小心 http://www.hackrmb.com/6and1 木馬!! 似係近一兩日先開始擴散

spector.R

近一兩日用NOD32 發現到呢隻野, 佢煩就煩在每隔幾分鐘就會做d動作,令到防毒要不斷彈Windows 出黎去block 佢...
有好多防毒軟件都仲未scan 到...




網上好似都仲未有清除佢既方法..

ALWIN_WONG

多謝bro 提醒﹗我會小心防範啦。^^

[ Last edited by ALWIN_WONG on 2006-12-3 at 09:32 PM ]

flpo

感謝你的寶貴分享，非常感激~

jesus1016cheung

大鑊啦!我中咗啦,咁點算呀,搵人幫下我啦,唔該

spector.R

係C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 個 folder 可以搵到佢Win32/Hupigon trojan既 exe檔, 應該會有好多個, 因為block 完一個佢自己又會多一個出黎.

我一陣試下去safe mode 然後清除哂裡面d 野睇下有冇用~

[ Last edited by spector.R on 2006-12-4 at 12:45 AM ]

spector.R

開始有d 頭緒....搵到d可能有關呢隻木馬既資料:
資料來源 : http://www.f-secure.com/v-descs/nilage_aut.shtml
係11月22日F-Secure 發現到一隻叫Nilage.AUT既木馬程式.
佢最主要目的係偷取受感染電腦裡面既敏感資料如 password, acount, 同時會嘗試去自動下載和安裝更多間諜程式.
做呢隻木馬個個人有可能係想偷人地玩online game 既account 資料, 例如韓國game Lineage 同 Maple Story.

當木馬程式偷到想要既data 就會將佢地store 做.txt format , 可能係係c:\6in1game.txt .

之後就會自己透過upload 去   
-http-://www.y8ne.com/mail/upfilets.asp
-http-://www.y8ne.com/mail/upfile.asp
將偷到既data send返出去比 Hacker .


除左偷password, 隻木馬仲識得自己走去http://www.hackrmb.com/6anREMOVEDexe download malware 然後儲存係我地d 電腦度轉名做%windir%\java\classes\spoolsys exe

[ Last edited by spector.R on 2006-12-4 at 12:46 AM ]

spector.R

Nilage.AUT includes keylogging functionality.

佢有keylogging function ... 唔知係咪keyboard打咩字都會記住... 暫時都係唔好去ebanking 個d 地方住...

[ Last edited by spector.R on 2006-12-4 at 12:43 AM ]

spector.R

Originally posted by jesus1016cheung at 2006-12-3 11:39 PM:
大鑊啦!我中咗啦,咁點算呀,搵人幫下我啦,唔該

如果發現到電腦有呢隻木馬, 可以試下用"清理磁碟" , 清理哂所有 Temporary Internet files, d malware 應該係哂C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 個 folder 入面.
仲有兩個木馬所做出黎既檔案分別係 :
winpsfisle.dll
ExesFisle

winpsfisle.dll 應該係C:/Windows
ExesFisle 應該係C:/Windows/System32

我唔清楚可唔可以delete, 但最好都將佢剪下去其他地方,zip 左佢, 咁樣木馬就再call唔到佢地.


最後re-boot 電腦.

記得加強返d Firewall 既防禦力ar~

[ Last edited by spector.R on 2006-12-4 at 02:49 AM ]

sakura310

er...
佢係咪會係msn度自動send訊息俾人叫人down ga?
因為我星期六0岩0岩中左毒,已經清左,已經搵唔返個毒叫咩名...
好似係呢個名,我唔肯定
不過我成功清到

方法如下:
因為佢幾分鐘就自己搞d野,點清都清唔哂
我都唔記得點樣發現佢係靠上網黎搞事的
所以我先斷線,佢地似仲有個file會自動變成window用緊ge程式,令你無返delete佢
所以跟住要做ge,就係按ctrl+alt+delete
係處理程序度搵佢出黎,close左佢
之後我unistall msn ge所有野,再掃毒,之後梗係清毒啦=.=
最後安返msn就無事了

唔知幫唔幫到大家呢~

hklady

我中左 , 清唔到 !!!