山西大学--太原高等工程专科学院挂马

显示全部楼层 · 发表于 2007-9-22 16:41:01

Begin scan in 'C:\Documents and Settings\dell\桌面\My Documents.rar'
C:\Documents and Settings\dell\桌面\My Documents.rar
  [0] Archive type: RAR
  --> Ms06014[1].html
   [DETECTION] Contains suspicious code HEUR/Exploit.HTML
  --> wyls[1].exe
   [DETECTION] Is the Trojan horse TR/Copiet.B.1
   [INFO]    The file was successfully wiped!
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-9-22 16:41:05

C:\ABC\My_Documents.rar:\Ms06014[1].html - 特征码 'Trojan-Downloader.JS.Psyme.kf' 被发现
C:\ABC\My_Documents.rar:\wyls[1].exe - 特征码 'Trojan-PWS.Win32.QQGame.ad' 被发现

显示全部楼层 · 发表于 2007-9-22 17:03:55

显示全部楼层 · 发表于 2007-9-22 17:10:02

detected: Trojan program Trojan-Downloader.JS.Psyme.kf URL: http://bbs.kafan.cn/attachment.php?aid=130713//Ms06014[1].html
detected: Trojan program Trojan-PSW.Win32.OnLineGames.cxo URL: http://bbs.kafan.cn/attachment.php?aid=130713//wyls[1].exe//UPX

显示全部楼层 · 发表于 2007-9-22 17:15:45

显示全部楼层 · 发表于 2007-9-22 17:22:32

D:\Documents and Settings\EKINCHENG\桌面\My Documents.rar » RAR » wyls[1].exe - probably a variant of Win32/Genetik trojan
D:\Documents and Settings\EKINCHENG\桌面\My Documents.rar - probably a variant of Win32/Genetik trojan - deleted - quarantined

显示全部楼层 · 发表于 2007-9-22 17:47:23

显示全部楼层 · 发表于 2007-9-22 17:48:11

Virus infection found

File which you are trying download contains virus. Loading has been interrupted.
Technical data:
Error name: Virus Alert
Virus description Generic.PWStealer.A9C9214A
Error code: -1602
Requested URL: /attachment.php?aid=130713
Requested HTTP method: GET
Requested ContentType: application/octet-stream
Requested IP: 211.136.18.143

显示全部楼层 · 发表于 2007-9-22 20:30:08

已删除：木马程序 Trojan-Downloader.JS.Psyme.kf 文件　: G:\9.22\My_Documents1.rar/Ms06014[1].html
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.cxo 文件　: G:\9.22\My_Documents1.rar/wyls[1].exe//UPX

[病毒样本] 山西大学--太原高等工程专科学院挂马

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源