同花顺网站被挂马

显示全部楼层 · 发表于 2008-2-9 09:57:11

http://www.10jqka.com.cn
傲游打开后小红伞不断报警直至资源耗尽……
firefox打开后小红伞无报警，一样资源耗尽……

显示全部楼层 · 发表于 2008-2-9 10:01:03

hxxp://ppp.buyaoni.com/dm/diao.htm
hxxp://ppp.buyaoni.com/dm/rl.htm
hxxp://ppp.buyaoni.com/dm/rr.htm

[ 本帖最后由 Graybird 于 2008-2-9 10:02 编辑 ]

显示全部楼层 · 发表于 2008-2-9 11:22:50

原帖由 最期之诗 于 2008-2-9 09:57 发表
firefox打开后小红伞无报警，一样资源耗尽……

因为你没有用 noscript ...

显示全部楼层 · 发表于 2008-2-9 12:35:15

看来又是老毒物

Log is generated by FreShow.
http://www.10jqka.com.cn
http://image.10jqka.com.cn/adv/html/homepage.1.html
      http://ppp.buyaoni.com/ww/new301.htm?024
         http://ppp.buyaoni.com/dm/diao.htm
               http://dd.749571.com/bb/bd.cab
         http://ppp.buyaoni.com/dm/11.js
               http://dd.749571.com/bb/014.exe
         http://ppp.buyaoni.com/dm/rl.htm
               http://dd.749571.com/bb/newrl.exe
         http://ppp.buyaoni.com/dm/rr.htm
               http://is.749571.com/bb/a.exe(失效）

[ 本帖最后由 tanlimo 于 2008-2-9 12:48 编辑 ]

显示全部楼层 · 发表于 2008-2-9 12:42:09

Starting the file scan:

Begin scan in 'E:\bd.cab'
E:\bd.cab
  [0] Archive type: CAB (Microsoft)
  --> bd.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was deleted!
Begin scan in 'E:\014.exe'
E:\014.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was deleted!
Begin scan in 'E:\newrl.exe'
E:\newrl.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-2-9 12:45:31

FS 全杀

显示全部楼层 · 发表于 2008-2-9 13:15:44

AVAST all pass

显示全部楼层 · 发表于 2008-2-9 14:01:49

IK
I:\virus\123.rar:\bd.cab\bd.exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found
I:\virus\123.rar:\bd.cab
I:\virus\123.rar:\newrl.exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found
I:\virus\123.rar:\014.exe - Signature 'Trojan-Downloader.Win32.Zlob.and' found
I:\virus\123.rar

5 Files scanned
(1 Archiv with 4 files)
3 Signatures found
0 Suspect code-parts found
Used time: 0:00.031

显示全部楼层 · 发表于 2008-2-9 14:31:34

F:\virus\123.rar » RAR » bd.cab » CAB » bd.exe - a variant of Win32/TrojanDownloader.Agent.IAJ trojan
F:\virus\123.rar » RAR » newrl.exe - a variant of Win32/TrojanDownloader.Agent.IAJ trojan
F:\virus\123.rar » RAR » 014.exe - a variant of Win32/TrojanDownloader.Agent.IAJ trojan

显示全部楼层 · 发表于 2008-2-9 14:45:43

Opera冲进去没事

[已鉴定] 同花顺网站被挂马

回复 4楼 tanlimo 的帖子

回复 4楼 tanlimo 的帖子