随便瞎输就碰见毒网了

显示全部楼层 · 发表于 2008-2-11 02:00:15

http://20080209.service-google.cn/lz3.css
这只貌似是新的，以前未见过

Begin scan in 'D:\病毒样本\lz3.css'
D:\病毒样本\
  lz3.css
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [WARNING] The file was ignored!

显示全部楼层 · 发表于 2008-2-11 02:01:53

原来还是旧的

显示全部楼层 · 发表于 2008-2-11 02:08:19

Log is generated by FreShow.
[wide]http://www.psp123.com
[frame]http://keeppure.cn/wm/sj.htm?king
      [frame]http://keeppure.cn/tool/noani.htm
         [frame]http://keeppure.cn/tool/1.html
            [frame]http://niu.xinniankl.com/web/rl.htm
               [object]http://exe.xinniankl.com/rl.exe
            [frame]http://keeppure.cn/tool/htm.html
            [script]http://js.users.51.la/1153797.js
         [frame]http://keeppure.cn/tool/2.html
            [object]http://keeppure.cn/tool/xy.exe
         [frame]http://keeppure.cn/tool/3.html
            [object]http://keeppure.cn/tool/xy.exe
         [frame]http://keeppure.cn/tool/4.html
            [object]http://keeppure.cn/tool/xy.exe
         [frame]http://keeppure.cn/tool/5.html
            [object]http://keeppure.cn/tool/xy.exe
         [frame]http://keeppure.cn/tool/6.html
            [object]http://keeppure.cn/tool/baidu.cab
      [frame]http://niu.xinniankl.com/web/669191.htm
         [script]http://niu.xinniankl.com/web/1.js
            [object]http://exe.xinniankl.com/014.exe
         [script]http://niu.xinniankl.com/web/bf.js
            [object]http://exe.xinniankl.com/bf.exe
         [script]http://niu.xinniankl.com/web/pps.js
            [object]http://exe.xinniankl.com/pps.exe
         [frame]http://niu.xinniankl.com/web/3.htm
            [object]http://exe.xinniankl.com/lz.exe
         [frame]http://niu.xinniankl.com/web/htm.html
            [frame]http://niu.xinniankl.com/web/rl.htm
                  [object]http://exe.xinniankl.com/rl.exe
      [frame]http://08675.service-google.cn/vip/Cn3100.htm
         [frame]http://08675.service-google.cn/vip/wm2/z.html
            [frame]http://08675.service-google.cn/vip/wm2/2.gif
                  [object]http://20080203.service-google.cn/614.exe
            [frame]http://08675.service-google.cn/vip/wm2/1.gif
                  [object]http://20080203.service-google.cn/bf.exe
            [frame]http://08675.service-google.cn/vip/wm2/5.gif
                  [object]http://20080203.service-google.cn/pps.exe
            [frame]http://08675.service-google.cn/vip/wm2/12.gif
                  [object]http://20080209.service-google.cn/lz3.css
            [frame]http://08675.service-google.cn/vip/wm2/11.gif
                  [object]http://20080203.service-google.cn/lz3.exe
            [frame]http://08675.service-google.cn/vip/wm2/4.gif
                  [object]http://20080203.service-google.cn/baidu.cab
            [frame]http://08675.service-google.cn/vip/wm2/3.gif
                  [object]http://20080203.service-google.cn/qvod.exe
      [frame]http://iii.wzxyq.com/root/45daima.htm?468-1
         [frame]http://iii.wzxyq.com/root/14.htm
            [object]http://mm.sqmnoopt.com/mm/mm.exe
         [script]http://iii.wzxyq.com/root/real.js
            [object]http://mm.sqmnoopt.com/mm/mm.exe
         [script]http://iii.wzxyq.com/root/baidu.js
            [frame]http://iii.wzxyq.com/root/lz.htm
                  [object]http://mm.sqmnoopt.com/mm/mm.exe
      [frame]http://ppp.buyaoni.com/ww/new05.htm?075
         [frame]http://ppp.buyaoni.com/dm/diao.htm
            [object]http://dd.749571.com/bb/bd.cab
            [script]http://ppp.buyaoni.com/dm/11.js
                  [object]http://dd.749571.com/bb/014.exe
            [script]http://ppp.buyaoni.com/dm/bb.js
                  [object]http://dd.749571.com/bb/bb.exe
            [script]http://ppp.buyaoni.com/dm/pp.js
                  [object]http://dd.749571.com/bb/pp.exe
         [frame]http://ppp.buyaoni.com/dm/rl.htm
            [object]http://dd.749571.com/bb/newrl.exe
         [frame]http://ppp.buyaoni.com/dm/rr.htm
            [object]http://is.749571.com/bb/a.exe (假）
            [object]http://dd.749571.com/bb/newrl.exe
      [frame]http://xxx.haoqq1680.com/lccc001.htm?6
         [frame]http://xxx.haoqq1680.com/*
         [script]http://xxx.haoqq1680.com/Ajax.gif
            [object]http://xxx.haoqq1680.com/dod.exe
         [frame]http://xxx.haoqq1680.com/Ms06014.htm
            [object]http://xxx.haoqq1680.com/dod.exe
         [script]http://xxx.haoqq1680.com/Real.js
            [object]http://xxx.haoqq1680.com/dod.exe
         [script]http://xxx.haoqq1680.com/Bfyy.gif
            [object]http://xxx.haoqq1680.com/dod.exe
         [script]http://xxx.haoqq1680.com/Pps.gif
            [object]http://xxx.haoqq1680.com/dod.exe
         [script]http://xxx.haoqq1680.com/XunLei.gif
            [object]http://xxx.haoqq1680.com/dod.exe
         [script]http://xxx.haoqq1680.com/Lz.gif
            [object]http://xxx.haoqq1680.com/dod.exe
         [frame]http://xxx.haoqq1680.com/QVod.html
            [object]http://xxx.haoqq1680.com/dod.exe

楼上的比我快

[ 本帖最后由 tanlimo 于 2008-2-11 02:22 编辑 ]

显示全部楼层 · 发表于 2008-2-11 06:36:33

Starting the file scan:

Begin scan in 'E:\virus\xy.exe'
E:\virus\xy.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\baidu.cab'
E:\virus\baidu.cab
  [0] Archive type: CAB (Microsoft)
  --> xy.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\rl.exe'
E:\virus\rl.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.YM
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\614.exe'
E:\virus\614.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\bf.exe'
E:\virus\bf.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\pps.exe'
E:\virus\pps.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\lz3.css'
E:\virus\lz3.css
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\real2.exe'
E:\virus\real2.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\lz3.exe'
E:\virus\lz3.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\qvod.exe'
E:\virus\qvod.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\mm.exe'
E:\virus\mm.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.ibm.1
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\bd.cab'
E:\virus\bd.cab
  [0] Archive type: CAB (Microsoft)
  --> bd.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\bb.exe'
E:\virus\bb.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\pp.exe'
E:\virus\pp.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\newrl.exe'
E:\virus\newrl.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\newgl.exe'
E:\virus\newgl.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\dod.exe'
E:\virus\dod.exe
   [DETECTION] Contains suspicious code HEUR/Malware
   [WARNING] The file was ignored!

Virus or unwanted program 'TR/Dropper.Gen [TR/Dropper.Gen]'
detected in file 'E:\virus\014.exe.
Action performed: Deny access

The file 'dod.exe' has been determined to be 'UNDER ANALYSIS'.

上报~

[ 本帖最后由 Graybird 于 2008-2-11 08:10 编辑 ]

显示全部楼层 · 发表于 2008-2-11 06:54:27

Starting the file scan:

Begin scan in 'E:\virus\1.exe'
E:\virus\1.exe
   [DETECTION] Is the Trojan horse TR/PSW.Online.aav.1
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\2.exe'
E:\virus\2.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Qha.5
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\4.exe'
E:\virus\4.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.poc
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\5.exe'
E:\virus\5.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Qha.8
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\6.exe'
E:\virus\6.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmi.4
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\7.exe'
E:\virus\7.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pmi.5
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\8.exe'
E:\virus\8.exe
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\9.exe'
E:\virus\9.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.qjy.1
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\10.exe'
E:\virus\10.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.pvk
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\11.exe'
E:\virus\11.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\12.exe'
E:\virus\12.exe
   [DETECTION] Is the Trojan horse TR/WuDisable.B
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\13.exe'
E:\virus\13.exe
   [DETECTION] Is the Trojan horse TR/Rootkit.Gen
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\14.exe'
E:\virus\14.exe
   [DETECTION] Is the Trojan horse TR/Spy.Gen
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\15.exe'
E:\virus\15.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Qha.12
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\16.exe'
E:\virus\16.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.243
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\17.exe'
E:\virus\17.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.305
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\18.exe'
E:\virus\18.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.qiv
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\19.exe'
E:\virus\19.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\20.exe'
E:\virus\20.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.Qha.6
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\21.exe'
E:\virus\21.exe
   [DETECTION] Is the Trojan horse TR/PSW.Steal.33915
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\22.exe'
E:\virus\22.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.308
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\24.exe'
E:\virus\24.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.qlc
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\27.exe'
E:\virus\27.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\28.exe'
E:\virus\28.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.owx
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\30.exe'
E:\virus\30.exe
   [DETECTION] Is the Trojan horse TR/Drop.Agent.12343
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\mm.exe'
E:\virus\mm.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.ibm.1
   [INFO]    The file was deleted!
Begin scan in 'E:\virus\k.exe'
E:\virus\k.exe
   [DETECTION] Contains detection pattern of the Windows virus W32/Downloader.J
   [INFO]    The file was deleted!

End of the scan: 2008年2月11日  06:54
Used time: 00:56 min

The scan has been done completely.

   0 Scanning directories
   27 Files were scanned
   27 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   27 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   0 Files not concerned
   0 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-11 08:28:36

俺的HOSTS还需要封
xxx.haoqq1680.com
keeppure.cn
08675.service-google.cn
mm.sqmnoopt.com
20080209.service-google.cn

显示全部楼层 · 发表于 2008-2-11 10:40:56

哈哈，楼上你是封不完的。

显示全部楼层 · 发表于 2008-2-11 14:04:22

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.OnlineGames.GEN
病毒： Trojan.DL.Win32.Mnless.xr
病毒： Trojan.Win32.Edog.h
病毒： Worm.Win32.VB.zap
病毒： Trojan.Win32.Edog.k
病毒： Trojan.DL.Win32.Undef.w
病毒： RootKit.Win32.Mnless.gp

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.30.60

显示全部楼层 · 发表于 2008-2-11 15:24:19

G:\Users\Administrator\Desktop\virus7.rar » RAR » xy.exe - Win32/TrojanDownloader.Small.NZS trojan
G:\Users\Administrator\Desktop\virus7.rar » RAR » 614.exe - Win32/TrojanDownloader.Small.NZS trojan
G:\Users\Administrator\Desktop\virus7.rar » RAR » baidu.cab » CAB » xy.exe - Win32/TrojanDownloader.Small.NZS trojan
G:\Users\Administrator\Desktop\virus7.rar » RAR » bb.exe - a variant of Win32/TrojanDownloader.Agent.IAJ trojan
G:\Users\Administrator\Desktop\virus7.rar » RAR » bd.cab » CAB » bd.exe - a variant of Win32/TrojanDownloader.Agent.IAJ trojan
G:\Users\Administrator\Desktop\virus7.rar » RAR » bf.exe - Win32/TrojanDownloader.Small.NZS trojan
G:\Users\Administrator\Desktop\virus7.rar » RAR » dod.exe - Win32/TrojanDownloader.Agent.IBH trojan
G:\Users\Administrator\Desktop\virus7.rar » RAR » lz3.css - Win32/TrojanDownloader.Small.NZS trojan
G:\Users\Administrator\Desktop\virus7.rar » RAR » mm.exe - a variant of Win32/TrojanDownloader.Agent.IAJ trojan
G:\Users\Administrator\Desktop\virus7.rar » RAR » newrl.exe - a variant of Win32/TrojanDownloader.Agent.IAJ trojan
G:\Users\Administrator\Desktop\virus7.rar » RAR » pp.exe - a variant of Win32/TrojanDownloader.Agent.IAJ trojan
G:\Users\Administrator\Desktop\virus7.rar » RAR » pps.exe - Win32/TrojanDownloader.Small.NZS trojan
G:\Users\Administrator\Desktop\virus7.rar » RAR » qvod.exe - Win32/TrojanDownloader.Small.NZS trojan
G:\Users\Administrator\Desktop\virus7.rar » RAR » real2.exe - Win32/TrojanDownloader.Small.NZS trojan
G:\Users\Administrator\Desktop\virus7.rar » RAR » rl.exe - Win32/TrojanDownloader.Small.NZL trojan
G:\Users\Administrator\Desktop\virus7.rar » RAR » 014.exe - a variant of Win32/TrojanDownloader.Agent.IAJ trojan

显示全部楼层 · 发表于 2008-2-11 16:35:54

The file 'dod.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Agent.qwb. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

[已鉴定] 随便瞎输就碰见毒网了

回复 10楼 rappar 的帖子

回复 6楼 mox 的帖子

31/18

回复 14楼 Graybird 的帖子