1打exe.rar

qqq000@qq.com

1打exe.rar

qqq000@qq.com

28个
飘飘飘

红心王子

卡吧7报了19个
费尔报了5个，还有一个识别出了壳程序
虽然说报的少了点，但是识别的质量还是不错的

Giggs

Kaspersky Anti-Virus 7.0

The requested URL http://bbs.kafan.cn/attachment.php?aid=74652 is infected with Trojan-PSW.Win32.OnLineGames.tz virus

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\1打exe.rar'
C:\Documents and Settings\morgan\My Documents\
  1打exe.rar
    [0] Archive type: RAR
    --> upxdnd.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.TZ.58
        [WARNING]   Infected files in archives cannot be repaired!
    --> alg32.dat
        [DETECTION] Contains suspicious code HEUR/Crypted
        [WARNING]   Infected files in archives cannot be repaired!
    --> Winhttps.dat
    --> bind_50446.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> draepl_dll
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.TZ.55
        [WARNING]   Infected files in archives cannot be repaired!
    --> F9A57E80_DLL
        [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.ahj.373 Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
    --> fmmtmj_dll
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.2499
        [WARNING]   Infected files in archives cannot be repaired!
    --> (1)cmdbcs.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> (1)mydata.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.UF.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> [1](1)cmdbcs.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> [1](1)mydata.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> [1]cmdbcs.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> [1]mydata.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> [1]upxdnd.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> [2](1)cmdbcs.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> [2](1)mydata.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.AUC
        [WARNING]   Infected files in archives cannot be repaired!
    --> [2]cmdbcs.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> [2]mydata.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.AUC
        [WARNING]   Infected files in archives cannot be repaired!
    --> [2]upxdnd.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.TZ.55
        [WARNING]   Infected files in archives cannot be repaired!
    --> cmdbcs.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> crasos.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> iexp10re.exe
        [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> jnavavm.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.ES.2503
        [WARNING]   Infected files in archives cannot be repaired!
    --> mydata.exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.UF.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> qjso.exe
        [DETECTION] Is the Trojan horse TR/PSW.Small.CF.27
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年5月22日  23:22
Used time: 00:12 min

The scan has been done completely.

      0 Scanning directories
     26 Files were scanned
     24 viruses and/or unwanted programs were found
     11 classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     -9 Files not concerned
      1 Archives were scanned
     25 Warnings
      0 Notes
      0 Hidden objects were found

扫描日志
NOD32版本 2285 (20070522) NT
命令行： C:\Documents and Settings\morgan\My Documents\ ?
?1打exe.rar
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 22.5.2007  时间：23:23:46
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\ ?
?morgan\My Documents\1打exe.rar
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>upxdnd.exe - 未查明的 NewHeur_PE 病毒 [7]
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>alg32.dat >>FSG v2.0 - 是正常的
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>Winhttps.dat - 是正常的
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>bind_50446.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>draepl_dll - 是正常的
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>F9A57E80_DLL - Win32/Agent.NEO 木马的变种
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>fmmtmj_dll - 是正常的
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>(1)cmdbcs.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>(1)mydata.exe - Win32/PSW.Agent.NEW 木马的变种
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>[1](1)cmdbcs.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>[1](1)mydata.exe - Win32/PSW.Agent.NEW 木马的变种
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>[1]cmdbcs.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>[1]mydata.exe - Win32/PSW.Agent.NEW 木马的变种
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>[1]upxdnd.exe - 未查明的 NewHeur_PE 病毒 [7]
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>[2](1)cmdbcs.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>[2](1)mydata.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>[2]cmdbcs.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>[2]mydata.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>[2]upxdnd.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>cmdbcs.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>crasos.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>iexp10re.exe - 是正常的
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>jnavavm.exe - 未查明的 NewHeur_PE 病毒 [7]
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>mydata.exe - Win32/PSW.Agent.NEW 木马的变种
C:\Documents and Settings\morgan\My Documents\1打exe.rar  ?
?>>RAR >>qjso.exe - Win32/PSW.Agent.NEA 木马
已扫描的文件数目：26
已发现的病毒数目：9
活动的病毒数目：1
完成时间： 23:23:50 总扫描时间：4 秒 (00:00:04)
注意：
[7] 该文件可能感染上未知病毒。


[Scan path] C:\Documents and Settings\morgan\My Documents\1打exe.rar
>>C:\Documents and Settings\morgan\My Documents\1打exe.rar\upxdnd.exe infected with Trojan.PWS.Wsgame.origin
>>>C:\Documents and Settings\morgan\My Documents\1打exe.rar\alg32.dat - Ok
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\Winhttps.dat - Ok
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\bind_50446.exe - Ok
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\draepl_dll - Ok
>>C:\Documents and Settings\morgan\My Documents\1打exe.rar\F9A57E80_DLL - Ok
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\fmmtmj_dll - Ok
>>C:\Documents and Settings\morgan\My Documents\1打exe.rar\(1)cmdbcs.exe probably infected with MULDROP.Trojan
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\(1)mydata.exe infected with Trojan.PWS.Soul
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\[1](1)cmdbcs.exe probably infected with MULDROP.Trojan
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\[1](1)mydata.exe infected with Trojan.PWS.Soul
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\[1]cmdbcs.exe probably infected with MULDROP.Trojan
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\[1]mydata.exe infected with Trojan.PWS.Soul
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\[1]upxdnd.exe infected with Trojan.PWS.Wsgame.origin
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\[2](1)cmdbcs.exe - Ok
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\[2](1)mydata.exe - Ok
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\[2]cmdbcs.exe - Ok
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\[2]mydata.exe - Ok
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\[2]upxdnd.exe - Ok
>>C:\Documents and Settings\morgan\My Documents\1打exe.rar\cmdbcs.exe probably infected with MULDROP.Trojan
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\crasos.exe - Ok
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\iexp10re.exe - Ok
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\jnavavm.exe infected with Trojan.PWS.Wsgame.origin
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\mydata.exe infected with Trojan.PWS.Soul
>C:\Documents and Settings\morgan\My Documents\1打exe.rar\qjso.exe infected with Trojan.PWS.Wsgame
C:\Documents and Settings\morgan\My Documents\1打exe.rar - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 27
Infected objects found: 8
Objects with modifications found: 0
Suspicious objects found: 4
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 132 Kb/s
Scan time: 00:00:04

Giggs

End of the scan: 2007年5月23日  14:25
Used time: 00:07 min

The scan has been done completely.

      0 Scanning directories
     27 Files were scanned
    24viruses and/or unwanted programs were found
      3 classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     19 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

[ 本帖最后由 wangshuyu2001 于 2007-5-23 14:26 编辑 ]

kp2006

在 D:\Documents and Settings\Administrator\桌面\1打exe.rar->F9A57E80_DLL 中发现 Trojan/Agent.igc 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\1打exe.rar->fmmtmj_dll 中发现 Trojan/PSW.OnLineGames.bkb 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\1打exe.rar->iexp10re.exe 中发现 Trojan/PSW.GamePass.jxx 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\1打exe.rar->jnavavm.exe 中发现 Trojan/PSW.OnLineGames.bka 病毒, 已删除
在 D:\Documents and Settings\Administrator\桌面\1打exe.rar->qjso.exe 中发现 TrojanDownloader.Agent.iuz 病毒, 已删除

seamonkey

KV：11个
江民杀毒软件报告文件

        北京江民新科技术有限公司

        扫描引擎 10.00.600
        病毒库日期 2007-05-23
        更新日期 2007-05-23

扫描目标 D:\1打exe.rar

开始时间 2007-05-23 16:05:10

在 D:\1打exe.rar->upxdnd.exe 中发现 Trojan/PSW.OnLineGames.bmo 病毒, 已删除
在 D:\1打exe.rar->alg32.dat 中发现 Trojan/PSW.GamePass.jzm 病毒, 已删除
在 D:\1打exe.rar->draepl_dll 中发现 Trojan/PSW.OnLineGames.bmp 病毒, 已删除
在 D:\1打exe.rar->F9A57E80_DLL 中发现 Trojan/Agent.igc 病毒, 已删除
在 D:\1打exe.rar->fmmtmj_dll 中发现 Trojan/PSW.OnLineGames.bkb 病毒, 已删除
在 D:\1打exe.rar->[1]upxdnd.exe 中发现 Trojan/PSW.OnLineGames.bmo 病毒, 已删除
在 D:\1打exe.rar->[2]upxdnd.exe 中发现 Trojan/PSW.OnLineGames.bmp 病毒, 已删除
在 D:\1打exe.rar->crasos.exe 中发现 Trojan/PSW.GamePass.kcc 病毒, 已删除
在 D:\1打exe.rar->iexp10re.exe 中发现 Trojan/PSW.GamePass.jxx 病毒, 已删除
在 D:\1打exe.rar->jnavavm.exe 中发现 Trojan/PSW.OnLineGames.bka 病毒, 已删除
在 D:\1打exe.rar->qjso.exe 中发现 TrojanDownloader.Agent.iuz 病毒, 已删除
正常结束。

扫描结果:
                 文件数 :489                                 病毒体 :11        
                   删除 :11                                    解毒 :0

moonsilver

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.OnlineGames.brp
病毒： Trojan.PSW.LMir.mlo      
病毒： Trojan.PSW.LMir.mlo      
病毒： Trojan.PSW.OnlineGames.brp
病毒： Trojan.DL.Mnless.aeh     
病毒： Trojan.PSW.OnlineGames.boi
病毒： Trojan.PSW.CabalOnline.aie
病毒： Trojan.PSW.RocOnline.bcv
病毒： Trojan.PSW.OnlineGames.brs
病毒： Trojan.PSW.CabalOnline.aie
病毒： Trojan.PSW.RocOnline.bcv
病毒： Packer.Mian007           
病毒： Trojan.PSW.CabalOnline.aia
病毒： Trojan.PSW.WLOnline.jed  

用户来源：互联网

软件版本：19.24.22

杀了24个

鼻耳盖子

有10来个在我这跑不起来，郁闷
木马名称:Trojan-PSW.Win32.OnLineGames.dmr
程序:
I:\TEST\070523\5\1打EXE\UPXDND.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.Agent.asc
程序:
I:\TEST\070523\5\1打EXE\F9A57E80_DLL
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.OnLineGames.dkq
程序:
I:\TEST\070523\5\1打EXE\JNAVAVM.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.Small.dk
程序:
I:\TEST\070523\5\1打EXE\QJSO.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?