 病毒, 已删除
正常结束。

扫描结果:
                 文件数 :41                                  病毒体 :24        
                   删除 :24                                    解毒 :0         
    扫描速度(千字节/秒) :729                               扫描时间 :00:00:02
    扫描文件速度(个/秒) :20

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\LYLOADER'
C:\Documents and Settings\morgan\My Documents\LYLOADER\LYLOADER\
  alg32.dat
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW.10
      [INFO]      The file was deleted!
  alg32.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW.10
      [INFO]      The file was deleted!
  cmdbcs.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '46a49311.qua'!
  cmdbcs.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ARI.223
      [INFO]      The file was deleted!
  ctfnom.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was deleted!
  javavm.dll
      [DETECTION] Is the Trojan horse TR/Agent.6656.54
      [INFO]      The file was deleted!
  javavm.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.2061
      [INFO]      The file was deleted!
  Kvsc3.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '46b3931b.qua'!
  Kvsc3.exe
      [DETECTION] Is the Trojan horse TR/Agent.12288.33
      [INFO]      The file was deleted!
  LYLOADER.EXE
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NN.34
      [INFO]      The file was deleted!
  LYMANGR.DLL
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NN.34
      [INFO]      The file was deleted!
  mppds.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.1934
      [INFO]      The file was deleted!
  mppds.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.QY.68
      [INFO]      The file was deleted!
  msccrt.dll
      [DETECTION] Is the Trojan horse TR/PSW.10752.10
      [INFO]      The file was deleted!
  msccrt.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NB.186
      [INFO]      The file was deleted!
  MSDEG32.DLL
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
      [INFO]      The file was moved to '468492fa.qua'!
  MSTCS.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW.10
      [INFO]      The file was deleted!
  nwizAsktao.dll
      [DETECTION] Is the Trojan horse TR/Agent.7680.57
      [INFO]      The file was deleted!
  nwizAsktao.exe
      [DETECTION] Is the Trojan horse TR/Agent.7680.57
      [INFO]      The file was deleted!
  nwizqjsj.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.QL.32
      [INFO]      The file was deleted!
  nwiztlbu.dll
      [DETECTION] Is the Trojan horse TR/PSW.Nilage.bjp.1
      [INFO]      The file was deleted!
  nwiztlbu.exe
      [DETECTION] Is the Trojan horse TR/PSW.Nilage.bjp.1
      [INFO]      The file was deleted!
  qjsj100.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.RC.13
      [INFO]      The file was deleted!
  rising883.exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.QC.24
      [INFO]      The file was deleted!
  servet.exe
      [DETECTION] Is the Trojan horse TR/Drop.Ag.344576.B
      [INFO]      The file was deleted!
  serveter.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!
  shualai.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '46b59312.qua'!
  shualai.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.SA.20
      [INFO]      The file was deleted!
  SMSSS.exe
      [DETECTION] Is the Trojan horse TR/Drop.Delf.aom
      [INFO]      The file was deleted!
  svchost.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
      [INFO]      The file was deleted!
  winform.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.QH.24
      [INFO]      The file was deleted!
  winform.exe
      [DETECTION] Is the Trojan horse TR/Agent.18432.32
      [INFO]      The file was deleted!
  Winhttps.dat
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW.18
      [INFO]      The file was deleted!
  Winhttps.dll
      [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NW.18
      [INFO]      The file was deleted!
  ~tmp.tmp
      [DETECTION] Is the Trojan horse TR/Drop.Ag.344576.B
      [INFO]      The file was deleted!


End of the scan: 2007年5月8日  08:09
Used time: 00:15 min

The scan has been done completely.

      2 Scanning directories
     35 Files were scanned
     35 viruses and/or unwanted programs were found
      3 classified as suspicious:
     31 files were deleted
      0 files were repaired
      4 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     -3 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

allenhippo

norton 23个

CreaCR

微点全杀