一论坛被挂木马

yashoo

http://www.cd120.com/phpwind/

Whkroran

登录界面，，，卡巴不报，，

小邪邪

咖啡杀了一个ANI

ay24

马被杀死了

小邪邪

这也杀得太绝了点吧？

我的是：
监控在后台静静的杀毒（无警报，无窗口，有记录）
我在前台如常的浏览着网页



[ 本帖最后由 小邪邪 于 2007-6-24 01:08 编辑 ]

dikex

问题出在http://www.cd120.com/phpwind/image/global.js这个js文件里面，被加入了挂马代码，指向于http://count12.5lyes.cn/index.htm，里面一个指向http://count12.5lyes.cn/okt.exe的MS07-017，一个指向http://count12.5lyes.cn/test/ad.exe的MS06-014，两个为同一文件

1688388728

病毒: CVE-2007-0038
檔案: my[1].c
目錄: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\XAG0GEON
處理序: GreenBrowser.exe

mofunzone

File:           ad.rar
Status:        
INFECTED/MALWARE
MD5:         2bfeae5d36694cba03e8617dff34cc69
Packers detected:        
NSPACK
Bit9 reports:         File not found
Scanner results
Scan taken on 23 Jun 2007 17:44:14 (GMT)
A-Squared        
Found nothing
AntiVir        
Found TR/Crypt.NSPI.Gen
ArcaVir        
Found nothing
Avast        
Found nothing
AVG Antivirus        
Found nothing
BitDefender        
Found Dropped:Generic.Malware.Fdld.3FC4C81A (probable variant)
ClamAV        
Found Trojan.Downloader-689
Dr.Web        
Found nothing
F-Prot Antivirus        
Found Possibly a new variant of W32/PWStealer1!Generic
F-Secure Anti-Virus        
Found nothing
Fortinet        
Found nothing
Kaspersky Anti-Virus        
Found nothing
NOD32        
Found a variant of Win32/TrojanDownloader.Delf.BCC
Norman Virus Control        
Found nothing
Panda Antivirus        
Found Trj/Downloader.LWC
Rising Antivirus        
Found nothing
VirusBuster        
Found Packed/NSPack
VBA32        
Found nothing

ay24

原帖由 dikex 于 2007-6-24 01:17 发表
问题出在http://www.cd120.com/phpwind/image/global.js这个js文件里面，被加入了挂马代码，指向于http://count12.5lyes.cn/index.htm，里面一个指向http://count12.5lyes.cn/okt.exe的MS07-017，一个指向http: ...

两个下载回来都干掉了。最后两个是样本

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\okt.rar'
C:\Documents and Settings\Administrator\My Documents\
  okt.rar
    [0] Archive type: RAR
    --> okt.exe
        [DETECTION] Is the Trojan horse TR/Crypt.NSPI.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!