内蒙古自治区环境保护局被挂大量木马

绅博周幸

http://www.nmhbj.com/


RT, 红伞进去点到手酸, 提取了部分样本( 还没提完IE就崩溃了), 不怕死的就进去吧, 估计一般杀软很难挡住全部的.

jimmyleo

这个网址 貌似很熟悉~

绅博周幸

Starting the file scan:

Begin scan in 'E:\Documents and Settings\fuming1\My Documents\My Documents.rar'
E:\Documents and Settings\fuming1\My Documents\My Documents.rar
  [0] Archive type: RAR
  --> new82[1].htm
      [DETECTION] Contains suspicious code HEUR/Exploit.HTML
  --> 74[1].htm
      [DETECTION] Contains detection pattern of the Java script virus JS/Dldr.Agent.NV
  --> 9038[1].htm
      [DETECTION] Contains suspicious code HEUR/Exploit.HTML
  --> dd.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> dd[1].exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> du[1].htm
      [DETECTION] Contains detection pattern of the Java script virus JS/Dldr.Small.BD
  --> 06014.htm
      [DETECTION] Contains detection pattern of the VBS script virus VBS/Psyme.CZ
      [INFO]      The file was deleted!


End of the scan: 2007年9月14日  23:46
Used time: 00:08 min

The scan has been done completely.

      0 Scanning directories
      8 Files were scanned
      5 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

风野胤

依然毫无感觉地进出
大家换opera吧。。。。。

siman.yu

去转了一圈，没事啊!！莫非给周总全抓啦？！

wangjay1980

detected: Trojan program Trojan-Downloader.JS.Agent.nv        File: C:\Documents and Settings\Owner\×ÀÃæ\My Documents.rar/74[1].htm
detected: Trojan program Trojan-Downloader.Win32.Baser.o        File: C:\Documents and Settings\Owner\×ÀÃæ\My Documents.rar/dd.exe
detected: Trojan program Trojan-Downloader.Win32.Baser.o        File: C:\Documents and Settings\Owner\×ÀÃæ\My Documents.rar/dd[1].exe

残缺的唯美

Scan performed at: 2007-9-15 15:16:28
Scanning Log
NOD32 version 2531 (20070915) NT
Command line: D:\Documents and Settings\EKINCHENG\桌面\My Documents.rar

Date: 15.9.2007  Time: 15:16:31
Anti-Stealth technology is enabled.
Scanned disks, folders and files: D:\Documents and Settings\EKINCHENG\桌面\My Documents.rar
D:\Documents and Settings\EKINCHENG\桌面\My Documents.rar ?RAR ?dd.exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\My Documents.rar ?RAR ?dd[1].exe - probably a variant of Win32/Genetik trojan
Number of scanned files: 8
Number of threats found: 2
Number of files cleaned: 1
Time of completion: 15:16:31 Total scanning time: 0 sec (00:00:00)

ashe_vaan

卡6进去叫了2次

红心王子

2007-9-15        16:08:19        1189843699        Administrator        3264        Sign of "Win32:Delf-FVX [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\My_Documents.rar\dd.exe" file.  
2007-9-15        16:08:24        1189843704        Administrator        3264        Sign of "Win32:Delf-FVX [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\My_Documents.rar\dd[1].exe" file.

wcaonima007