一包22个，21个过卡巴

dikex

一包22个文件，21个过卡巴，全部都是最外面那个svchost.exe下载的毒的一部分；

svchost.exe卡巴报为Virus.Win32.AutoRun.p，简单分析看这里，它会删除许多其他病毒在HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\下面的注册表项！

http://hi.baidu.com/dikex/blog/item/75ea9e440fb3ed83b2b7dca5.html


样本密码：infected

The EQs

可怜啊。。。。nod32一个也不报。。。。

qwerasdf123

2005-5-21,23:16:26 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\rxso.exe
2005-5-21,23:16:26 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\rxso.exe
2005-5-21,23:16:24 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\rxso.exe
2005-5-21,23:16:29 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\rxso0.dll
2005-5-21,23:16:29 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\rxso0.dll
2005-5-21,23:16:29 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\rxso0.dll
2005-5-21,23:16:32 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\tlso.exe
2005-5-21,23:16:34 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\tlso0.dll
2005-5-21,23:16:35 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\wdso.exe
2005-5-21,23:16:36 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\wdso0.dll
2005-5-21,23:16:37 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\wgso0.dll
2005-5-21,23:16:38 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\wlso.exe
2005-5-21,23:16:39 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\wlso0.dll
2005-5-21,23:16:41 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\wmso.exe
2005-5-21,23:16:42 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\wmso0.dll
2005-5-21,23:16:44 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\woso0.dll
2005-5-21,23:16:42 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\woso0.dll
2005-5-21,23:16:44 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\woso0.dll
2005-5-21,23:16:46 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\ztso0.dll
2005-5-21,23:16:46 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\ztso0.dll
2005-5-21,23:16:46 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\ztso0.dll
2005-5-21,23:16:48 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\daso.exe
2005-5-21,23:16:48 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\daso.exe
2005-5-21,23:16:48 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\daso.exe
2005-5-21,23:16:49 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\daso0.dll
2005-5-21,23:16:50 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\fyso.exe
2005-5-21,23:16:51 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\fyso0.dll
2005-5-21,23:16:52 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\jtso.exe
2005-5-21,23:16:52 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\jtso0.dll
2005-5-21,23:16:53 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\qjso.exe
2005-5-21,23:16:54 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\a\qjso0.dll
2005-5-21,23:16:55 [WARNING] Is the Trojan horse TR/Crypt.ULPM.Gen!
  C:\Documents and Settings\Administrator\桌面\2007-05-21-1\svchost.exe

The EQs

壮观啊。。这么多壳。。。

zane_xzz

红伞清一色报壳

yzt1004

AVG AntiSpyware7.5没反应
甩官方了

dikex

那个svchost还会对比服务器和本地的病毒的版本，以进行即使更新，所以这些样本都是比较新的

moonsilver

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.OnlineGames.bph
病毒： Trojan.PSW.OnlineGames.bph
病毒： Trojan.PSW.OnlineGames.bpi
病毒： Trojan.PSW.OnlineGames.bpi
病毒： Trojan.PSW.OnlineGames.bpj
病毒： Trojan.PSW.OnlineGames.bpj
病毒： Trojan.PSW.OnlineGames.bpk
病毒： Trojan.PSW.OnlineGames.bpk
病毒： Trojan.PSW.OnlineGames.bpl
病毒： Trojan.PSW.OnlineGames.bpl
病毒： Trojan.PSW.OnlineGames.bpn
病毒： Trojan.PSW.OnlineGames.bpn
病毒： Trojan.PSW.OnlineGames.bpo
病毒： Trojan.PSW.OnlineGames.bpo
病毒： Trojan.PSW.OnlineGames.bpp
病毒： Trojan.PSW.OnlineGames.bpq
病毒： Trojan.PSW.OnlineGames.bpq
病毒： Trojan.PSW.OnlineGames.bpr
病毒： Trojan.PSW.OnlineGames.bpr
病毒： Trojan.PSW.OnlineGames.bps
病毒： Trojan.PSW.OnlineGames.bpt

用户来源：互联网

软件版本：19.24.02



瑞星报了21个，只有那个svchost没报

[ 本帖最后由 moonsilver 于 2007-5-21 23:31 编辑 ]

yzt1004

19号的病毒库还是0呢
瑞星对本土东西就是不一样

The EQs

瑞星。。。不敢苟同ing