挂的一塌糊涂

显示全部楼层 · 发表于 2008-4-4 22:45:52

http://xxx.er19.com/output/0/029.asp
没解完。。这个。。有兴趣的解完吧。。

Log is generated by FreShow.
[wide]http://xxx.er19.com/output/0/029.asp
[script]http://s16.cnzz.com/stat.php?id=809081&web_id=809081&show=pic
      [object]http://3w.chirenrou.cn/wm/bak.exe
[frame]http://dd00.2008dajiafa.cn/vip/Zn36517.htm
      [object]http://20080318.2008dajiafa.cn/ad.cab
      [frame]http://dd00.2008dajiafa.cn/vip/20080318/7.gi  f
         [object]http://r11.2008dajiafa.cn/r11.exe
      [frame]http://dd00.2008dajiafa.cn/vip/20080318/u.html
         [frame]http://dd00.2008dajiafa.cn/vip/20080318/1.gi  f
         [frame]http://dd00.2008dajiafa.cn/vip/20080318/2.gi  f
         [frame]http://dd00.2008dajiafa.cn/vip/20080318/3.gi  f
         [frame]http://dd00.2008dajiafa.cn/vip/20080318/4.gi  f
         [frame]http://dd00.2008dajiafa.cn/vip/20080318/5.gi  f
         [frame]http://dd00.2008dajiafa.cn/vip/20080318/6.gi  f
      [script]http://js.users.51.la/1692643.js
[frame]http://75.cncz.us/kew75.htm?11
      [frame]http://75.cncz.us/w/u.html
         [frame]http://75.cncz.us/w/w/u.html
            [frame]http://u.cncz.us/new000.htm
                  [frame]http://u.cncz.us/w/u.html
                     [frame]http://u.cncz.us/w/1.gi  f
                              [object]http://u.cncz.us/d/ad.cab
                     [frame]http://u.cncz.us/w/7.gi  f
                        [script]http://u.cncz.us/js/alarm.js
                        [script]http://u.cncz.us/js/config.js
                     [frame]http://u.cncz.us/w/2.gi  f
                     [frame]http://u.cncz.us/w/3.gi  f
                     [frame]http://u.cncz.us/w/4.gi  f
                     [frame]http://u.cncz.us/w/5.gi  f
                     [frame]http://u.cncz.us/w/6.gi  f
                  [script]http://js.users.51.la/1554929.js
         [script]http://js.users.51.la/1554929.js
      [script]http://js.users.51.la/1554929.js
[frame]http://3w.chirenrou.cn/28159386.htm?804
      [frame]http://3w.chirenrou.cn/wm/new.htm
         [frame]http://3w.chirenrou.cn/wm/Ajax.htm
         [frame]http://3w.chirenrou.cn/wm/Ms06014.htm
         [frame]http://3w.chirenrou.cn/wm/Real.htm
         [frame]http://3w.chirenrou.cn/wm/Bfyy.htm
         [frame]http://3w.chirenrou.cn/wm/Lz.htm
         [frame]http://3w.chirenrou.cn/wm/Pps.htm
         [frame]http://3w.chirenrou.cn/wm/XunLei.htm
      [frame]http://3w.chirenrou.cn/rl.htm
      [script]http://js.users.51.la/1750684.js
[frame]http://club.pchome.net/forum_5_45____.html
      [script]http://club.pchome.net/js/popupImages.js
      [script]http://is.qq.com/js/addportal.js
      [frame]http://a.158dm.com/b5.htm
         [script]http://b.158dm.com/one/ok.js
         [frame]http://b.158dm.com/one/ok.htm
            [script]http://b.158dm.com/one/14.js
                  [object]http://c.158dm.com/ok.exe
            [script]http://b.158dm.com/one/rl.js
            [script]http://b.158dm.com/one/lz.js
         [script]http://s101.cnzz.com/stat.php?id=358277&web_id=358277
         [script]http://js.users.51.la/1740075.js
         [frame]http://www.tj555.com/ads.asp?id="+
      [script]http://stat.pchome.net/stat.js
      [script]http://btn.pchome.net/swfobject.js
      [script]http://btn.pchome.net/flash.js
      [script]http://img.club.pchome.net/html/count/PChome_Count.js
      [script]http://img.club.pchome.net/btm/btm.js
      [script]http://dw-cn.com.com/js/dw.js
[frame]http://adsl.jk33581.com/web/6604635.htm
[frame]http://www.916kk.com/index.htm
      [script]http://1.hao929.cn/z.js
      [script]http://www.916kk.com/电子书苑.files/stat.js
      [script]http://1.hao929.cn/z.js
[frame]http://wb.shijiediyi.net/one/huai4.htm?804
[frame]http://dd00.2008dajiafa.cn/vip/Zn36517.htm
[frame]http://club.pchome.net/forum_1_15.html
[frame]http://75.cncz.us/kew75.htm?11
[frame]http://adsl.jk33581.com/web/6604635.htm
[frame]http://www.916kk.com/index.htm

显示全部楼层 · 发表于 2008-4-4 22:48:04

先放5个上来。。

显示全部楼层 · 发表于 2008-4-4 22:48:57

C:\Documents and Settings\Don johnson\桌面\D5.rar » RAR » ad2.cab » CAB » ad.exe - Win32/TrojanDownloader.Small.NZS trojan
C:\Documents and Settings\Don johnson\桌面\D5.rar » RAR » ok.exe - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\Don johnson\桌面\D5.rar » RAR » bak.exe - a variant of Win32/AutoRun.HZ worm
C:\Documents and Settings\Don johnson\桌面\D5.rar » RAR » ad.cab » CAB » ad.exe - Win32/TrojanDownloader.Small.NZS trojan
C:\Documents and Settings\Don johnson\桌面\D5.rar » RAR » r11.exe - Win32/TrojanDownloader.Small.NZS trojan

显示全部楼层 · 发表于 2008-4-4 22:50:57

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\D5.rar'
C:\Documents and Settings\Administrator\My Documents\
  D5.rar
[0] Archive type: RAR
   --> ad2.cab
      [1] Archive type: CAB (Microsoft)
      --> ad.exe
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
         [WARNING] Infected files in archives cannot be repaired!
   --> ok.exe
      [1] Archive type: Runtime Packed
      --> Object
   --> bak.exe
      [1] Archive type: Runtime Packed
      --> Object
         [DETECTION] Is the Trojan horse TR/Drop.Cattivo.A
         [WARNING] Infected files in archives cannot be repaired!
   --> ad.cab
      [1] Archive type: CAB (Microsoft)
      --> ad.exe
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
         [WARNING] Infected files in archives cannot be repaired!
--> r11.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [NOTE]    The file was deleted!

End of the scan: 2008年4月4日  07:50
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   8 Files were scanned
   5 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   3 Archives were scanned
   3 Warnings
   1 Notes

显示全部楼层 · 发表于 2008-4-4 22:51:53

Starting the file scan:

Begin scan in 'E:\D5.rar'
E:\D5.rar
  [0] Archive type: RAR
--> ad2.cab
   [1] Archive type: CAB (Microsoft)
   --> ad.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
  --> ok.exe
   [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
  --> bak.exe
   [DETECTION] Is the Trojan horse TR/Drop.Cattivo.A
--> ad.cab
   [1] Archive type: CAB (Microsoft)
   --> ad.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
  --> r11.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-4-4 22:58:35

ess扫描日志
病毒库版本: 3003 (20080404)
日期: 2008-4-4 时间: 23:02:42
已扫描的磁盘、文件夹和文件: G:\D5.rar
G:\D5.rar > RAR > ad2.cab > CAB > ad.exe - Win32/TrojanDownloader.Small.NZS 特洛伊木马
G:\D5.rar > RAR > ok.exe - 可能是 Win32/Genetik 特洛伊木马的变种
G:\D5.rar > RAR > bak.exe - Win32/AutoRun.HZ 蠕虫的变种
G:\D5.rar > RAR > ad.cab > CAB > ad.exe - Win32/TrojanDownloader.Small.NZS 特洛伊木马
G:\D5.rar > RAR > r11.exe - Win32/TrojanDownloader.Small.NZS 特洛伊木马
已扫描的对象数: 5
发现的威胁数: 5
完成时间: 23:02:45 总扫描时间: 3 秒 (00:00:03)

显示全部楼层 · 发表于 2008-4-5 00:06:28

木马名称:Trojan-Downloader.Win32.Small.ocj

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.A52ABCA6B4374C8\桌面\R11.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Downloader.Win32.Small.ocj

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.A52ABCA6B4374C8\LOCAL SETTINGS\TEMP\RAR$EX00.281\AD.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
马名称:Trojan-PSW.Win32.OLGame.ysj

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.A52ABCA6B4374C8\LOCAL SETTINGS\TEMP\RAR$EX01.218\AD.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.A52ABCA6B4374C8\桌面\BAK.EXE
是否删除病毒程序及其衍生物?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.A52ABCA6B4374C8\桌面\OK.EXE
是否阻止该进程继续运行?
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.A52ABCA6B4374C8\桌面\OK.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\TASKS\0X01XX8P.EXE
2) C:\WINDOWS.0\TASKS\EXPLORER.EXT
是否删除病毒程序及其衍生物?

显示全部楼层 · 发表于 2008-4-5 00:20:31

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.OnlineGames.GEN
病毒： Suspicious.Trojan.Win32.Downldr.a

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.38.40

今天没兴趣了，困了。

显示全部楼层 · 发表于 2008-4-5 00:24:39

粗略一看，应该是常见物，只是被挂的太多了，这站垃圾。

显示全部楼层 · 发表于 2008-4-5 01:05:28

[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\d5.rar->ad2.cab->ad.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\d5.rar->ok.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\d5.rar->bak.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\d5.rar->ad.cab->ad.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\d5.rar->r11.exe->(UPack)

[已鉴定] 挂的一塌糊涂

10/4