故技重施：酷狗音乐首页再次挂马

will

详细分析见：http://hi.baidu.com/yimike/blog/item/4195a9023dcc92094bfb51aa.html

样本在此：

byx0210

晕 幸好我从来不用。

jimmyleo

占楼


不用酷狗 好多年。。。




G:\Security\Scan\V\bak.css : infected Win32.TrojanDownloader.Agent.OAD
G:\Security\Scan\V\max1.exe : infected Trojan-GameThief.Win32.OnLineGames.shss
G:\Security\Scan\V\max12.exe : infected Trojan-GameThief.Win32.OnLineGames.sjxn
G:\Security\Scan\V\max13.exe : infected Trojan-GameThief.Win32.OnLineGames.snda
G:\Security\Scan\V\max15.exe : infected Trojan-GameThief.Win32.OnLineGames.siyn
G:\Security\Scan\V\max17.exe : infected Trojan-PSW.Win32.OnlineGames
G:\Security\Scan\V\max2.exe : infected Trojan-PSW.Win32.OnlineGames
G:\Security\Scan\V\max21.exe : infected Trojan-PSW.Win32.OnlineGames
G:\Security\Scan\V\max26.exe : infected Trojan.Win32.Agent.wqk
G:\Security\Scan\V\max28.exe : infected Trojan.PWS.Wsgame.6437
G:\Security\Scan\V\max29.exe : infected Trojan-GameThief.Win32.OnLineGames.slxb
G:\Security\Scan\V\max30.exe : infected Trojan.Win32.Agent.sav
G:\Security\Scan\V\max31.exe : infected Trojan-GameThief.Win32.OnLineGames.shhw
G:\Security\Scan\V\max32.exe : infected Trojan-GameThief.Win32.OnLineGames.slmh
G:\Security\Scan\V\max33.exe : infected Trojan-GameThief.Win32.OnLineGames.shhw
G:\Security\Scan\V\max35.exe : infected Trojan-GameThief.Win32.OnLineGames.slzm
G:\Security\Scan\V\max4.exe : infected Trojan-GameThief.Win32.OnLineGames.siyn
G:\Security\Scan\V\max5.exe : infected Trojan-PSW.Win32.OnlineGames
G:\Security\Scan\V\max7.exe : infected Trojan-PSW.Win32.OnLineGames.ryhe


19

[ 本帖最后由 jimmyleo 于 2008-8-4 17:22 编辑 ]

hljdqzr

卡巴8 报了

solar

avast! 没等文件存入磁盘

飞雪幻天

漏了一个max35.exe


不好意思，更新病毒库后杀了

[ 本帖最后由 飞雪幻天 于 2008-8-4 17:26 编辑 ]

冷冷

怎么我平时用也没反应？

will

为什么每次我用的时候都发现挂马…  

shuixinghuo

驱逐舰终于让我安慰了，哈哈哈哈。轻松杀！


刚发现，漏了几个，上报

[ 本帖最后由 shuixinghuo 于 2008-8-4 17:32 编辑 ]

jimmyleo

G:\Security\Scan\V\bak.css infected with Trojan.DownLoad.1124
G:\Security\Scan\V\max1.exe infected with Trojan.PWS.Gamania.12824
G:\Security\Scan\V\max11.exe infected with Trojan.PWS.Gamania.origin
G:\Security\Scan\V\max12.exe infected with Trojan.MulDrop.18152
G:\Security\Scan\V\max14.exe infected with Trojan.PWS.Gamania.origin
G:\Security\Scan\V\max15.exe infected with Trojan.PWS.Gamania.12822
G:\Security\Scan\V\max16.exe infected with Trojan.PWS.Gamania.origin
G:\Security\Scan\V\max17.exe infected with Trojan.PWS.Gamania.11721
G:\Security\Scan\V\max18.exe infected with Trojan.PWS.Gamania.origin
G:\Security\Scan\V\max19.exe infected with Trojan.PWS.Gamania.origin
G:\Security\Scan\V\max2.exe infected with Trojan.PWS.Gamania.12006
G:\Security\Scan\V\max20.exe infected with Trojan.PWS.Gamania.origin
G:\Security\Scan\V\max21.exe infected with Trojan.PWS.Gamania.12006
G:\Security\Scan\V\max22.exe infected with Trojan.PWS.Gamania.12839
G:\Security\Scan\V\max23.exe infected with Trojan.PWS.Gamania.origin
G:\Security\Scan\V\max25.exe infected with Trojan.PWS.Wsgame.origin
G:\Security\Scan\V\max26.exe infected with Trojan.PWS.Wsgame.origin
G:\Security\Scan\V\max27.exe infected with Trojan.PWS.Wsgame.origin
G:\Security\Scan\V\max28.exe infected with Trojan.PWS.Wsgame.6437
G:\Security\Scan\V\max29.exe infected with Trojan.MulDrop.18199
G:\Security\Scan\V\max3.exe infected with Trojan.PWS.Gamania.origin
G:\Security\Scan\V\max30.exe infected with Trojan.PWS.Wsgame.6439
G:\Security\Scan\V\max31.exe infected with BackDoor.Zapinit.31
G:\Security\Scan\V\max32.exe infected with Trojan.PWS.Wsgame.6472
G:\Security\Scan\V\max33.exe infected with BackDoor.Zapinit.31
G:\Security\Scan\V\max34.exe infected with Trojan.PWS.Wsgame.origin
G:\Security\Scan\V\max34.exe infected with Trojan.PWS.Wsgame.6827
G:\Security\Scan\V\max35.exe infected with Trojan.MulDrop.18189
G:\Security\Scan\V\max4.exe infected with Trojan.PWS.Gamania.12822
G:\Security\Scan\V\max5.exe infected with Trojan.PWS.Gamania.12031
G:\Security\Scan\V\max6.exe infected with Trojan.MulDrop.18187
G:\Security\Scan\V\max7.exe infected with Trojan.MulDrop.18151
G:\Security\Scan\V\max8.exe infected with Trojan.PWS.Gamania.12839
G:\Security\Scan\V\max9.exe infected with Trojan.PWS.Gamania.origin


33
少了个13