PCSL 可疑恶意网站每日分析 20080918

显示全部楼层 · 发表于 2008-9-18 18:36:09

91.121.138.222
http://91.121.138.222/~warman24/Setup_ver1.1706.0.exe
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
allinonespy.com
http://www.allinonespy.com/all-in-one-spy.exe
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.ppexe.com/
http://www.ppexe.com/comine/2.exe
http://www.ppexe.com/comine/mfrj.exe
http://www.ppexe.com/comine/dwbins.exe
http://www.ppexe.com/comine/wowoaa.exe
http://www.ppexe.com/comine/mf.exe
http://www.ppexe.com/comine/ffxi369.exe
http://www.ppexe.com/new/1.exe
http://www.ppexe.com/comine/mf.exe
http://www.ppexe.com/comine/db820.exe

复制代码

以上信息仅供研究使用！

显示全部楼层 · 发表于 2008-9-18 19:02:27

2008/9/18 19:00:35 已清除木马程序 Trojan-GameThief.Win32.WOW.bpl G:\Temp\Temp.rar/wowoaa.exe
2008/9/18 19:00:35 已清除木马程序 Trojan-GameThief.Win32.WOW.bxo G:\Temp\Temp.rar/mfrj.exe//PE_Patch.UPX//UPX
2008/9/18 19:00:35 已清除木马程序 Trojan-GameThief.Win32.WOW.byh G:\Temp\Temp.rar/mf.exe//PE_Patch.UPX//UPX
2008/9/18 19:00:35 已清除木马程序 Trojan-GameThief.Win32.OnLineGames.sxzm G:\Temp\Temp.rar/ffxi369.exe
2008/9/18 19:00:35 已清除木马程序 Trojan-Downloader.Win32.Delf.gff G:\Temp\Temp.rar/dwbins.exe
2008/9/18 19:00:35 已清除木马程序 Trojan-Downloader.Win32.Delf.mfy G:\Temp\Temp.rar/db820.exe
2008/9/18 19:00:35 已清除木马程序 Trojan-Downloader.Win32.Zlob.zhw G:\Temp\Temp.rar/Setup_ver1.1706.0.exe
2008/9/18 19:00:35 已清除木马程序 Trojan-GameThief.Win32.OnLineGames.tdqb G:\Temp\Temp.rar/2.exe
2008/9/18 19:00:35 已清除木马程序 Trojan-GameThief.Win32.WOW.bvw G:\Temp\Temp.rar/1.exe//MPRESS
2008/9/18 19:00:35 已清除木马程序 Trojan-Downloader.Win32.Delf.gff G:\Temp\Temp.rar

all-in-one-spy.exe To KL

AhnLab-V3	2008.9.13.0	2008.09.18	-
AntiVir	7.8.1.28	2008.09.18	TR/Keylog.2893483
Authentium	5.1.0.4	2008.09.18	-
Avast	4.8.1195.0	2008.09.17	Win32:Trojan-gen {Other}
AVG	8.0.0.161	2008.09.17	-
BitDefender	7.2	2008.09.18	-
CAT-QuickHeal	9.50	2008.09.17	-
ClamAV	0.93.1	2008.09.18	-
DrWeb	4.44.0.09170	2008.09.18	-
eSafe	7.0.17.0	2008.09.17	Spyware.Gen
eTrust-Vet	31.6.6091	2008.09.16	-
Ewido	4.0	2008.09.18	-
F-Prot	4.4.4.56	2008.09.18	-
F-Secure	8.0.14332.0	2008.09.18	-
Fortinet	3.113.0.0	2008.09.18	Keylog/AllinOne
GData	19	2008.09.18	Win32:Spyware-gen
Ikarus	T3.1.1.34.0	2008.09.18	Virus.Win32.Spyware
K7AntiVirus	7.10.460	2008.09.17	-
Kaspersky	7.0.0.125	2008.09.18	-
McAfee	5386	2008.09.17	potentially unwanted program Keylog-AllinOne
Microsoft	1.3903	2008.09.18	-
NOD32v2	3451	2008.09.18	Win32/Spy.AllInOne
Norman	5.80.02	2008.09.17	-
Panda	9.0.0.4	2008.09.18	Trj/Agent.DIL
PCTools	4.4.2.0	2008.09.17	-
Prevx1	V2	2008.09.18	Malicious Software
Rising	20.62.32.00	2008.09.18	-
Sophos	4.33.0	2008.09.18	-
Sunbelt	3.1.1645.1	2008.09.17	All-In-One Spy
Symantec	10	2008.09.18	Spyware.AllInOne
TheHacker	6.3.0.9.086	2008.09.18	-
TrendMicro	8.700.0.1004	2008.09.18	-
VBA32	3.12.8.5	2008.09.17	-
ViRobot	2008.9.18.1381	2008.09.18	-
VirusBuster	4.5.11.0	2008.09.17	-
Webwasher-Gateway	6.6.2	2008.09.18	Trojan.Keylog.2893483

显示全部楼层 · 发表于 2008-9-18 19:06:50

病毒 2008-09-18  19:06:33 C:\Documents and Settings\Administrator\桌面\vir\wowoaa.exe Win32.PSWTroj.OnlineGames.wo.65536 清除成功
病毒 2008-09-18  19:06:33 C:\Documents and Settings\Administrator\桌面\vir\mfrj.exe Win32.PSWTroj.WOW.123972 清除成功
病毒 2008-09-18  19:06:33 C:\Documents and Settings\Administrator\桌面\vir\mf.exe Win32.PSWTroj.WOW.128068 清除成功
病毒 2008-09-18  19:06:33 C:\Documents and Settings\Administrator\桌面\vir\ffxi369.exe Win32.PSWTroj.OnLineGames.14848 清除成功
病毒 2008-09-18  19:06:32 C:\Documents and Settings\Administrator\桌面\vir\db820.exe Win32.TrojDownloader.Delf.63488 清除成功
病毒 2008-09-18  19:06:32 C:\Documents and Settings\Administrator\桌面\vir\1.exe Win32.PSWTroj.WOW.32324 清除成功

显示全部楼层 · 发表于 2008-9-18 19:34:11

难道是 fraud SPY

还带帮助文件

显示全部楼层 · 发表于 2008-9-18 20:02:24

Hello.
No malicious software was found in the attached file.

Please quote all when answering. Do not forget to include you registration data.
-----------------
Regards, Maslennikov Denis
Virus Analyst, Kaspersky Lab.

Ph.: +7(495) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com http://www.viruslist.com

> Attachment: vir.rar

>
>

> RyH

显示全部楼层 · 发表于 2008-9-18 20:14:02

1.3.NIS无反应

2.无法访问??

显示全部楼层 · 发表于 2008-9-18 20:15:38

无敌特征码:avast Win32:Trojan-gen {Other}
Prevx1 Malicious Software

显示全部楼层 · 发表于 2008-9-18 20:27:18

看来是真的an-SPY

显示全部楼层 · 发表于 2008-9-18 20:39:03

确实如此

[已鉴定] PCSL 可疑恶意网站每日分析 20080918

回复 5楼尤金卡巴斯基的帖子

回复 8楼 wangjay1980 的帖子

[已鉴定] PCSL 可疑恶意网站每日分析 20080918

回复 5楼 尤金卡巴斯基 的帖子

回复 8楼 wangjay1980 的帖子

回复 5楼尤金卡巴斯基的帖子