http://www.278.cc/

显示全部楼层 · 发表于 2008-12-4 11:55:55

Log is generated by FreShow.
[wide]http://www.278.cc/
[script]http://www.278.cc/templates/Slate/js/alternation.js
[script]http://www.278.cc/templates/Slate/js/picnews.js
[script]http://www.278.cc/templates/Slate/js/alternation-news.js
[script]http://www.278.cc/templates/Slate/js/fontzoom.js
      [script]http://www.54ax.cn/17aq/q.js
         [frame]http://kaixinba871a.com/d3/1.htm
            [frame]http://kaixinba871a.com/d3/14.htm
                  [object]http://longzaitian8899.com/xia/ll.exe
            [frame]http://kaixinba871a.com/d3/flash.htm
            [frame]http://kaixinba871a.com/d3/xx.htm
                  [object]http://longzaitian8899.com/xia/ll.exe
            [frame]http://kaixinba871a.com/d3/lz.htm
            [frame]http://kaixinba871a.com/d3/office.htm
            [frame]http://kaixinba871a.com/d3/real.htm
            [frame]http://kaixinba871a.com/d3/real.html
            [script]http://js.tongji.cn.yahoo.com/864283/ystat.js
[script]http://www.278.cc/templates/Slate/js/topads.js
[script]http://www.278.cc/batch.panels.php?rand=702606
[script]http://www.278.cc/include/js/slide.js
[script]http://www.278.cc/bbs/api/javascript.php?key=threads_top
[script]http://www.278.cc/bbs/api/javascript.php?key=threads_ixmeirong
[script]http://shop.278.cc/goods_script.php?cat_id=26&intro_type=is_new&need_image=true&goods_num=2&arrange=h&charset=GB2312&sitename=
[script]http://shop.278.cc/goods_script.php?cat_id=26&intro_type=is_best&need_image=true&goods_num=2&arrange=h&charset=GB2312&sitename=
[script]http://shop.278.cc/goods_script.php?cat_id=1&intro_type=is_best&need_image=true&goods_num=4&arrange=h&charset=GB2312&sitename=
[script]http://www.278.cc/bbs/api/javascript.php?key=threads_oeI
[script]http://js.users.51.la/1864946.js
[script]http://s139.cnzz.com/stat.php?id=961535&web_id=961535&show=pic1
[frame]http://www.278.cc/*.htm
[script]http://www.278.cc/batch.html.php?code=http%253A%252F%252Fwww.278.cc%252Findex.php%253Faction%252Fnews%2F1228361478%2F300%2F0%2F0%2Fnews&lastmodified=' + Modified.getTime() + '

显示全部楼层 · 发表于 2008-12-4 12:21:09

2008-12-04 12:21:29 加载库文件操作:阻止
进程路径:D:\Program Files\GreenBrowser\GreenBrowser.exe
文件路径:C:\Program Files\Common Files\System\msadc\msadco.dll
触发规则:所有程序规则->禁止加载的库文件->*\msadco.dll

显示全部楼层 · 发表于 2008-12-4 12:30:43

http://kaixinba871a.com/d3/real.html
http://kaixinba871a.com/d3/xx.htm
刚才操作失误没有解密
现在也解出来了，同一个
http://longzaitian8899.com/xia/ll.exe

显示全部楼层 · 发表于 2008-12-4 12:36:12

卡巴--Dropper

显示全部楼层 · 发表于 2008-12-4 13:10:51

杀

显示全部楼层 · 发表于 2008-12-4 13:20:25

红伞的强项。。。。

2008-12-4,13:18:17 [DETERMINE] Malware found.
      URL: http://kaixinba871a.com/d3/14.htm
      Contains HEUR/HTML.Malware suspicious code
2008-12-4,13:18:17 [DETERMINE] Malware found.
      URL: http://kaixinba871a.com/d3/xx.htm
      Contains HEUR/HTML.Malware suspicious code

[ 本帖最后由曲中求于 2008-12-4 13:21 编辑 ]

显示全部楼层 · 发表于 2008-12-4 13:32:51

Checking: http://longzaitian8899.com/xia/ll.exe
Engine version: 4.44.0.9170
File size: 34.39 KB

http://longzaitian8899.com/xia/ll.exe packed by FSG
>http://longzaitian8899.com/xia/ll.exe probably infected with DLOADER.Trojan

显示全部楼层 · 发表于 2008-12-4 16:50:57

费尔拦截

显示全部楼层 · 发表于 2008-12-4 20:38:43

McAfee ll.exe Downloader-BLE

显示全部楼层 · 发表于 2008-12-4 20:48:25

木马名称:Trojan-Dropper.Win32.Agent.vpn

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\LL.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

[已鉴定] http://www.278.cc/