囧，又被挂了！

显示全部楼层 · 发表于 2008-10-30 20:14:55

现在挂马的网站满天飞，

吓死个人了！

挂马网址：
http://www3.upweb.net/index275-img/showlog.php?id=42842

RIS2009现在是强大了，决心买一套！

访问地址：http://www.google.com.97sose.cn/6666/06014.htm
访问网页的进程："C:\Program Files\TheWorld 2.0\TheWorld.exe"
漏洞对象名：scripting.filesystemobject

访问地址：http://www.google.com.97sose.cn/6666/cx.htm
访问网页的进程："C:\Program Files\TheWorld 2.0\TheWorld.exe"
病毒名称：Suspicious.Trojan-Downloader.Unescape.ShellCode.b

访问地址：http://www.google.com.97sose.cn/6666/cx.htm
访问网页的进程："C:\Program Files\TheWorld 2.0\TheWorld.exe"
病毒名称：Suspicious.Trojan-Downloader.Unescape.ShellCode.b

挂了什么给看看啊！

显示全部楼层 · 发表于 2008-10-30 20:19:45

要是抓住样本就好了。

显示全部楼层 · 发表于 2008-10-30 20:24:44

Malicious Web Site Blocked

You attempted to access:

http://www3.upweb.net/index275-img/showlog.php?id=42842

This is a known mailicious web site. It is recommended that you do NOT visit this site. The detailed report explains the security risks on this site.

For your protection, this web site has been blocked. Visit Symantec to learn more about phishing and internet security.

显示全部楼层 · 发表于 2008-10-30 20:26:11

挂马网址有马？

显示全部楼层 · 发表于 2008-10-30 20:53:33

explore.rar (38.33 KB, 下载次数: 123)

显示全部楼层 · 发表于 2008-10-30 21:03:57

显示全部楼层 · 发表于 2008-10-30 21:11:16

[发现安全风险： ] <W32/Agent.S.gen!Eldorado (not disinfectable, 普通)> C:\Test\explore.rar->explore.exe

---------------------------------------------------------------------
扫描已结束: 2008-10-30, 21:10:39
用时: 0:00:01

扫描结果:

已扫描的文件:    6
已感染的对象:    1
已清除的对象:    0
已隔离的文件:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-10-30 21:45:22

木马名称:Trojan.Win32.Generic.gl

程序:
C:\DOCUMENTS AND SETTINGS\LOLITA\LOCAL SETTINGS\TEMP\TEMPORARY INTERNET FILES\CONTENT.IE5\S76RIZID\EXPLORE[1].EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2008-10-30 21:47:34

在 C:\Documents and Settings\Administrator\桌面\explore.rar->explore.exe 中发现 Trojan-DDos.Agent.sl 病毒, 已删除

显示全部楼层 · 发表于 2008-10-30 22:26:17

Starting the file scan:

Begin scan in 'C:\Documents and Settings\***\桌面\explore.rar'
C:\Documents and Settings\***\桌面\explore.rar
[0] Archive type: RAR
--> explore.exe
   [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE]    A backup was created as '4979c443.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

[已鉴定] 囧，又被挂了！

F-Prot 4.4.4