北京志愿者协会首页被插入恶意代码

显示全部楼层 · 发表于 2008-4-23 13:56:00

消息转自：知道安全
北京志愿者协会http://bva.bv2008.cn/

Log is generated by FreShow.
[wide]http://bva.bv2008.cn/
[frame]http://wb.shijiediyi.net/one/hao8.htm?024
      [frame]http://bb.congtouzailai.net/wmwm/new.htm
         [object]http://mn.haoyuming.net/mmuu/abd.cab
         [object]http://mn.haoyuming.net/mmuu/abf.exe
         [object]http://mn.haoyuming.net/mmuu/arl.exe
         [object]http://mn.haoyuming.net/mmuu/a014.exe
[frame]http://wb.shijiediyi.net/one/hao8.htM?024
      [frame]http://bb.congtouzailai.net/wmwm/new.htm
[frame]http://wb.shijiediyi.net/one/hao8.htm?024
      [frame]http://bb.congtouzailai.net/wmwm/new.htm
[frame]http://wb.shijiediyi.net/one/hao8.htM?024
      [frame]http://bb.congtouzailai.net/wmwm/new.htm

Starting the file scan:
Begin scan in 'C:\Documents and Settings\Administrator\桌面\abd.cab'
C:\Documents and Settings\Administrator\桌面\abd.cab
  [0] Archive type: CAB (Microsoft)
  --> abd.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [NOTE]    The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\桌面\a014.exe'
C:\Documents and Settings\Administrator\桌面\a014.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [NOTE]    The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\桌面\abf.exe'
C:\Documents and Settings\Administrator\桌面\abf.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [NOTE]    The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\桌面\arl.exe'
C:\Documents and Settings\Administrator\桌面\arl.exe
   [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ppu
   [NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-4-23 14:07:16

毒: Trojan-PSW.Win32.OnLineGames.ppu (4x)

显示全部楼层 · 发表于 2008-4-23 14:08:55

E:\病毒\桌面.rar > RAR > abd.cab > CAB > abd.exe - Win32/TrojanDownloader.Small.NZS 特洛伊木马
E:\病毒\桌面.rar > RAR > a014.exe - Win32/TrojanDownloader.Small.NZS 特洛伊木马
E:\病毒\桌面.rar > RAR > abf.exe - Win32/TrojanDownloader.Small.NZS 特洛伊木马
E:\病毒\桌面.rar > RAR > arl.exe - Win32/TrojanDownloader.Small.NZS 特洛伊木马

........

显示全部楼层 · 发表于 2008-4-23 14:25:41

Firefox 3.0
以报告的攻击站点！

显示全部楼层 · 发表于 2008-4-23 14:29:28

已删除：木马程序 Trojan-PSW.Win32.OnLineGames.ppu 文件: D:\临时文件\桌面.rar/abd.cab/abd.exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.ppu 文件: D:\临时文件\桌面.rar/a014.exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.ppu 文件: D:\临时文件\桌面.rar/abf.exe//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.ppu 文件: D:\临时文件\桌面.rar/arl.exe//PE_Patch//UPack

显示全部楼层 · 发表于 2008-4-23 14:31:36

费尔报

显示全部楼层 · 发表于 2008-4-23 14:44:03

[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\桌面.rar->abd.cab->abd.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\桌面.rar->a014.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\桌面.rar->abf.exe->(UPack)
[Found possible security risk] <W32/Heuristic-162!Eldorado (damaged, not disinfectable)> C:\test\桌面.rar->arl.exe->(UPack)

显示全部楼层 · 发表于 2008-4-23 14:49:30

F-PROT中启发挂

显示全部楼层 · 发表于 2008-4-23 18:23:34

783203FBE53950AE61BE133FFBB6A0B0  arl.exe
783203FBE53950AE61BE133FFBB6A0B0  abf.exe
783203FBE53950AE61BE133FFBB6A0B0  abd.exe
783203FBE53950AE61BE133FFBB6A0B0  a014.exe

是同一个

显示全部楼层 · 发表于 2008-4-23 19:21:27

伞8 When accessing data from the URL, "http://bbs.kafan.cn/attachment.php?aid=247756"
a virus or unwanted program 'TR/PSW.OnlineGames.ppu' [trojan] was found.
Action taken: Blocked file

[已鉴定] 北京志愿者协会首页被插入恶意代码

回复 7楼 aerbeisi 的帖子