华军被挂马了?

显示全部楼层 · 发表于 2008-2-14 17:59:49

http://news.newhua.com/news1/news/2008/213/082139155918FCEAHII2D54HH79HE0.html

显示全部楼层 · 发表于 2008-2-14 18:00:06

红伞报

显示全部楼层 · 发表于 2008-2-14 18:43:47

http://xxx.haoqq1680.com/dod.exe

显示全部楼层 · 发表于 2008-2-14 18:44:05

Threat details:

Web page:
http://xxx.haoqq1680.com/dod.exe

Threat:
probably a variant of Win32/Genetik trojan

Comment:
Access to the web page was blocked by ESET Smart Security.

显示全部楼层 · 发表于 2008-2-14 18:47:54

C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\~FA9.TMP
协议类型:TCP
本地地址:0.0.0.0
本地端口:1671
远端地址:222.189.237.164(江苏·扬州)
远端端口:80

有联网动作微点发现动作了

显示全部楼层 · 发表于 2008-2-14 18:56:59

确实被挂！

显示全部楼层 · 发表于 2008-2-15 00:50:09

Virus or unwanted program 'TR/Crypt.NSPM.Gen [TR/Crypt.NSPM.Gen]'
detected in file 'C:\TDDOWNLOAD\dod.exe.td.
Action performed: Delete file

显示全部楼层 · 发表于 2008-2-17 23:19:02

Log is generated by FreShow.
[wide]http://xxx.haoqq1680.com/vip003.htm
[script]http://xxx.haoqq1680.com/Ajax.gif
[object]http://xxx.haoqq1680.com/dod.exe
[frame]http://xxx.haoqq1680.com/Ms06014.htm
[script]http://xxx.haoqq1680.com/Real.js
[script]http://xxx.haoqq1680.com/Bfyy.gif
[script]http://xxx.haoqq1680.com/Pps.gif
[script]http://xxx.haoqq1680.com/XunLei.gif
[script]http://xxx.haoqq1680.com/Lz.gif
[frame]http://xxx.haoqq1680.com/QVod.html

显示全部楼层 · 发表于 2008-2-17 23:25:22

木马名称:Trojan-Downloader.Win32.Agent.ppk

程序:
D:\DOCUMENTS AND SETTINGS\XXXXX\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\S1IB8DU3\DOD[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2008-2-17 23:26:11

The following viruses Trojan-Downloader.Win32.Agent.jew

[已鉴定] 华军被挂马了?

老马了