魔兽世界木马的网址

Anycall-D908

http://mszx49.cn/248.htm今天魔兽查资料就碰到这个了,名字还叫WOW.EXE呢....百分百就是魔兽木马了,还好NOD32拦住了,不然账号有死翘翘了

mofunzone

antivir直接XX网页，不发了就

peterpanone

http://mszx49.cn/248.htm
打开之后卡巴报警，网页含有木马、恶意脚本。

孤独更可靠

抓回来了``



网页3次加密:

Us-ascii\10进制\16进制加密

MS06-14漏洞下载:

http://www.ip568.cn/mm/wow.exe

打齐补丁的没事

:)


偌曼的回复:

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

&#26700 : INFECTED with W32/Suspicious_U.gen.dropper (Signature: W32/Suspicious_U.gen)


[ DetectionInfo ]
    * Sandbox name: W32/Suspicious_U.gen.dropper
    * Signature name: W32/Suspicious_U.gen
    * Compressed: YES

[ General information ]
    * **Locates window "ÈðÐÇ×¢²á±í¼à¿ØÌáʾ [class #32770]" on desktop.
    * **Locates window "IE Ö´Ðб£»¤ [class #32770]" on desktop.
    * **Locates window "ÈðÐÇ¿¨¿¨ÉÏÍø°²È«ÖúÊÖ - IE·À©ǽ [class #32770]" on desktop.
    * **Locates window "NULL [class AVP.AlertDialog]" on desktop.
    * **Locates window "NULL [class AVP.Product_Notification]" on desktop.
    * **Locates window "NULL [class AVP.TrafficMonConnectionTerm]" on desktop.

[ Changes to filesystem ]
    * Creates directory C:\Program Files\NetMeeting.
    * Creates file C:\Program Files\NetMeetingavpms.exe.
    * Creates file C:\Program Files\NetMeetingavpms.cfg.

[ Process/window information ]
    * Enumerates running processes.

[ Signature Scanning ]
    * C:\Program Files\NetMeetingavpms.exe (13872 bytes) : W32/Suspicious_U.gen.
    * C:\Program Files\NetMeetingavpms.cfg (144 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************



嗯,是盗魔兽的木马``

[:27:]

huaxiang954

Symantec Client Security 3.15的防火墙报：
检测到并禁止了针对您计算机的入侵企图“HTTP MSIE Generic Browser Exploit”。
入侵者: www.ip568.cn(222.84.225.79)(http(80))。
风险级别: 高。
协议: TCP。
攻击的 IP: localhost。
攻击的端口: pptp(1723)。
详细信息: 检测到并禁止了入侵。与 www.ip568.cn(222.84.225.79) 的所有通信将被禁止 2880 分钟。  
病毒没进来^_^
对于楼上提供的病毒样本，报警详情如图：

[ 本帖最后由 huaxiang954 于 2007-10-19 08:28 编辑 ]

wangjay1980

detected: virus Heur.Trojan.Generic        File: C:\Documents and Settings\Owner\×ÀÃæ\wow.rar/wow.exe//PE_Patch//UPack

mofunzone

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\wow.exe'
C:\TDDOWNLOAD\
  wow.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [WARNING]   The file was ignored!

solcroft

啊弥陀佛

微点砍掉

欠妳緈諨