红伞防不住个盗号木马？？？？？？

显示全部楼层 · 发表于 2010-1-25 16:19:10

Log is generated by FreShow.
[wide]http://www.xinnong.com/niu/hangqing/wow/10150.html
[script]http://pagead3.googlesyndications.co.cc/data/backup/logo.gif
      [frame]http://www.97it.com.cn/a/kk.htm?hahakkkk
         [script]http://www.97it.com.cn/a/what.jpg
         [object]http://www.07073.com/t/w.rar

显示全部楼层 · 发表于 2010-1-25 16:22:34

真是悲剧了只是很不解将军令就这么脆弱么

显示全部楼层 · 发表于 2010-1-25 16:23:06

小红伞可以查杀此木马程序.

Start of the scan: 2010年1月25日  16:20

Starting the file scan:

Begin scan in 'D:\Downloads\w.exe'
D:\Downloads\w.exe
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE]    The file was deleted!

End of the scan: 2010年1月25日  16:20
Used time: 00:36 Minute(s)

The scan has been done completely.

   0 Scanned directories
   1 Files were scanned
   1 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   1 files were deleted
   0 Viruses and unwanted programs were repaired
   0 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   0 Files not concerned
   0 Archives were scanned
   0 Warnings
   1 Notes

显示全部楼层 · 发表于 2010-1-25 16:34:36

显示全部楼层 · 发表于 2010-1-25 16:38:11

本帖最后由 will 于 2010-1-25 16:44 编辑

楼主这样修复系统：
1.重命名C:\Windows\System32\rpcss.dll为rpcss.dll.old
2.重命名C:\Windows\System32\t3rpcss.dll为rpcss.dll
3.搜索System32下大小为64KB（65536字节），MD5值为6B62FFB880F745B3A1E2198CC09D1C8C 的t39123.dll文件(这是个WOW盗号木马)，将其强制删除
4.将红伞更新至最新，扫描系统盘

显示全部楼层 · 发表于 2010-1-25 16:44:17

关于:hxxp://www.xinnong.com/niu/hangqing/wow/10150.html解密的日志(全体输出 -  5):

Level  1>hxxp://www.xinnong.com/niu/hangqing/wow/10150.html
Level  1>hxxp://pagead3.googlesyndications.co.cc/data/backup/logo.gif
Level  1>hxxp://www.97it.com.cn/a/kk.htm?hahakkkk
Level  1>hxxp://www.97it.com.cn/a/what.jpg
Level  2>hxxp://www.07073.com/t/w.rar ●

By XE鼓

显示全部楼层 · 发表于 2010-1-25 16:48:45

本帖最后由钢铁侠于 2010-1-25 16:57 编辑

瑞星2010拦截，上图。
恶意网站已被拦截.jpg

显示全部楼层 · 发表于 2010-1-25 16:54:44

回复 17# 钢铁侠

图挂

显示全部楼层 · 发表于 2010-1-25 16:58:34

回复 18# Hopesky
编辑了几次都挂了，总算好了，累死我了。

显示全部楼层 · 发表于 2010-1-25 21:19:01

杯具呦~~
op攔截IP:222.35.140.235~~~~