Virus.Win32.AutoRun.p所下载的病毒已全部更新！（附样本）

dikex

原帖由 风野胤 于 2007-5-22 20:35 发表

我上报给nod长期用的都是这个密码
除了有时连带着上报给费尔  密码会用virus
刺猬上报给哪家的？

一般上报到卡巴总部

aoyang

费尔扫描没反应，运行后一个不留全杀了。

wangjay1980

Hello,

conime.exe_, copypfh.exe_, csrss.exe_, ctfmon.exe_, IEXPLORE.exe_, mmc.exe_, services.exe_, smss.exe_, spglsdr.exe_, srogm.exe_, stpgldk.exe_, svchost(1).exe_, svchost32.exe_ - Trojan-PSW.Win32.OnLineGames.um

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Alexander Romanenko
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: 2007-05-22-1.zip

The EQs

的确在报壳。。。。鉴定完毕

shmily512099

呵呵  微点完全解决。。。。

yzt1004

晕
昨天的刚给AVG AntiSpyware7.5，今天升级可以杀了，现在又得上报
倒霉

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\2007-05-22-1'
C:\Documents and Settings\morgan\My Documents\2007-05-22-1\
  conime.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!
  copypfh.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!
  csrss.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!
  ctfmon.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!
  IEXPLORE.EXE
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!
  mmc.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!
  services.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!
  smss.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!
  spglsdr.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!
  srogm.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!
  stpgldk.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!
  svchost(1).exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!
  svchost.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!
  svchost32.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年5月22日  08:10
Used time: 00:09 min

The scan has been done completely.

      1 Scanning directories
     14 Files were scanned
     14 viruses and/or unwanted programs were found
      0 classified as suspicious:
     14 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      0 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

mofunzone

扫描日志
NOD32版本 2279 (20070521) NT
命令行： C:\Documents and Settings\morgan\My Documents\ ?
?2007-05-22-1
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 22.5.2007  时间：08:14:41
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\ ?
?morgan\My Documents\2007-05-22-1\
C:\Documents and Settings\morgan\My Documents\ ?
?2007-05-22-1\conime.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\ ?
?2007-05-22-1\copypfh.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\ ?
?2007-05-22-1\csrss.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\ ?
?2007-05-22-1\ctfmon.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\ ?
?2007-05-22-1\IEXPLORE.EXE - 是正常的
C:\Documents and Settings\morgan\My Documents\ ?
?2007-05-22-1\mmc.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\ ?
?2007-05-22-1\services.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\ ?
?2007-05-22-1\smss.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\ ?
?2007-05-22-1\spglsdr.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\ ?
?2007-05-22-1\srogm.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\ ?
?2007-05-22-1\stpgldk.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\ ?
?2007-05-22-1\svchost(1).exe - 是正常的
C:\Documents and Settings\morgan\My Documents\ ?
?2007-05-22-1\svchost.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\ ?
?2007-05-22-1\svchost32.exe - 是正常的
已扫描的文件数目：14
已发现的病毒数目：0
完成时间： 08:14:43 总扫描时间：2 秒 (00:00:02)

mofunzone

[Scan path] C:\Documents and Settings\morgan\My Documents\2007-05-22-1
C:\Documents and Settings\morgan\My Documents\2007-05-22-1\conime.exe - Ok
C:\Documents and Settings\morgan\My Documents\2007-05-22-1\copypfh.exe - Ok
C:\Documents and Settings\morgan\My Documents\2007-05-22-1\csrss.exe - Ok
C:\Documents and Settings\morgan\My Documents\2007-05-22-1\ctfmon.exe - Ok
C:\Documents and Settings\morgan\My Documents\2007-05-22-1\IEXPLORE.EXE - Ok
C:\Documents and Settings\morgan\My Documents\2007-05-22-1\mmc.exe - Ok
C:\Documents and Settings\morgan\My Documents\2007-05-22-1\services.exe - Ok
C:\Documents and Settings\morgan\My Documents\2007-05-22-1\smss.exe - Ok
C:\Documents and Settings\morgan\My Documents\2007-05-22-1\spglsdr.exe - Ok
C:\Documents and Settings\morgan\My Documents\2007-05-22-1\srogm.exe - Ok
C:\Documents and Settings\morgan\My Documents\2007-05-22-1\stpgldk.exe - Ok
C:\Documents and Settings\morgan\My Documents\2007-05-22-1\svchost(1).exe - Ok
C:\Documents and Settings\morgan\My Documents\2007-05-22-1\svchost.exe - Ok
C:\Documents and Settings\morgan\My Documents\2007-05-22-1\svchost32.exe - Ok

wangjay1980

deleted: Trojan program Trojan-PSW.Win32.OnLineGames.um        File: C:\Documents and Settings\Owner\×ÀÃæ\2007-05-22-1.zip/spglsdr.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.um        File: C:\Documents and Settings\Owner\×ÀÃæ\2007-05-22-1.zip/csrss.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.um        File: C:\Documents and Settings\Owner\×ÀÃæ\2007-05-22-1.zip/IEXPLORE.EXE
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.um        File: C:\Documents and Settings\Owner\×ÀÃæ\2007-05-22-1.zip/mmc.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.um        File: C:\Documents and Settings\Owner\×ÀÃæ\2007-05-22-1.zip/smss.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.um        File: C:\Documents and Settings\Owner\×ÀÃæ\2007-05-22-1.zip/srogm.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.um        File: C:\Documents and Settings\Owner\×ÀÃæ\2007-05-22-1.zip/stpgldk.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.um        File: C:\Documents and Settings\Owner\×ÀÃæ\2007-05-22-1.zip/svchost32.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.um        File: C:\Documents and Settings\Owner\×ÀÃæ\2007-05-22-1.zip/ctfmon.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.um        File: C:\Documents and Settings\Owner\×ÀÃæ\2007-05-22-1.zip/copypfh.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.um        File: C:\Documents and Settings\Owner\×ÀÃæ\2007-05-22-1.zip/svchost(1).exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.um        File: C:\Documents and Settings\Owner\×ÀÃæ\2007-05-22-1.zip/conime.exe
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.um        File: C:\Documents and Settings\Owner\×ÀÃæ\2007-05-22-1.zip/services.exe