动物家园被挂马

显示全部楼层 · 发表于 2007-9-20 23:39:24

[MD5: 105A0A]声讨挂马者

[ 本帖最后由 wulm 于 2007-9-20 23:44 编辑 ]

显示全部楼层 · 发表于 2007-9-20 23:54:06

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL: bbs.kafan.cn/attachment.php?aid=130160
Information: Contains suspicious code HEUR/Malware

--------------------------------------------------------------------------------
Generated by AntiVir WebGuard 7.01.00.11, AVE 7.6.0.15, VDF 6.39.1.152

显示全部楼层 · 发表于 2007-9-20 23:55:01

显示全部楼层 · 发表于 2007-9-21 01:22:16

Scan performed at: 2007-9-21 1:21:50
Scanning Log
NOD32 version 2541 (20070920) NT
Command line: C:\Documents and Settings\Don johnson\桌面\样本.rar
Operating memory - is OK

Date: 21.9.2007 Time: 01:21:56
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Don johnson\桌面\样本.rar
C:\Documents and Settings\Don johnson\桌面\样本.rar ?RAR ?player.exe - a variant of Win32/PSW.Delf.NIY trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 01:21:56 Total scanning time: 0 sec (00:00:00)

显示全部楼层 · 发表于 2007-9-21 02:39:21

2007-09-21 02:38:00 创建文件操作:阻止
进程路径:D:\病毒库\样本\player.exe
文件路径:C:\WINDOWS\system32\player.exe
触发规则:所有程序规则->文件规则->%systemdrive%\*.exe

显示全部楼层 · 发表于 2007-9-21 08:13:44

Begin scan in 'F:\bingdu\样本.rar'
F:\bingdu\样本.rar
  [0] Archive type: RAR
  --> player.exe
   [DETECTION] Is the Trojan horse TR/PSW.Delf.acb
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-9-21 08:23:38

http://www.kingzoo.com/bbs/index.php

??

这个吗??

显示全部楼层 · 发表于 2007-9-21 08:59:45

deleted: Trojan program Trojan-Dropper.Win32.VB.rv File: C:\Documents and Settings\Owner\×ÀÃæ\play.zip/player.exe//NSPack

显示全部楼层 · 发表于 2007-9-21 09:04:58

http://www.kingzoo.com/bbs/viewt ... a=page%3D1#pid46865

管理员做解释了

并未被挂马

显示全部楼层 · 发表于 2007-9-21 13:59:39

微点干掉

[病毒样本] 动物家园被挂马

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块