6

sam.to

http://wasdbd.cn/a/1.htm

http://wasdbd.cn/a/2.htm

http://wasdbd.cn/a/3.htm

http://wasdbd.cn/a/4.htm

http://wasdbd.cn/a/5.htm

http://aaa.awercom.com/fzl.htm

zenwalk

内置(*)的过滤器匹配 — 移除带链接的图片，等等: //js.*.51.la*.js [http://wasdbd.cn/a/1.htm]
已阻止的「自动页面刷新」 [http://wasdbd.cn/a/1.htm]

palfan

这是从哪里复制下来的日志

试了第一个，这个I/O啊 我本本的硬盘呐，狂转啊

zenwalk

2008-6-9,9:10:45 [WARNING]  Suspicious file: Contains suspicious code HEUR/Crypted.E!
      [INFO] This reference is in all likelihood a false positive. Please send us this file for further analysis immediately.
  C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\K9MB4PMN\control_pic[1].jpg
      [INFO] No right to access the file.
2008-6-9,9:10:49 [WARNING]  Suspicious file: Contains suspicious code HEUR/Malware!
      [INFO] This reference is in all likelihood a false positive. Please send us this file for further analysis immediately.
  C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\K9MB4PMN\control_pic[1].jpg
      [INFO] The file will be copied to quarantine.
      [INFO] The file will be deleted.
2008-6-9,9:11:02 [WARNING] Contains suspicious code HEUR/HTML.Malware!
  C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\QFABO7WR\fzl[1].htm
      [INFO] The file will be copied to quarantine.
      [INFO] The file will be deleted.
2008-6-9,9:11:09 [WARNING] Contains detection pattern of the exploits EXP/Flash.Gen!
  C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MZOJ2XMZ\WIN%209,0,47,0i[1].swf
      [INFO] The file will be copied to quarantine.
      [INFO] The file will be deleted.

shery0000

1. 
   
2. http://aaa.awerbiz.cn/aaa.exe
   
3. http://www.hhsnbn.cn/control_pic.jpg
   

复制代码

[ 本帖最后由 shery0000 于 2008-6-9 10:44 编辑 ]

Palkia

C:\Documents and Settings\Administrator\桌面\2.rar>>aaa.exe        TrojanPSW.OnLineGames.wlu.kjdk        木马        还未处理
C:\Documents and Settings\Administrator\桌面\2.rar>>control_pic.jpg        TrojanPSW.OnLineGames.wlu.kjdk        木马        还未处理

挪威的冬天

金山毒霸 0

sbbdms

包括那6个网页一起打包，共8个

8.rar (52.87 KB, 下载次数: 29)

2008-6-9 14:46 上传

点击文件名下载附件

sbbdms

卡巴杀2漏6

已删除：木马程序 Trojan-PSW.Win32.OnLineGames.anxg        文件　: D:\软件\其它\v\k\8.rar/control_pic.jpg//PE_Patch//UPack//#//PE_Patch//UPack
已删除：木马程序 Trojan-PSW.Win32.OnLineGames.anxg        文件　: D:\软件\其它\v\k\8.rar/aaa.exe//PE_Patch//UPack//#//PE_Patch//UPack

TO KL

风野胤

原帖由 palfan 于 2008-6-9 04:46 发表
这是从哪里复制下来的日志

试了第一个，这个I/O啊 我本本的硬盘呐，狂转啊

明显是adm的日志。。。。。。