http://www.in9.cn/index.php（999宝藏网 --专注操作系统）

显示全部楼层 · 发表于 2008-6-20 20:22:51

Log is generated by FreShow.
[wide]http://www.in9.cn/index.php
[script]http://www.in9.cn/js/global.js
      [script]http://www.in9.cn/js/pw_tagdata.js
         [frame]http://www.aeroxr.cn/xu.html
            [frame]http://www.aeroxr.cn/as.html
                  [object]http://www.tygvb.cn/4562.swf
                  [object]http://www.tygvb.cn/4561.swf
                  [frame]http://www.flashj.com.cn/lg.html
                     [object]http://www.flashj.com.cn/Baidu.cab
                     [frame]http://www.flashj.com.cn/1.html
                        [object]http://www.bnhkm.cn/google.exe
                     [frame]http://www.flashj.com.cn/l.html
                        [object]http://www.bnhkm.cn/google.exe
                     [frame]http://www.flashj.com.cn/bf.html
                        [object]http://www.bnhkm.cn/google.exe
                     [frame]http://www.flashj.com.cn/r.html
                        [object]http://www.bnhkm.cn/google.exe
                     [frame]http://www.flashj.com.cn/nr.html
                        [object]http://www.bnhkm.cn/google.exe
            [script]http://js.users.51.la/1902390.js
         [script]http://play.unionsky.cn/show/?placeID=51436
[script]http://www.in9.cn/js/Deploy.js
[script]http://www.in9.cn/js/pw_ajax.js
[script]http://www.in9.cn/js/popup.js
[script]http://js.tongji.cn.yahoo.com/261365/ystat.js
      [script]http://js.tongji.cn.yahoo.com/261365/

下载地址：

http://www.tygvb.cn/4561.swf

http://www.tygvb.cn/4562.swf

http://www.flashj.com.cn/Baidu.cab

http://www.bnhkm.cn/google.exe

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.AntiAV.aj

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.49.42

显示全部楼层 · 发表于 2008-6-20 20:37:13

已删除google.exe Generic Downloader.z (特洛伊)
已删除baidu.exe Generic Downloader.z (特洛伊)

显示全部楼层 · 发表于 2008-6-20 20:40:47

将相关网页和程序打包，共11个

显示全部楼层 · 发表于 2008-6-20 20:41:16

卡巴杀2漏9

已删除：病毒 Worm.Win32.Downloader.pu 文件　: D:\软件\其它\v\k\wangma2.rar/google.exe//PE_Patch//UPack
已删除：病毒 Worm.Win32.Downloader.pu 文件　: D:\软件\其它\v\k\wangma2.rar/Baidu.cab/baidu.exe//PE_Patch//UPack

TO KL

显示全部楼层 · 发表于 2008-6-20 20:42:55

显示全部楼层 · 发表于 2008-6-20 23:06:31

Begin scan in 'C:\Documents and Settings\Administrator\桌面\新資料夾 (2)'
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\1.html
   [DETECTION] Contains suspicious code HEUR/HTML.Malware
   [NOTE]    The fund was classified as suspicious.
   [NOTE]    A backup was created as '48c3c75f.qua'  ( QUARANTINE )
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\as.html
   [DETECTION] Contains suspicious code HEUR/HTML.Malware
   [NOTE]    The fund was classified as suspicious.
   [NOTE]    A backup was created as '4889c7a4.qua'  ( QUARANTINE )
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\Baidu.cab
  [0] Archive type: CAB (Microsoft)
--> baidu.exe
      [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    A backup was created as '48c4c792.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\google.exe
   [DETECTION] Is the Trojan horse TR/Hijacker.Gen
   [NOTE]    A backup was created as '48cac7a0.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\l.html
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Dldr.Agent.GC
   [NOTE]    A backup was created as '4944bac0.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\lg.html
   [DETECTION] Contains suspicious code HEUR/HTML.Malware
   [NOTE]    The fund was classified as suspicious.
   [NOTE]    A backup was created as '4889c798.qua'  ( QUARANTINE )
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\nr.html
   [DETECTION] Contains suspicious code HEUR/HTML.Malware
   [NOTE]    The fund was classified as suspicious.
   [NOTE]    A backup was created as '4889c7a3.qua'  ( QUARANTINE )
C:\Documents and Settings\Administrator\桌面\新資料夾 (2)\r.html
   [DETECTION] Contains detection pattern of the exploits EXP/RealPlay.H
   [NOTE]    A backup was created as '48c3c761.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!

End of the scan: 2008年6月20日  23:05
Used time: 00:02 min

The scan has been done completely.

   1 Scanning directories
   12 Files were scanned
   4 viruses and/or unwanted programs were found
   4 Files were classified as suspicious:
   4 files were deleted
   0 files were repaired
   8 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   8 Files not concerned
   1 Archives were scanned
   0 Warnings
   8 Notes
Sent to Avira

显示全部楼层 · 发表于 2008-6-20 23:08:13

F:\virus.rar>>Baidu.cab>>baidu.exe TrojanDownloader.Nurech.bd.bmqk 木马
F:\virus.rar>>google.exe TrojanDownloader.Nurech.bd.bmqk 木马

显示全部楼层 · 发表于 2008-6-21 08:24:11

两个

显示全部楼层 · 发表于 2008-6-21 08:30:37

C:\Documents and Settings\Administrator\桌面\virus\1.html Script.HttpDownloader.i 病毒还未处理
C:\Documents and Settings\Administrator\桌面\virus\4562.swf Exploit.SWF.Downloader.ci.gen 木马还未处理
C:\Documents and Settings\Administrator\桌面\virus\Baidu.cab>>baidu.exe TrojanDownloader.Nurech.bd.bmqk 木马还未处理
C:\Documents and Settings\Administrator\桌面\virus\google.exe TrojanDownloader.Nurech.bd.bmqk 木马还未处理
C:\Documents and Settings\Administrator\桌面\virus\lg.html JS.Decoder.v 病毒还未处理

[病毒样本] http://www.in9.cn/index.php（999宝藏网 --专注操作系统）

本帖子中包含更多资源

mcafee

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

5