小心 http://www.hackrmb.com/6and1 木馬!! 似係近一兩日先開始擴散
近一兩日用NOD32 發現到呢隻野, 佢煩就煩在每隔幾分鐘就會做d動作,令到防毒要不斷彈Windows 出黎去block 佢...有好多防毒軟件都仲未scan 到...
[img]http://i9.photobucket.com/albums/a86/kimsuna/complex2/nod32.jpg[/img]
[img]http://www.storage4all.com/uploads/dc60cf25fe.jpg[/img]
網上好似都仲未有清除佢既方法.. 多謝bro 提醒﹗我會小心防範啦。^^
[[i] Last edited by ALWIN_WONG on 2006-12-3 at 09:32 PM [/i]] 感謝你的寶貴分享，非常感激~ 大鑊啦!我中咗啦,咁點算呀,搵人幫下我啦,唔該 係C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 個 folder 可以搵到佢Win32/Hupigon trojan既 exe檔, 應該會有好多個, 因為block 完一個佢自己又會多一個出黎.
我一陣試下去safe mode 然後清除哂裡面d 野睇下有冇用~
[[i] Last edited by spector.R on 2006-12-4 at 12:45 AM [/i]] 開始有d 頭緒....搵到d可能有關呢隻木馬既資料:
資料來源 : [url]http://www.f-secure.com/v-descs/nilage_aut.shtml[/url]
係11月22日F-Secure 發現到一隻叫Nilage.AUT既木馬程式.
佢最主要目的係偷取受感染電腦裡面既敏感資料如 password, acount, 同時會嘗試去自動下載和安裝更多間諜程式.
做呢隻木馬個個人有可能係想偷人地玩online game 既account 資料, 例如韓國game Lineage 同 Maple Story.
當木馬程式偷到想要既data 就會將佢地store 做.txt format , 可能係係c:\6in1game.txt .
之後就會自己透過upload 去
-http-://www.y8ne.com/mail/upfilets.asp
-http-://www.y8ne.com/mail/upfile.asp
將偷到既data send返出去比 Hacker .
除左偷password, 隻木馬仲識得自己走去[url]http://www.hackrmb.com/6anREMOVEDexe[/url] download malware 然後儲存係我地d 電腦度轉名做%windir%\java\classes\spoolsys exe
[[i] Last edited by spector.R on 2006-12-4 at 12:46 AM [/i]] Nilage.AUT includes keylogging functionality.
佢有keylogging function ... 唔知係咪keyboard打咩字都會記住... 暫時都係唔好去ebanking 個d 地方住...
[[i] Last edited by spector.R on 2006-12-4 at 12:43 AM [/i]] [quote]Originally posted by [i]jesus1016cheung[/i] at 2006-12-3 11:39 PM:
大鑊啦!我中咗啦,咁點算呀,搵人幫下我啦,唔該 [/quote]
如果發現到電腦有呢隻木馬, 可以試下用"清理磁碟" , 清理哂所有 Temporary Internet files, d malware 應該係哂C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 個 folder 入面.
仲有兩個木馬所做出黎既檔案分別係 :
winpsfisle.dll
ExesFisle
winpsfisle.dll 應該係C:/Windows
ExesFisle 應該係C:/Windows/System32
我唔清楚可唔可以delete, 但最好都將佢剪下去其他地方,zip 左佢, 咁樣木馬就再call唔到佢地.
最後re-boot 電腦.
記得加強返d Firewall 既防禦力ar~
[[i] Last edited by spector.R on 2006-12-4 at 02:49 AM [/i]] er...
佢係咪會係msn度自動send訊息俾人叫人down ga?
因為我星期六0岩0岩中左毒,已經清左,已經搵唔返個毒叫咩名...
好似係呢個名,我唔肯定
不過我成功清到
方法如下:
因為佢幾分鐘就自己搞d野,點清都清唔哂
我都唔記得點樣發現佢係靠上網黎搞事的
所以我先斷線,佢地似仲有個file會自動變成window用緊ge程式,令你無返delete佢
所以跟住要做ge,就係按ctrl+alt+delete
係處理程序度搵佢出黎,close左佢
之後我unistall msn ge所有野,再掃毒,之後梗係清毒啦=.=
最後安返msn就無事了
唔知幫唔幫到大家呢~ 我中左 , 清唔到 !!! 防止木馬最保險的辦法就是..
1.不斷更新防毒軟體的病毒碼
2.不隨意開啟不明網站或信件
也在此感謝大大提供消息...........^^ **** 作者被禁止或刪除 內容自動屏蔽 **** 現在的木馬真係好犀利呀,我次次一上網即係有木馬程式想入黎,好彩有防毒軟件攔截到,現在如果上網唔裝防毒軟式真係好危險呀.......... 好彩有你提醒我~~多謝哂 How to clean ah???? so afraid... 多左大佬既提醒..小弟會注意.... 你地好厲害呀，咁都知D黑客用隻木馬程式想做咩，放心啦，我會小心D ga la **** 作者被禁止或刪除 內容自動屏蔽 **** 木馬仲有好多種...
我依家都有隻叫idhygc都搞唔掂... This virus comes from where, and how to avoid and clean it!
頁:
[1]
2