挂马

显示全部楼层 · 发表于 2008-1-3 04:19:47

hxxp://www.czn.com.cn/exec/2007_11/5/200711513595.shtml

[ 本帖最后由 lanvin 于 2008-1-3 04:36 编辑 ]

显示全部楼层 · 发表于 2008-1-3 04:24:01

显示全部楼层 · 发表于 2008-1-3 12:56:21

ESET
2008-1-3 12:55:01 HTTP filter file http://999.dywoyk88.cn/hast.exe a variant of Win32/TrojanDownloader.Flux trojan connection terminated - quarantined CHINESE-GUNDAM\GUNDAM Threat was detected upon access to web by the application: C:\Program Files\Mozilla Firefox\firefox.exe.

另，ZA的spy site blocking 拦截此网址

显示全部楼层 · 发表于 2008-1-3 13:08:58

VBS
以前经常遇到的！！大蜘蛛没有杀到

显示全部楼层 · 发表于 2008-1-3 13:51:45

微点砍掉

显示全部楼层 · 发表于 2008-1-3 13:58:32

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\hast.exe'
C:\Documents and Settings\Administrator\桌面\hast.exe
[DETECTION] Is the Trojan horse TR/Autorun.CA
[INFO] The file was deleted!

显示全部楼层 · 发表于 2008-1-3 14:20:08

原帖由 lanvin 于 2008-1-3 04:24 发表
http://999.dywoyk88.cn/hast.exe
用FS解出一个

运行了下　先关我ＱＱ　　再改我时间　ＥＱ拦下　　然后没动静了

显示全部楼层 · 发表于 2008-1-3 14:31:08

Hello. This file is already detected. Please update your bases.

Please quote all when answering. Do not forget to include you registration data.
-----------------
Regards, Ermilov Maxim
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

> Attachment: hast.exe

莫名其妙　　根本报不了

显示全部楼层 · 发表于 2008-1-3 15:03:11

2008-1-3 15:03:05 1199343785 Administrator 4080 Sign of "Win32:AutoRun-IC" has been found in "C:\Documents and Settings\Administrator\桌面\hast.exe\[Upack]\[Embedded#05010]" file.

显示全部楼层 · 发表于 2008-1-3 15:10:51

D:\Downloads\样本\hast.exe - a variant of Win32/TrojanDownloader.Flux trojan

[已鉴定] 挂马