病毒网址

显示全部楼层 · 发表于 2008-5-10 17:00:00

占用内存太大了，卡死我了，直接下网页下来是一个加密的，看不懂
谁能解析一下？
http://www.wodegezi.cn/gm.htm
http://www.wodegezi.cn/webx.asp

显示全部楼层 · 发表于 2008-5-10 17:09:59

http://down.wodegezi.cn/down.exe

显示全部楼层 · 发表于 2008-5-10 17:12:22

Starting the file scan:

Begin scan in 'E:\AV\down.exe'
E:\AV\down.exe
[DETECTION] Is the Trojan horse TR/Downloader.Gen
[NOTE] The file was deleted!

显示全部楼层 · 发表于 2008-5-10 17:13:07

wodegezi我的鸽子

显示全部楼层 · 发表于 2008-5-10 17:17:57

噢～噢～下载者，偶运行一下看有啥反应

——————————————————————————
进程里面从1.exe到20.exe挨个运行- -

[ 本帖最后由 majsma 于 2008-5-10 17:20 编辑 ]

显示全部楼层 · 发表于 2008-5-10 17:38:09

http://gm.wodegezi.cn/1.exe
http://gm.wodegezi.cn/2.exe
http://gm.wodegezi.cn/3.exe
http://gm.wodegezi.cn/4.exe
http://gm.wodegezi.cn/5.exe
http://gm.wodegezi.cn/6.exe
http://gm.wodegezi.cn/7.exe
http://gm.wodegezi.cn/8.exe
http://gm.wodegezi.cn/9.exe
http://gm.wodegezi.cn/10.exe
http://gm.wodegezi.cn/11.exe
http://gm.wodegezi.cn/12.exe
http://gm.wodegezi.cn/13.exe
http://gm.wodegezi.cn/14.exe
http://gm.wodegezi.cn/15.exe
http://gm.wodegezi.cn/16.exe
http://gm.wodegezi.cn/17.exe
http://gm.wodegezi.cn/18.exe
http://gm.wodegezi.cn/19.exe
http://gm.wodegezi.cn/20.exe
http://gm.wodegezi.cn/21.exe
http://gm.wodegezi.cn/22.exe

复制代码

　
２２．ｅｘｅ无法下载　只有２１个

[ 本帖最后由冷冷于 2008-5-10 17:53 编辑 ]

显示全部楼层 · 发表于 2008-5-10 17:51:10

原帖由冷冷于 2008-5-10 17:38 发表
 http://gm.wodegezi.cn/1.exe
http://gm.wodegezi.cn/2.exe
http://gm.wodegezi.cn/3.exe
http://gm.wodegezi.cn/4.exe
http://gm.wodegezi.cn/5.exe
http://gm.wodegezi.cn/6.exe
http://gm.wodegezi.cn/7.ex ...

Starting the file scan:

Begin scan in 'E:\AV\list.rar'
E:\AV\list.rar
E:\AV\list.rar
  [0] Archive type: RAR
--> 6.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/Proxy.Xorpix.EN
      --> Object
         [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.aks.1
--> 7.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> 9.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> 10.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> 11.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
      [3] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.abzd.34
--> 13.exe
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
--> 14.exe
   --> Object
      [2] Archive type: RSRC
      --> Object
         [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.adqz
--> 19.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.ddo
--> 17.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
--> 20.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
--> 21.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.ddo
--> 1.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.ddo
   [NOTE]    The file was deleted!

End of the scan: 2008年5月10日  18:17
Used time: 00:20 min

The scan has been done completely.

   0 Scanning directories
   22 Files were scanned
   23 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   1 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   -1 Files not concerned
   1 Archives were scanned
   0 Warnings
   1 Notes

[ 本帖最后由 Exia 于 2008-5-10 18:15 编辑 ]

显示全部楼层 · 发表于 2008-5-10 20:12:42

RS20.43.52未杀！

显示全部楼层 · 发表于 2008-5-10 20:14:23

原帖由冷冷于 2008-5-10 17:38 发表
 http://gm.wodegezi.cn/1.exe
http://gm.wodegezi.cn/2.exe
http://gm.wodegezi.cn/3.exe
http://gm.wodegezi.cn/4.exe
http://gm.wodegezi.cn/5.exe
http://gm.wodegezi.cn/6.exe
http://gm.wodegezi.cn/7.ex ...

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.SunOnline.nx
病毒： Harm.Win32.AntiSig.a
病毒： Trojan.PSW.Win32.GameOL.ka
病毒： Trojan.PSW.Win32.GamesOnline.yk
病毒： Trojan.PSW.Win32.GameOL.gau
病毒： Trojan.PSW.Win32.GameOL.nfp
病毒： Trojan.PSW.Win32.GameOL.gbk
病毒： Trojan.PSW.Win32.SunOnline.ny
病毒： RootKit.Win32.Mnless.oe
病毒： Trojan.DL.Win32.Baser.av
病毒： Trojan.PSW.Win32.GamesOnline.yi
病毒： Trojan.PSW.Win32.QQGame.bz
病毒： Trojan.PSW.Win32.GameOL.im

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.43.52

显示全部楼层 · 发表于 2008-5-11 10:39:42

2008-05-11 10:33:37 文件保护(创建文件) 操作:阻止
进程路径:C:\program files\Internet Explorer\IEXPLORE.EXE
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\~~.exe

[已鉴定] 病毒网址

2/0

60/23