一个网址,我的诺顿2009报~

sanhu35

很眼熟啊

xi889

Hello,

1.exe_ - Worm.Win32.AutoRun.qxz

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Sergey Prokudin
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: 1.rar

>
>   pe]

[ 本帖最后由 xi889 于 2008-10-20 14:21 编辑 ]

tigerllhc

由firefox拦截

sytd2368

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL:  http://www.151av.com/
Information:  Contains recognition pattern of the HTML/Downloader.Gen HTML script virus  


--------------------------------------------------------------------------------
Generated by AntiVir WebGuard 8.0.15.0, AVE 8.2.0.5, VDF 7.0.7.61

sam.to

原帖由 tanlimo 于 2008-10-20 11:48 发表
http://cccaaass.cn/1.exe
http://cccaaass.cn/2.exe
......

http://cccaaass.cn/20.exe

放上來
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\1.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\10.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\11.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\12.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\13.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\14.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\15.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\16.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\17.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\18.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\19.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\2.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\20.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\3.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\4.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\5.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\6.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\7.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\8.exe#//PE_Patch//UPack
已刪除: 病毒 Worm.Win32.AutoRun.qxz        檔案: C:\Documents and Settings\kato9096\桌面\85\9.exe#//PE_Patch//UPack
卡巴清空

雨宫优子

没多大新意
关于:hxxp://cccaaass.cn/9/123.htm解密的日志(全体输出-  18):

Level 0>http://cccaaass.cn/9/123.htm
Level 1>http://cccaaass.cn/9/fx.htm
Level 1>http://cccaaass.cn/9/ss.htm
Level 2>http://ddddsds.cn/1.exe
Level 1>http://cccaaass.cn/9/lz.htm
Level 2>http://ddddsds.cn/1.exe
Level 1>http://cccaaass.cn/9/nctaudiofile.htm
Level 1>http://cccaaass.cn/9/ms06014.htm
Level 1>http://cccaaass.cn/9/sina.htm
Level 1>http://cccaaass.cn/9/office.htm
Level 1>http://cccaaass.cn/9/thunder.htm
Level 2>http://ddddsds.cn/1.exe
Level 1>http://cccaaass.cn/9/glworld.htm
Level 2>http://ddddsds.cn/1.exe
Level 1>http://cccaaass.cn/9/re10.htm
Level 2>http://ddddsds.cn/1.exe
Level 1>http://cccaaass.cn/9/re11.htm
Level 2>http://ddddsds.cn/1.exe
1~20还是我和没注册猜出来的呢，版权必究..

tanlimo

你们猜的是http://hhhhhttt.cn/1.exe~20.exe我猜的是http://cccaaass.cn/1.exe~20.exe

所以没有侵犯版权

[ 本帖最后由 tanlimo 于 2008-10-20 23:05 编辑 ]

star_xing

2008-10-20 23:04:20        HTTP 过滤器        文件        http://ddddsds.cn/1.exe        Win32/AutoRun.Delf.I 蠕虫 的变种        连接中断 - 已隔离        75443A4376A148A\Administrator        通过应用程序访问 web 时检测到威胁: C:\Program Files\Internet Explorer\IEXPLORE.EXE.

leonfg

ESET 1+20 全：
C:\Documents and Settings\GUNDAM\桌面\wab.rar » RAR » wab.exe - a variant of Win32/AutoRun.Delf.I worm


C:\Documents and Settings\GUNDAM\桌面\85\85\1.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\10.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\11.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\12.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\13.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\14.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\15.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\16.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\17.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\18.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\19.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\2.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\20.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\3.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\4.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\5.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\6.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\7.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\8.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined
C:\Documents and Settings\GUNDAM\桌面\85\85\9.exe# - a variant of Win32/AutoRun.Delf.I worm - cleaned by deleting - quarantined

雨宫优子

网址指向是一样的..

Pinging cccaaass.cn [121.14.156.59] with 32 bytes of

Reply from 121.14.156.59: bytes=32 time=20ms TTL=118
Reply from 121.14.156.59: bytes=32 time=20ms TTL=118
Reply from 121.14.156.59: bytes=32 time=20ms TTL=118
Reply from 121.14.156.59: bytes=32 time=20ms TTL=118

Ping statistics for 121.14.156.59:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% lo
Approximate round trip times in milli-seconds:
    Minimum = 20ms, Maximum = 20ms, Average = 20ms

Pinging hhhhhttt.cn [121.14.156.59] with 32 bytes of

Reply from 121.14.156.59: bytes=32 time=20ms TTL=118
Reply from 121.14.156.59: bytes=32 time=20ms TTL=118
Reply from 121.14.156.59: bytes=32 time=20ms TTL=118
Reply from 121.14.156.59: bytes=32 time=20ms TTL=118

Ping statistics for 121.14.156.59:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% lo
Approximate round trip times in milli-seconds:
    Minimum = 20ms, Maximum = 20ms, Average = 20ms
所以还是侵犯了版权