http://www.emsos.com.cnE搜礼品

shadowmin

Log is generated by FreShow.
[wide]http://www.emsos.com.cn/class.asp?lx=big&anid=64&Page=2
    [script]http://csson.ch.ma/css.js?width=700&height=600&keyword=uf556
    [script]http://csson.ch.ma/css.js?width=700&height=600&keyword=uf556
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://pes.mv121.cn/muc.js
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
    [script]http://webpresence.qq.com/getonline?Type=1&870879435:447244835:
    [script]http://pes.mv121.cn/muc.js
        [frame]http://www.ppppj.com.cn/vv/mm01.htm
            [frame]http://www.ppppj.com.cn/vv/index.htm
                [frame]http://www.ppppj.com.cn/vv/yy.htm
                    [script]http://www.ppppj.com.cn/vv/14.js
                        [object]http://www.ppppj.com.cn/www.exe
                [frame]http://www.ppppj.com.cn/vv/flash.htm
                [frame]http://www.ppppj.com.cn/vv/qb.htm
                [frame]http://www.ppppj.com.cn/vv/ippp.htm
                [frame]http://www.ppppj.com.cn/vv/ip.htm
                    [frame]http://www.ppppj.com.cn/vv/bf.htm
                        [script]http://www.ppppj.com.cn/vv/bf.js
                            [object]http://www.ppppj.com.cn/www.exe
                [frame]http://www.ppppj.com.cn/vv/02.htm
                [frame]http://www.ppppj.com.cn/vv/lz.htm
                [frame]http://www.ppppj.com.cn/vv/office.htm
            [script]http://s34.cnzz.com/stat.php?id=1376942&web_id=1376942
    [script]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/mx.js
        [script]http://js.users.51.la/2819645.js
        [frame]http://%77%77%77%2E%74%6C%74%6C%62%61%2E%63%6E/http:\/\/wr.kug78.cn\/1\/05\/index.htm?8
            [frame]http://wr.kug78.cn/1/05/index2.htm
                [frame]http://wr.kug78.cn/1/05/ccqm.htm
                [script]http://wr.kug78.cn/1/05/js.css
                    [frame]http://wr.kug78.cn/1/05/hk14.htm
                        [script]http://wr.kug78.cn/1/05/14.css
                            [object]http://f1.hf3y5.com/1/AcX.exe'
                        [script]http://wr.kug78.cn/1/05/15.css
                        [script]http://wr.kug78.cn/1/05/16.css
                    [frame]http://wr.kug78.cn/1/05/hkfl.htm
                    [frame]http://wr.kug78.cn/1/05/hkvod.htm
                        [script]http://wr.kug78.cn/1/05/ccvod.css
                            [object]http://f1.hf3y5.com/1/AcX.exe'
                        [script]http://wr.kug78.cn/1/05/b.css
                        [script]http://wr.kug78.cn/1/05/d.css
                    [frame]http://wr.kug78.cn/1/05/hkbb.htm
                    [frame]http://wr.kug78.cn/1/05/hkzzx.htm
                    [frame]http://wr.kug78.cn/1/05/hkff.htm
                    [frame]http://wr.kug78.cn/1/05/hk122121.htm
            [script]http://js.tongji.cn.yahoo.com/1026831/ystat.js
            [script]http://count7.51much.com/cnt.php?uid=UA-1-12321&style=text&text=网站统计

328397663

原帖由 shadowmin 于 2009-5-8 16:44 发表
Log is generated by FreShow.
[wide]http://www.emsos.com.cn/class.asp?lx=big&anid=64&Page=2
    [script]http://csson.ch.ma/css.js?width=700&height=600&keyword=uf556
    [script]http://csson.ch.ma/cs ...

exe

mofunzone

ile:	www.exe
Status:	INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5:	fa21a6497b5e92b12d408f793e6b2d8c
Packers detected:	UPACK
Scanner results
Scan taken on 08 May 2009 08:45:35 (GMT)
A-Squared	Found Trojan-Spy.Win32.Banker!IK
AntiVir	Found WORM/Rbot.Gen
ArcaVir	Found nothing
Avast	Found Win32:Rootkit-gen
AVG Antivirus	Found Worm/Generic.ZIU
BitDefender	Found Trojan.Crypt.Delf.C
ClamAV	Found Trojan.W32.Cyn.23-3
CPsecure	Found BackDoor.W32.Cyn.20
Dr.Web	Found Trojan.MulDrop.30863
F-Prot Antivirus	Found W32/Heuristic-210A!Eldorado (probable variant)
F-Secure Anti-Virus	Found nothing
Ikarus	Found Trojan-Spy.Win32.Banker
Kaspersky Anti-Virus	Found nothing
NOD32	Found a variant of Win32/AutoRun.ADC
Norman Virus Control	Found W32/Packed_Upack.H
Panda Antivirus	Found W32/AutoRun.DJ.worm
Quick Heal	Found Win32.VirTool.DelfInject.gen!X.2
Sophos Antivirus	Found Mal/EncPk-BW, Mal/Autorun-F
VirusBuster	Found Packed/Upack
VBA32	Found MalwareScope.Trojan-PSW.Game.7

File:	AcX.exe
Status:	INFECTED/MALWARE
MD5:	019463ceb381cc617248865aceb16e37
Packers detected:	PE_PATCH.UPX, UPX
Scanner results
Scan taken on 08 May 2009 08:46:03 (GMT)
A-Squared	Found Trojan.Win32.AntiAV!IK
AntiVir	Found TR/Killav.PN
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found Gen:Trojan.Heur.2014755353
ClamAV	Found nothing
CPsecure	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found Trojan-Downloader.Win32.Geral.kq
Ikarus	Found Trojan.Win32.AntiAV
Kaspersky Anti-Virus	Found Trojan-Downloader.Win32.Geral.kq
NOD32	Found probably a variant of Win32/AntiAV.AZQ (probable variant)
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Quick Heal	Found nothing
Sophos Antivirus	Found Mal/Mdrop-N
VirusBuster	Found nothing
VBA32	Found nothing

走丢啦

网马真疯狂~~

黑衣~魂

DR.WEB
Engine version: 5.0.0.12182
Total virus-finding records: 544319
File size: 37.00 KB
File MD5: 019463ceb381cc617248865aceb16e37

/AcX.exe packed by UPX
/AcX.exe infected with Trojan.MulDrop.31488