先锋网被插入恶意代码

显示全部楼层 · 发表于 2008-6-1 18:29:46

来源：自己刚才浏览时发现的

Log is generated by FreShow.
[wide]http://www.pcpchina.com/
[frame]http://fackyou1.3322.org/cn10.htm
      [frame]http://dsajk2.cn/xi/dj.htm
         [frame]http://dsajk2.cn/xi/14.htm
            [object]http://60.190.118.85/9/ck.exe
         [frame]http://dsajk2.cn/xi/rl.htm
            [object]http://60.190.118.85/9/ck.exe
         [frame]http://dsajk2.cn/xi/new.htm
            [object]http://60.190.118.85/9/ck.exe
         [frame]http://dsajk2.cn/xi/lz.htm
            [object]http://60.190.118.85/9/ck.exe
      [frame]http://dsajk2.cn/xi/xx.htm
                  [object]http://msi7ka.cn/9/ad01.swf
                  [object]http://msi7ka.cn/9/ad02.swf

Avira
Begin scan in 'C:\Documents and Settings\wangjian\桌面\桌面.rar'
C:\Documents and Settings\wangjian\桌面\桌面.rar
  [0] Archive type: RAR
--> ad01.swf
   [1] Archive type: SWC
   --> Object
      [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
--> ad02.swf
   [1] Archive type: SWC
   --> Object
      [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
   [WARNING] The file was ignored!

显示全部楼层 · 发表于 2008-6-1 18:30:44

卡巴杀1

已删除：木马程序 Trojan-Downloader.Win32.Agent.rjq 文件　: D:\软件\其它\v\k\桌面.rar/ck.exe//PE_Patch//UPack//#

TO KL

Hello.
No malicious software was found in the attached file.

Please quote all when answering. Do not forget to include you registration data.
-----------------
Regards, Vyacheslav Zakorzhevsky
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

> Attachment: ??.rar

[ 本帖最后由 sbbdms 于 2008-6-5 23:41 编辑 ]

显示全部楼层 · 发表于 2008-6-1 18:30:59

Begin scan in 'C:\Documents and Settings\haha\桌面\桌面.rar'
C:\Documents and Settings\haha\桌面\桌面.rar
  [0] Archive type: RAR
--> ad01.swf
   [1] Archive type: SWC
   --> Object
      [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
--> ad02.swf
   [1] Archive type: SWC
   --> Object
      [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
   [NOTE]    A backup was created as '487111b9.qua'  ( QUARANTINE )

显示全部楼层 · 发表于 2008-6-1 18:37:32

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL: http://60.190.118.85/9/ck.exe
Information: Is the Trojan horse TR/Downloader.Gen

显示全部楼层 · 发表于 2008-6-1 19:11:56

C:\Documents and Settings\Administrator\桌面\桌面.rar>>ck.exe Heuri.Suspicious.ERNM 启发式扫描还未处理

木马名称:Trojan.Win32.Genetik.ipj
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\RAR$EX00.562\CK.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2008-6-1 19:14:00

ad01.swf 1.47/1.47KB 100.00% 在线扫描没有发现病毒，但这并不能说明此文件百分之百可信。2008-6-1 19:13:38 2008-6-1 19:13:47
ad02.swf 1.47/1.47KB 100.00% 在线扫描没有发现病毒，但这并不能说明此文件百分之百可信。2008-6-1 19:13:45 2008-6-1 19:13:56

显示全部楼层 · 发表于 2008-6-1 19:21:03

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Hack.Exploit.Swf.a

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.46.62

显示全部楼层 · 发表于 2008-6-1 21:09:09

flash病毒真的是开始泛滥了

显示全部楼层 · 发表于 2008-6-1 21:09:49

对象: ck.exe
在压缩档案里: F:\virus\桌面.rar
Status: 已发现病毒
病毒: Trojan.Crypt.DJ (BD 引擎)

显示全部楼层 · 发表于 2008-6-1 21:23:13

McAfee ck.exe New Malware.aj

[已鉴定] 先锋网被插入恶意代码

5/2