中国电子地图网被插入恶意代码

电影结束了

TF挂....
COMODO有反应...
替换了explorer???

duck2002

nod32     
0个

原帖由 ck893210 于 2008-5-18 14:02 发表
产物
http://xiaba66.cn/yoo1.exe
http://xiaba66.cn/yoo2.exe
http://xiaba66.cn/yoo3.exe
http://xiaba66.cn/yoo4.exe
http://xiaba66.cn/yoo6.exe
http://xiaba66.cn/yoo7.exe
http://xiaba66.cn/yoo8.exe ...

Starting the file scan:
Begin scan in 'E:\AV\yoo24.exe'
E:\AV\yoo24.exe
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo25.exe'
E:\AV\yoo25.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo26.exe'
E:\AV\yoo26.exe
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo28.exe'
E:\AV\yoo28.exe
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo27.exe'
E:\AV\yoo27.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo29.exe'
E:\AV\yoo29.exe
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo30.exe'
E:\AV\yoo30.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.109
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo31.exe'
E:\AV\yoo31.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.afqn
      [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\oKoK.exe'
E:\AV\oKoK.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.acjm
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo5.exe'
E:\AV\yoo5.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo1.exe'
E:\AV\yoo1.exe
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo2.exe'
E:\AV\yoo2.exe
      [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aidk
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo3.exe'
E:\AV\yoo3.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo4.exe'
E:\AV\yoo4.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo6.exe'
E:\AV\yoo6.exe
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo7.exe'
E:\AV\yoo7.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/Proxy.Xorpix.EZ
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo8.exe'
E:\AV\yoo8.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.Steal.44657
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo9.exe'
E:\AV\yoo9.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.aers
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo10.exe'
E:\AV\yoo10.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.113
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo11.exe'
E:\AV\yoo11.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.110
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo12.exe'
E:\AV\yoo12.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.106
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo13.exe'
E:\AV\yoo13.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.112
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo14.exe'
E:\AV\yoo14.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo15.exe'
E:\AV\yoo15.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo16.exe'
E:\AV\yoo16.exe
      [DETECTION] Is the Trojan horse TR/Onlinegames.NVI
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo17.exe'
E:\AV\yoo17.exe
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo18.exe'
E:\AV\yoo18.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo19.exe'
E:\AV\yoo19.exe
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo20.exe'
E:\AV\yoo20.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo21.exe'
E:\AV\yoo21.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.108
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo22.exe'
E:\AV\yoo22.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
Begin scan in 'E:\AV\yoo23.exe'
E:\AV\yoo23.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NVI.105
      [NOTE]      The file was deleted!

End of the scan: 2008年5月18日  14:37
Used time: 00:30 min
The scan has been done completely.
      0 Scanning directories
     32 Files were scanned
     34 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     32 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     -2 Files not concerned
      0 Archives were scanned
      0 Warnings
     32 Notes

qigang

RS20.44.62未杀！

qigang

瑞星病毒查杀结果报告（108/33）

清除病毒种类列表：

病毒： Trojan.PSW.Win32.GameOL.nlr
病毒： Trojan.PSW.Win32.GameSOL.n
病毒： Trojan.PSW.Win32.GamesOnline.zt
病毒： Trojan.PSW.Win32.GameOL.nlv
病毒： Trojan.PSW.Win32.GameSOL.l
病毒： Trojan.PSW.Win32.GameOL.gdl
病毒： Trojan.PSW.Win32.GameOL.nla
病毒： Trojan.PSW.Win32.GameOL.nka
病毒： Trojan.PSW.Win32.QQHX.txg
病毒： Trojan.PSW.Win32.GameOL.njk
病毒： Trojan.PSW.Win32.GamesOnline.aak
病毒： Trojan.PSW.Win32.GameOL.njf
病毒： Trojan.PSW.Win32.GameSOL.k
病毒： Trojan.PSW.Win32.GamesOnline.zn
病毒： Trojan.PSW.Win32.GameOL.nlt
病毒： Trojan.PSW.Win32.QQHX.txh
病毒： RootKit.Win32.Undef.gt   
病毒： Trojan.PSW.Win32.GameOL.nip
病毒： Trojan.PSW.Win32.GamesOnline.aam
病毒： Trojan.PSW.Win32.GamesOnline.zv
病毒： RootKit.Win32.RESSDT.al  
病毒： Trojan.PSW.Win32.GamesOnline.wb
病毒： Trojan.PSW.Win32.WoWar.apo
病毒： Trojan.Win32.Undef.gfj   
病毒： Trojan.Win32.Undef.gfj   
病毒： Trojan.PSW.Win32.GameOL.nlm
病毒： Trojan.PSW.Win32.XYOnline.aei
病毒： Worm.Win32.PaBug.hb      
病毒： Trojan.PSW.Win32.QQHX.twx

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.44.62

BING126

McAfee        bd.cab         Generic.dx

wangjay1980

TO KL