网站病毒

kp2006

http://61.152.169.234/flas.exe

http://www.xusce.cn/xasp.asp?id=1

http://www.xusce.cn/xui/1.exe

http://www.xusce.cn/xui/4.exe

http://www.xusce.cn/xui/6.exe

http://www.xusce.cn/xui/9.exe

The EQs

Time        Module        Object        Name        Threat        Action        User        Information
2007-5-9 22:27:14        IMON        file        http://61.152.169.234/flas.exe        a variant of Win32/Agent.NEO trojan                KASPERSK-56C566\EQ2       
2007-5-9 22:26:21        IMON        file        http://www.xusce.cn/xui/9.exe        probably a variant of Win32/PSW.QQPass.VD trojan                KASPERSK-56C566\EQ2       
2007-5-9 22:25:40        IMON        file        http://www.xusce.cn/xui/4.exe        Win32/Pacex.Gen virus                KASPERSK-56C566\EQ2

The EQs

Time        Module        Object        Name        Threat        Action        User        Information
2007-5-9 22:27:36        IMON        file        http://www.xusce.cn/xasp.asp?id=1        a variant of Win32/TrojanDownloader.Ani.Gen trojan                KASPERSK-56C566\EQ2

mofunzone

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\flas.exe'
C:\TDDOWNLOAD\
  flas.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.ahj.358 Backdoor server programs
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\1.exe'
C:\TDDOWNLOAD\
  1.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '46a6e283.qua'!
Begin scan in 'C:\TDDOWNLOAD\4.exe'
C:\TDDOWNLOAD\
  4.exe
      [DETECTION] Is the Trojan horse TR/PCK.NSAnti.N.64
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\6.exe'
C:\TDDOWNLOAD\
  6.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\9.exe'
C:\TDDOWNLOAD\
  9.exe
      [DETECTION] Is the Trojan horse TR/PSW.Stealer.64638
      [INFO]      The file was deleted!


End of the scan: 2007年5月9日  08:01
Used time: 00:07 min

The scan has been done completely.

      0 Scanning directories
      5 Files were scanned
      5 viruses and/or unwanted programs were found
      1 classified as suspicious:
      4 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
     -1 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found

mofunzone

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\xasp.asp'
C:\TDDOWNLOAD\
  xasp.asp
      [DETECTION] Contains signature of the exploits EXP/Ani.Gen
      [INFO]      The file was deleted!

alleynsun

卡巴7 ，6.9不杀，1启发，其他已知

harry_chang2003

PCC殺兩隻

蛙总

有一个叫NICK—ZONE的也是病毒网站！

yinxuchina

北京江民新科技术有限公司

        扫描引擎 10.00.600
        病毒库日期 2007-05-09
        更新日期 2007-05-10

扫描目标 C:\Documents and Settings\mrly\My Documents\flas.exe

扫描目标 C:\Documents and Settings\mrly\My Documents\1.exe

扫描目标 C:\Documents and Settings\mrly\My Documents\4.exe

扫描目标 C:\Documents and Settings\mrly\My Documents\6.exe

扫描目标 C:\Documents and Settings\mrly\My Documents\9.exe

开始时间 2007-05-10 03:30:10

在 C:\Documents and Settings\mrly\My Documents\flas.exe 中发现 Trojan/PSW.GamePass.hvl 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\4.exe 中发现 Backdoor/Agent.laa 病毒, 已删除
在 C:\Documents and Settings\mrly\My Documents\6.exe 中发现 Backdoor/Huigezi.qqm 病毒, 已删除
正常结束。

扫描结果:
                 文件数 :7                                   病毒体 :3         
                   删除 :3                                     解毒 :0         
    扫描速度(千字节/秒) :0                                 扫描时间 :00:00:00

鼻耳盖子