ITECN.net被挂马，大家小心

显示全部楼层 · 发表于 2008-3-1 13:11:48

列表里面的东东

显示全部楼层 · 发表于 2008-3-1 13:15:06

ESS正在扫描...........
病毒库版本: 2913 (20080301)
日期: 2008-3-1 时间: 13:18:18
已扫描的磁盘、文件夹和文件: D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1128.exe - Win32/PSW.OnLineGames.NML 特洛伊木马的变种
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1129.exe - Win32/PSW.OnLineGames.NML 特洛伊木马的变种
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1130.exe - Win32/PSW.OnLineGames.NML 特洛伊木马的变种
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1131.exe - Win32/PSW.OnLineGames.NML 特洛伊木马的变种
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1132.exe - Win32/PSW.OnLineGames.NML 特洛伊木马
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1133.exe - Win32/PSW.OnLineGames.NML 特洛伊木马的变种
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1134.exe - Win32/PSW.OnLineGames.MUG 特洛伊木马的变种
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1111.exe - 可能是 Win32/Genetik 特洛伊木马的变种
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1112.exe - Win32/PSW.OnLineGames.MUG 特洛伊木马
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1113.exe - Win32/PSW.OnLineGames.NFL 特洛伊木马
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1114.exe - Win32/PSW.OnLineGames.MUG 特洛伊木马
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1115.exe - Win32/PSW.OnLineGames.MUG 特洛伊木马
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1116.exe - Win32/PSW.OnLineGames.MUG 特洛伊木马
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1117.exe - Win32/PSW.OnLineGames.MUG 特洛伊木马
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1118.exe - 可能是 Win32/PSW.OnLineGames.NFL 特洛伊木马的变种
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1119.exe - Win32/PSW.OnLineGames.MUG 特洛伊木马
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1120.exe - Win32/PSW.OnLineGames.MUG 特洛伊木马
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1121.exe - Win32/PSW.OnLineGames.MUG 特洛伊木马
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1122.exe - Win32/PSW.OnLineGames.MUG 特洛伊木马
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1123.exe - Win32/PSW.OnLineGames.MUG 特洛伊木马
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1124.exe - Win32/PSW.OnLineGames.NML 特洛伊木马的变种
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1125.exe - Win32/PSW.OnLineGames.MUG 特洛伊木马
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1126.exe - Win32/PSW.OnLineGames.MUG 特洛伊木马
D:\Documents and Settings\xxxxxxxx\桌面\Data01.rar > RAR > 1127.exe - Win32/PSW.OnLineGames.NFL 特洛伊木马
已扫描的对象数: 24
发现的威胁数: 24
完成时间: 13:18:25 总扫描时间: 7 秒 (00:00:07)

显示全部楼层 · 发表于 2008-3-1 13:32:30

Begin scan in 'C:\Documents and Settings\haha\桌面\Data01.rar'
C:\Documents and Settings\haha\桌面\Data01.rar
  [0] Archive type: RAR
--> 1128.exe
      [DETECTION] Contains suspicious code HEUR/Malware
--> 1129.exe
      [DETECTION] Contains suspicious code HEUR/Malware
--> 1130.exe
      [DETECTION] Contains suspicious code HEUR/Malware
--> 1131.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> 1132.exe
   [DETECTION] Is the Trojan horse TR/BHO.aya.1
--> 1133.exe
      [DETECTION] Contains suspicious code HEUR/Malware
--> 1111.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.djg.2
--> 1112.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
      --> Object
         [4] Archive type: RSRC
         --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.qnq.1
--> 1113.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NSR.393
--> 1114.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/PSW.Wow.acd
--> 1116.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
      --> Object
         [4] Archive type: RSRC
         --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.rti.7
--> 1117.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
      --> Object
         [4] Archive type: RSRC
         --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.rjh.6
--> 1118.exe
      [DETECTION] Is the Trojan horse TR/Onlinegames.rxt
--> 1119.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
      --> Object
         [4] Archive type: RSRC
         --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.rjh.11
--> 1121.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
      --> Object
         [4] Archive type: RSRC
         --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.rjh.13
--> 1122.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
      --> Object
         [4] Archive type: RSRC
         --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.rjh
  --> 1124.exe
   [DETECTION] Is the Trojan horse TR/BHO.aya.1
   [INFO]    A backup was created as '483cead0.qua'  ( QUARANTINE )

End of the scan: 2008年3月1日  13:32
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   25 Files were scanned
   26 viruses and/or unwanted programs were found
   6 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   -1 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-3-1 14:59:33

ACCESS DENIED
The requested URL could not be retrieved

--------------------------------------------------------------------------------

While trying to retrieve the URL: http://bbs.kafan.cn/attachment.php?aid=210610

The folowing error was encountered:

The requested object is INFECTED. The following viruses Trojan-PSW.Win32.OnLineGames.sea were found

Please contact your service provider if you feel this is incorrect.

--------------------------------------------------------------------------------

Generated Fri Feb 29 22:59:37 2008 by Kaspersky Internet Security 7.0

显示全部楼层 · 发表于 2008-3-1 15:29:31

Log is generated by FreShow.
[wide]http://blogs.itecn.net/blogs/default.aspx
[frame]http://xxx.wofala.info/123.htm
      [frame]http://xxx.wofala.info/ceshi/real.htm
         [object]http://xxx.huilaiba.info/ww/la.exe
      [frame]http://xxx.wofala.info/ceshi/lz.htm
      [frame]http://xxx.wofala.info/ceshi/614.htm

显示全部楼层 · 发表于 2008-3-1 22:17:06

57/24

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GamesOnline.pc
病毒： Trojan.PSW.Win32.GameOL.mcv
病毒： Trojan.PSW.Win32.GamesOnline.oj
病毒： Trojan.PSW.Win32.GamesOnline.oe
病毒： Trojan.PSW.Win32.GameOL.lvx
病毒： Trojan.PSW.Win32.GameOL.GEN
病毒： Trojan.PSW.Win32.GamesOnline.mn
病毒： Trojan.PSW.Win32.GameOL.mcr
病毒： Trojan.PSW.Win32.GameOL.mau
病毒： Trojan.PSW.Win32.GameOL.mcy
病毒： RootKit.Win32.GameHack.GEN
病毒： Trojan.PSW.Win32.DJOnline.bq

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.33.52

显示全部楼层 · 发表于 2008-3-1 22:17:38

3/0

rising20.33.52未知！

显示全部楼层 · 发表于 2008-3-31 18:13:09

还是小心为妙

显示全部楼层 · 发表于 2008-3-31 18:22:09

24

E:\病毒\Data01.rar>>1111.exe       TrojanDownloader.Nurech.bd.bmqk       木马       还未处理
E:\病毒\Data01.rar>>1112.exe       TrojanPSW.OnLineGames.qnk.xzis       木马       还未处理
E:\病毒\Data01.rar>>1113.exe       W32.Viking.k       病毒       还未处理
E:\病毒\Data01.rar>>1114.exe       TrojanPSW.OnLineGames.qiv.nfii       木马       还未处理
E:\病毒\Data01.rar>>1115.exe       PWSteal.m.jezg       木马       还未处理
E:\病毒\Data01.rar>>1116.exe       TrojanPSW.OnLineGames.rhu.ilsj       木马       还未处理
E:\病毒\Data01.rar>>1117.exe       TrojanPSW.OnLineGames.rhu.sfyd       木马       还未处理
E:\病毒\Data01.rar>>1118.exe       W32.Viking.k       病毒       还未处理
E:\病毒\Data01.rar>>1119.exe       Trojan.Cap821923.cbiv       木马       还未处理
E:\病毒\Data01.rar>>1120.exe       TrojanPSW.OnLineGames.rhu.ahya       木马       还未处理
E:\病毒\Data01.rar>>1121.exe       TrojanPSW.OnLineGames.rhu.fcud       木马       还未处理
E:\病毒\Data01.rar>>1122.exe       TrojanPSW.OnLineGames.rhu.ufvl       木马       还未处理
E:\病毒\Data01.rar>>1123.exe       Trojan.Cap821823.brgh       木马       还未处理
E:\病毒\Data01.rar>>1124.exe       TrojanPSW.OnLineGames.rwv.ajkl       木马       还未处理
E:\病毒\Data01.rar>>1125.exe       Trojan.Cap822523.ldsu       木马       还未处理
E:\病毒\Data01.rar>>1126.exe       Trojan.Cap822523.qbne       木马       还未处理
E:\病毒\Data01.rar>>1127.exe       W32.Viking.k       病毒       还未处理
E:\病毒\Data01.rar>>1128.exe       Trojan.BHO.azw.wvui       木马       还未处理
E:\病毒\Data01.rar>>1129.exe       Trojan.BHO.azw.lstx       木马       还未处理
E:\病毒\Data01.rar>>1130.exe       TrojanPSW.GamesOnline.pc.obge       木马       还未处理
E:\病毒\Data01.rar>>1131.exe       Trojan.BHO.azw.atgq       木马       还未处理
E:\病毒\Data01.rar>>1132.exe       Trojan.BHO.ayz.cvvd       木马       还未处理
E:\病毒\Data01.rar>>1133.exe       Trojan.BHO.azw.ewuc       木马       还未处理
E:\病毒\Data01.rar>>1134.exe       TrojanPSW.OnLineGames.ryv.viwk       木马       还未处理

显示全部楼层 · 发表于 2008-3-31 18:23:19

E:\病毒\la.rar>>la.exe Trojan.Cap822819.oync 木马还未处理

[病毒样本] ITECN.net被挂马，大家小心

回复某楼的帖子

本帖子中包含更多资源

回复 11楼 qianwenxiang 的帖子

回复 2楼 tanlimo 的帖子

回复 11楼 qianwenxiang 的帖子

回复 2楼 tanlimo 的帖子

[病毒样本] ITECN.net被挂马，大家小心

回复 某楼 的帖子

本帖子中包含更多资源

回复 11楼 qianwenxiang 的帖子

回复 2楼 tanlimo 的帖子

回复 11楼 qianwenxiang 的帖子

回复 2楼 tanlimo 的帖子

回复某楼的帖子