PCSL 可疑恶意网站每日分析 20081115

显示全部楼层 · 发表于 2008-11-14 22:41:13

http://msaknust.com/images/menu.jpg (C:\Windows\BitDefender.exe)
http://www.comprafacilsac.com/r1.exe
https://www.box.net/shared/static/kiur88kidh.exe
http://www.playitontheweb.com/01/img/amigo.exe
http://www.cobrancasweb.com/imagens/imagem.jpg
http://www.cobrancasweb.com/imagens/imagem1.jpg
http://www.oiuytre.net/down/ko.exe
http://www.mensagemevangelica.com.br/download/biblia_digital.exe
http://server.microlite20.com/~admin271/ldr.exe
http://www.staffcop.com/download/staffcop.exe
http://77.93.75.148/img/cntr.dll?sid=D8545F5A4F080F0F000D54585C59595D5D4F1F545B365C365836085B51363A0C1B1F000A0C4939080A02495B4F0A000D545D282F582F5C2C2B5E585B285D50285D502F2B5128582C5E5D5E2A585A5F5C2C4F081D54502A285A515C5959505F2C5B58582D2D50505D50585C59595D5D282A2F2F2F2F4F1E1D545E505D5B5C0C5B5E59584F0B00545A5B594F04061B1901000D54001B185D4F1B0C1F000D54505D5C5D69B101
http://77.93.75.148/img/cntr.dll?sid=6E545F5A4F080F0F000D54585F5F5A51514F1F545B365C365836085B51363A0C1B1F000A0C4939080A02495A4F0A000D545C2F2B5C502B5150595E5E2B5D2B59502B5A2C282B5F50582B2D585E5E502F5C4F081D545D5C592A2F2A5A59505E5A2D58582D2D50585F59585F5F5A5151282A2F2F2F2F4F1E1D545D5D0B5E5C0C5B5E59584F0B00545A5B594F04061B1901000D54001B185D4F1B0C1F000D54505D5B5F690701
http://77.93.75.148/img/cntr.dll?sid=E0545F5A4F080F0F000D54585F5F5A51514F1F545B365C365836085B51363A0C1B1F000A0C4939080A02495A4F0A000D545E5D502C505C5C5E595B2D285D2F5E2D282A2B5B2D502B2B2F515F2A2F582B504F081D542C2F2F5D2C2F5B5F505F2D2F58582D2D2B5E2C2A585F5F5A5151282A2F2F2F2F4F1E1D54510A0B0B5C0C5B5E59584F0B00545A5B594F04061B1901000D54001B185D4F1B0C1F000D54505D5B5F698901
http://85.17.166.232/form/index.dll?setid=irq4&affid=164573&uid=F12497C0820D11DD9EE5164573CFFFFF&rid=zdez&guid=3B2EA59765304A519BF58B34667106AA
http://85.17.166.232/form/index.dll?setid=an2g&affid=166350&uid=B6D91FFC927D11DD85CB166350CFFFFF&rid=gl2vmclr&guid=251CCB529BF24D359ABDF4494AE0949E
http://85.17.166.232/form/index.dll?setid=irq4&affid=150044&uid=13B8E62A758811DD84E5150044CFFFFF&rid=zdez&guid=605760C6C2F54BBF8701D02E80E28BEC
http://scanner.rapid-antivirus.com/setup/install_4746_NnwzNnwxMDIwMDAwMDAwfHx8fHx8fHw_.exe
http://iabestscan.com/common/destrub.js

复制代码

显示全部楼层 · 发表于 2008-11-14 22:57:18

http://www.mensagemevangelica.com.br/download/biblia_digital.exe  3.33m
http://www.staffcop.com/download/staffcop.exe  4.01m
http://msaknust.com/images/menu.jpg  6.53m

[ 本帖最后由 tvuser2007 于 2008-11-14 23:01 编辑 ]

显示全部楼层 · 发表于 2008-11-14 23:02:50

已删除：木马程序 Trojan.Win32.Monder.gen 文件: C:\Documents and Settings\Administrator\桌面\桌面.rar/cntr.dll
已删除：木马程序 Trojan.Win32.Runner.bv 文件: C:\Documents and Settings\Administrator\桌面\桌面.rar/ko.exe//UPX
已删除：新威胁 not-a-virus:FraudTool.Win32.PowerAntivirus2009.bi 文件: C:\Documents and Settings\Administrator\桌面\桌面.rar/install_4746_NnwzNnwxMDIwMDAwMDAwfHx8fHx8fHw_.exe//stream//data0001

显示全部楼层 · 发表于 2008-11-15 01:01:57

紅傘2/10
其餘上報

显示全部楼层 · 发表于 2008-11-15 09:09:20

D:\Users\ekincheng\Desktop\桌面.rar » RAR » cntr.dll - Win32/Adware.Virtumonde.FP application
D:\Users\ekincheng\Desktop\桌面.rar » RAR » ko.exe - probably a variant of Win32/Genetik trojan
D:\Users\ekincheng\Desktop\桌面.rar » RAR » install_4746_NnwzNnwxMDIwMDAwMDAwfHx8fHx8fHw_.exe » NSIS » 龐

[已鉴定] PCSL 可疑恶意网站每日分析 20081115

to kl