一包

beat2

REGKEY.hiv 这个不知道是什么，jotti上只有BD报了

BitDefender         Found Trojan.PWS.Onlinegames.AVH

foxhound

KIS7.0.0.119

已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.nn 文件: F:\10.zip/1630[1].exe
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.nn 文件: F:\10.zip/LYLOADER.EXE//PE_Patch//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.vb 文件: F:\10.zip/LYMANGR.DLL//UPack
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.nn 文件: F:\10.zip/MSDEG32.DLL//UPack
已删除: 病毒 Worm.Win32.Viking.lj 文件: F:\10.zip/RichDll.dll//Petite//PE_Patch
已隔离: 病毒 Trojan.Generic (变种) 文件: F:\10.zip/servet.exe//PE_Patch.UPX
已删除: 木马程序 Trojan-PSW.Win32.OnLineGames.es 文件: F:\10.zip/SVCHOST.EXE
已删除: 病毒 Worm.Win32.Viking.lm 文件: F:\10.zip/sys11.exe

报了8个~ 其中1个启发~

[ 本帖最后由 foxhound 于 2007-5-29 14:41 编辑 ]

moonsilver

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.XYOnline.pb   
病毒： Trojan.PSW.XYOnline.pb   
病毒： Trojan.PSW.XYOnline.pb   
病毒： Trojan.PSW.XYOnline.pb   
病毒： Worm.Viking.tc           
病毒： Worm.Viking.tc           

用户来源：互联网

软件版本：19.25.11

6个

红心王子

斧头KV砍掉了7个，比瑞星多一个

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\10.zip'
C:\Documents and Settings\morgan\My Documents\
  10.zip
    [0] Archive type: ZIP
    --> 1630[1].exe
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NN.71
        [WARNING]   Infected files in archives cannot be repaired!
    --> LYLOADER.EXE
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NN.71
        [WARNING]   Infected files in archives cannot be repaired!
    --> LYMANGR.DLL
        [DETECTION] Is the Trojan horse TR/Agent.nma.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> Ms06014[1].htm
        [DETECTION] Contains signature of the HTML script virus HTML/Dldr.Huti
        [WARNING]   Infected files in archives cannot be repaired!
    --> MSDEG32.DLL
        [DETECTION] Is the Trojan horse TR/PSW.OnLineGames.NN.71
        [WARNING]   Infected files in archives cannot be repaired!
    --> REGKEY.hiv
    --> RichDll.dll
        [DETECTION] Is the Trojan horse TR/PSW.Delf.AF.2
        [WARNING]   Infected files in archives cannot be repaired!
    --> servet.exe
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> SVCHOST.EXE
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
    --> sys11.exe
        [DETECTION] Is the Trojan horse TR/PSW.Delf.AF.2
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!


End of the scan: 2007年5月28日  23:43
Used time: 00:08 min

The scan has been done completely.

      0 Scanning directories
     11 Files were scanned
      9 viruses and/or unwanted programs were found
      1 classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
     10 Warnings
      0 Notes
      0 Hidden objects were found

扫描日志
NOD32版本 2293 (20070527) NT
命令行： C:\Documents and Settings\morgan\My Documents\10. ?
?zip
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 28.5.2007  时间：23:44:09
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\ ?
?morgan\My Documents\10.zip
C:\Documents and Settings\morgan\My Documents\10.zip  ?
?>>ZIP >>1630[1].exe - 可能是 Win32/PSW.Agent.NEC 木马  ?
?的一个变种
C:\Documents and Settings\morgan\My Documents\10.zip  ?
?>>ZIP >>LYLOADER.EXE - 可能是 Win32/PSW.Agent.NEC 木马  ?
?的一个变种
C:\Documents and Settings\morgan\My Documents\10.zip  ?
?>>ZIP >>LYMANGR.DLL - Win32/PSW.Agent.NEC 木马的变种
C:\Documents and Settings\morgan\My Documents\10.zip  ?
?>>ZIP >>Ms06014[1].htm - 是正常的
C:\Documents and Settings\morgan\My Documents\10.zip  ?
?>>ZIP >>MSDEG32.DLL - Win32/PSW.Agent.NEC 木马的变种
C:\Documents and Settings\morgan\My Documents\10.zip  ?
?>>ZIP >>REGKEY.hiv - 是正常的
C:\Documents and Settings\morgan\My Documents\10.zip  ?
?>>ZIP >>RichDll.dll - Win32/Viking.DA 病毒
C:\Documents and Settings\morgan\My Documents\10.zip  ?
?>>ZIP >>servet.exe - Win32/TrojanDownloader.Delf.BHO  ?
?木马的变种
C:\Documents and Settings\morgan\My Documents\10.zip  ?
?>>ZIP >>SVCHOST.EXE - Win32/PSW.WOW.NBZ 木马
C:\Documents and Settings\morgan\My Documents\10.zip  ?
?>>ZIP >>sys11.exe - Win32/Viking.DA 病毒
已扫描的文件数目：11
已发现的病毒数目：8
活动的病毒数目：1
完成时间： 23:44:11 总扫描时间：2 秒 (00:00:02)


[Scan path] C:\Documents and Settings\morgan\My Documents\10.zip
>>>C:\Documents and Settings\morgan\My Documents\10.zip\1630[1].exe is an adware program Adware.Casino.origin
>>C:\Documents and Settings\morgan\My Documents\10.zip\LYLOADER.EXE probably infected with MULDROP.Trojan
>>C:\Documents and Settings\morgan\My Documents\10.zip\LYMANGR.DLL - Ok
>C:\Documents and Settings\morgan\My Documents\10.zip\Ms06014[1].htm - Ok
>>C:\Documents and Settings\morgan\My Documents\10.zip\MSDEG32.DLL - Ok
>C:\Documents and Settings\morgan\My Documents\10.zip\REGKEY.hiv - Ok
>>C:\Documents and Settings\morgan\My Documents\10.zip\RichDll.dll infected with Win32.HLLW.Gavir.66
>C:\Documents and Settings\morgan\My Documents\10.zip\servet.exe infected with Win32.HLLW.Creater
>C:\Documents and Settings\morgan\My Documents\10.zip\SVCHOST.EXE infected with Trojan.PWS.Wsgame
>C:\Documents and Settings\morgan\My Documents\10.zip\sys11.exe infected with Win32.HLLW.Gavir.72
C:\Documents and Settings\morgan\My Documents\10.zip - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 12
Infected objects found: 4
Objects with modifications found: 0
Suspicious objects found: 1
Adware programs found: 1
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 173 Kb/s
Scan time: 00:00:01

aoyang

解压出来杀6个
再执行杀一个
7个

worker321

咖啡报六个

2007-5-29        15:09:34        未采取操作         C:\Documents and Settings\Administrator\桌面\10.zip\1630[1].EXE\00000c80.EXE        New Malware.aj(特洛伊)
2007-5-29        15:09:35        未采取操作         C:\Documents and Settings\Administrator\桌面\10.zip\LYLOADER.EXE        New Malware.aj(特洛伊)
2007-5-29        15:09:35        未采取操作         C:\Documents and Settings\Administrator\桌面\10.zip\LYMANGR.DLL\LYMANGR.DLL        Generic PWS.j(特洛伊)
2007-5-29        15:09:35        未采取操作         C:\Documents and Settings\Administrator\桌面\10.zip\MS06014[1].HTM        ObfuscatedHtml (ED)(特洛伊)
2007-5-29        15:09:35        未采取操作         C:\Documents and Settings\Administrator\桌面\10.zip\RICHDLL.DLL        W32/HLLP.Philis.dll(病毒)
2007-5-29        15:09:35        未采取操作         C:\Documents and Settings\Administrator\桌面\10.zip\SYS11.EXE        W32/HLLP.Philis.kl (ED)(病毒)

zzh161

PCC 7个

鼻耳盖子

木马名称:Trojan-PSW.Win32.Agent.cwp
程序:
I:\TEST\070529\21\10\LYLOADER.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-PSW.Win32.Agent.cwp
程序:
I:\TEST\070529\21\10\LYLOADER.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.Vikings.qd
程序:
I:\TEST\070529\21\10\RICHDLL.DLL
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
蠕虫名称:Worm.Win32.Vikings.d
程序:
I:\TEST\070529\21\10\SYS11.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

傻猪猪米走鸡

nod8个，没倒……