来一包!!!

wangjay1980

9个

tracydk

Starting the file scan:

Begin scan in 'F:\样本\下载基地9.zip'
F:\样本\下载基地9.zip
  [0] Archive type: ZIP
  --> IEXPLORE.EXE
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> mmc.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> services.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> spglsdr.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> srogm.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> stpgldk.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> svchost(1).exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> conime.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> copypfh.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\下载基地9.zip'
C:\Documents and Settings\morgan\My Documents\
  下载基地9.zip
    [0] Archive type: ZIP
    --> IEXPLORE.EXE
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> mmc.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> services.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> spglsdr.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> srogm.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> stpgldk.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> svchost(1).exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> conime.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> copypfh.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

扫描日志
NOD32版本 2279 (20070521) NT
命令行： C:\Documents and Settings\morgan\My Documents\ ?
?下载基地9.zip
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 21.5.2007  时间：17:44:48
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\ ?
?morgan\My Documents\下载基地9.zip
C:\Documents and Settings\morgan\My Documents\下载基地9. ?
?zip >>ZIP >>IEXPLORE.EXE - 是正常的
C:\Documents and Settings\morgan\My Documents\下载基地9. ?
?zip >>ZIP >>mmc.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\下载基地9. ?
?zip >>ZIP >>services.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\下载基地9. ?
?zip >>ZIP >>spglsdr.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\下载基地9. ?
?zip >>ZIP >>srogm.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\下载基地9. ?
?zip >>ZIP >>stpgldk.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\下载基地9. ?
?zip >>ZIP >>svchost(1).exe - 是正常的
C:\Documents and Settings\morgan\My Documents\下载基地9. ?
?zip >>ZIP >>conime.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\下载基地9. ?
?zip >>ZIP >>copypfh.exe - 是正常的
已扫描的文件数目：9
已发现的病毒数目：0
完成时间： 17:44:53 总扫描时间：5 秒 (00:00:05)


[Scan path] C:\Documents and Settings\morgan\My Documents\下载基地9.zip
>C:\Documents and Settings\morgan\My Documents\下载基地9.zip\IEXPLORE.EXE infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\morgan\My Documents\下载基地9.zip\mmc.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\morgan\My Documents\下载基地9.zip\services.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\morgan\My Documents\下载基地9.zip\spglsdr.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\morgan\My Documents\下载基地9.zip\srogm.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\morgan\My Documents\下载基地9.zip\stpgldk.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\morgan\My Documents\下载基地9.zip\svchost(1).exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\morgan\My Documents\下载基地9.zip\conime.exe infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\morgan\My Documents\下载基地9.zip\copypfh.exe infected with Trojan.PWS.Wsgame
C:\Documents and Settings\morgan\My Documents\下载基地9.zip - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 11
Infected objects found: 9
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 122 Kb/s
Scan time: 00:00:01

tracydk

LS的装两个杀毒啊,呵呵,感觉NOD是多余的

mofunzone

一个，剩下两个绿色扫描器，无聊玩的

wangjay1980

红伞怎么什么病毒都报这个名字

mofunzone

家族类启发，你这些样本实际是一个病毒家族的变种，剩下还有很多，不过对于我来说，叫什么名字有什么关系，提示用户了就ok，总比屁都不出强

[ 本帖最后由 mofunzone 于 2007-5-21 17:01 编辑 ]

龙井茶

m版总是要比一比让大家看明白。

taihuxian

Virus: Trojan-PSW.Win32.OnLineGames.ui (9x)

Virus found while downloading Web content.

Address: bbs.kafan.cn

tracydk

原帖由 mofunzone 于 2007-5-22 08:52 发表
家族类启发，你这些样本实际是一个病毒家族的变种，剩下还有很多，不过对于我来说，叫什么名字有什么关系，提示用户了就ok，总比屁都不出强

不过红伞都是报一个名称的话也有点不好,不知道具体是什么毒