QQ网站被挂马了？

6877297

拿这个去查了一下就只有红伞查得出来

挪威的冬天

信息        2008-05-29  14:39:40        您此次查毒隔离了2个文件                       
信息        2008-05-29  14:39:40        您此次查毒共查出2个病毒以及危险代码                       
信息        2008-05-29  14:39:40        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件4个                       
信息        2008-05-29  14:39:40        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-05-29  14:39:40        D:\Desktop\abe-1.exe        Win32.Troj.DownLoaderT.hu.147456        隔离成功       
病毒        2008-05-29  14:39:38        D:\Desktop\abe.exe        Win32.Troj.DownLoaderT.hu.147456        隔离成功

Nerazzurri

deleted: Trojan program Trojan-PSW.Win32.OnLineGames.aksn        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/r7.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajsp        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/i8.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajth        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/x9.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajsz        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/l10.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.akau        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/b11.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajtf        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/z12.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.akka        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/m13.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.aklk        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/n14.exe//FSG
deleted: Trojan program Trojan.Win32.Agent.qqx        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/o15.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajbx        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/g16.exe//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.aksa        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/j17.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajsr        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/l18.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.adup        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/c19.exe//PE_Patch//UPack
deleted: virus Worm.Win32.Downloader.ml        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/t20.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajta        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/p21.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajtn        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/x22.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajti        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/m23.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajtf        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/o24.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.akjn        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/b25.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajst        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/e26.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajtl        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/v27.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajsu        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/m28.exe//FSG
deleted: virus Worm.Win32.Downloader.mb        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/u29.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajna        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/h30.exe//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajsv        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/b31.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.akug        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/c32.exe//FSG//#//UPack
deleted: Trojan program Backdoor.Win32.Popwin.bfu        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/u33.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.QQPass.cas        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/f34.exe//UPX
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajsw        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/e1.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajss        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/r2.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajtt        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/a3.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajto        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/j4.exe//FSG
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.ajnn        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/y5.exe//PE_Patch//UPack
deleted: Trojan program Trojan-PSW.Win32.OnLineGames.akji        File: C:\Users\Nerazzurri\Desktop\Ñù±¾(35).rar/m6.exe//FSG

以后腾讯网都不敢上了。。。

Starting the file scan:

Begin scan in 'E:\AV\virus'
E:\AV\virus\r7.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The fund was classified as suspicious.
      [NOTE]      The file was moved to '486c51d7.qua'!
E:\AV\virus\i8.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\x9.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\l10.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\b11.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\z12.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajtg
      --> Object
          [DETECTION] Contains detection pattern of the worm WORM/Downloader.MM
      [NOTE]      The file was deleted!
E:\AV\virus\m13.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\n14.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\o15.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/Agent.qqx.1
      --> Object
          [DETECTION] Is the Trojan horse TR/Agent.qqx
      [NOTE]      The file was deleted!
E:\AV\virus\g16.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajcf
      [NOTE]      The file was deleted!
E:\AV\virus\j17.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The fund was classified as suspicious.
      [NOTE]      The file was moved to '487551d2.qua'!
E:\AV\virus\l18.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\c19.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.afqn
      [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\t20.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajsq
      --> Object
          [DETECTION] Contains detection pattern of the worm WORM/Downloader.MM
      [NOTE]      The file was deleted!
E:\AV\virus\p21.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\x22.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\m23.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\o24.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajtg
      --> Object
          [DETECTION] Contains detection pattern of the worm WORM/Downloader.MM
      [NOTE]      The file was deleted!
E:\AV\virus\b25.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/Agent.qqx
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
      [NOTE]      The file was deleted!
E:\AV\virus\e26.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\v27.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajtm
      --> Object
          [DETECTION] Contains detection pattern of the worm WORM/Downloader.MM
      [NOTE]      The file was deleted!
E:\AV\virus\m28.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\u29.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Contains detection pattern of the worm WORM/Downloader.LY
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\h30.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajna
      [NOTE]      The file was deleted!
E:\AV\virus\b31.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\c32.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\u33.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Popwin.bfu Backdoor server programs
      [NOTE]      The file was deleted!
E:\AV\virus\f34.exe
      [DETECTION] Is the Trojan horse TR/ATRAPS.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\e1.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajus
      [NOTE]      The file was deleted!
E:\AV\virus\r2.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\a3.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\j4.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajtp
      [NOTE]      The file was deleted!
E:\AV\virus\y5.exe
    --> Object
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.ajnn
      [DETECTION] Is the Trojan horse TR/Dldr.Delphi.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\m6.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
E:\AV\virus\abe.exe
      [DETECTION] Is the Trojan horse TR/Spy.Gen
      [NOTE]      The file was deleted!


End of the scan: 2008年5月29日  14:48
Used time: 00:18 min

The scan has been done completely.

      1 Scanning directories
     35 Files were scanned
     42 viruses and/or unwanted programs were found
      2 Files were classified as suspicious:
     33 files were deleted
      0 files were repaired
      2 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     -7 Files not concerned
      0 Archives were scanned
      0 Warnings
     35 Notes

palfan

帮忙把两个启发的上报了吧，我懒得下了

上报了

woai_jolin

早就清了吧

solcroft

* avast! Report
* This file is generated automatically
*
* Task 'Simple user interface' used
* Started on Thursday, May 29, 2008
* VPS: 080529-0, 29/05/2008
*

C:\Documents and Settings\Admin\Desktop\样本(35)\a3.exe\[FSG] [L] Win32:OnLineGames-DQS [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\abe.exe\[Upack]\[Embedded#03008]\[Embedded#a808] [L] Win32:Trojan-gen {Other} (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\b11.exe\[FSG] [L] Win32:OnLineGames-DQS [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\b25.exe\[FSG]\[Embedded#3000]\[Upack] [L] Win32:Agent-BQC [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\b31.exe\[FSG] [L] Win32:OnLineGames-DQS [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\c19.exe\[Upack]\[Embedded#50c0]\[Upack] [L] Win32:WOW-FXY [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\c32.exe\[FSG]\[Embedded#3000]\[Upack] [L] Win32:Agent-BQC [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\e1.exe\[FSG]\[Embedded#3000]\[Upack] [L] Win32:Agent-BQC [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\e26.exe\[FSG] [L] Win32:OnLineGames-DQS [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\f34.exe\[UPX]\[Embedded#FILE] [L] Win32:OnLineGames-BSI [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\g16.exe\[UPX]\[Embedded#1860] [L] Win32:OnLineGames-DQN [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\h30.exe\[UPX]\[Embedded#1860] [L] Win32:OnLineGames-DQS [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\i8.exe\[FSG] [L] Win32:OnLineGames-DQS [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\j17.exe\[FSG] [L] Win32:OnLineGames-DQS [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\j4.exe\[FSG]\[Embedded#3000]\[Upack] [L] Win32:Agent-BQC [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\l10.exe\[FSG] [L] Win32:OnLineGames-DQN [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\l18.exe\[FSG] [L] Win32:Agent-CNF [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\m13.exe\[FSG] [L] Win32:OnLineGames-DQS [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\m23.exe\[FSG] [L] Win32:OnLineGames-DQS [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\m28.exe\[FSG] [L] Win32:OnLineGames-DAB [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\m6.exe\[FSG] [L] Win32:OnLineGames-DQS [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\n14.exe\[FSG] [L] Win32:OnLineGames-DQS [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\o15.exe\[FSG]\[Embedded#4000]\[Upack] [L] Win32:Agent-BQC [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\o24.exe\[FSG]\[Embedded#3000]\[Upack] [L] Win32:Agent-BQC [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\p21.exe\[FSG] [L] Win32:OnLineGames-DQS [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\r2.exe\[FSG] [L] Win32:OnLineGames-DQS [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\r7.exe\[FSG] [L] Win32:OnLineGames-DQS [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\t20.exe\[FSG]\[Embedded#3000]\[Upack] [L] Win32:Agent-BQC [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\u29.exe\[FSG]\[Embedded#3000]\[Upack] [L] Win32:Agent-BQC [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\u33.exe\[Upack]\[Embedded#06010] [L] Win32:Agent-LWQ [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\v27.exe\[FSG]\[Embedded#3000]\[Upack] [L] Win32:Agent-BQC [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\x22.exe\[FSG] [L] Win32:OnLineGames-DQS [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\x9.exe\[FSG] [L] Win32:OnLineGames-DJX [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\y5.exe\[Upack]\[Embedded#50c0]\[Upack] [L] Win32:OnLineGames-CYO [Trj] (0)
C:\Documents and Settings\Admin\Desktop\样本(35)\z12.exe\[FSG]\[Embedded#3000]\[Upack] [L] Win32:Agent-BQC [Trj] (0)
Infected files: 35
Total files: 114
Total folders: 1
Total size: 3.1 MB

*
* Task stopped: Thursday, May 29, 2008
* Run-time was 4 second(s)

The file 'r7.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/PSW.OnlineGames.aksn. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.04.109. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

The file 'j17.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/PSW.OnlineGames.aksa. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.04.109. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

tonger2003

这种网站都挂了马

TX真的悲哀啊