Rozetka заражена? | Крымский форум

Rozetka заражена?

  • Добро пожаловать на форум! Рады видеть вас здесь! Зарегистрируйтесь или Войдите в аккаунт, чтобы иметь полный доступ к площадке!
Bannerok
F

FreeLSD

Guest
Уже не первый день пытаюсь зайти на сайт известного интернет-магазина Розетка, Доктор Веб блокирует страницу по причине наличия VBS.Psyme.377. Таки действительно они подхватили или это антивирус зря волнуется?
 
NOD32 4.0.417.0 версия сигнатур 4764 (20100112)
не ругается.

в догонку
Браузер Mozilla Firefox
ADBlock включён и что-то порезал.
 
MedicusAmicus дата теста 2008.11.02 !?
Сомневаюсь что в моих базах нет этого вируса. Но так и быть - прогоню куреитом. Посмотрим
 
Браузер Mozilla Firefox
Антивирус Avast
Зашел на главную - не ругнулся.
 
Nikolas, если что-то резало, то, может, и не пролез.
У меня тоже Мозилла. DrWeb со Spider Gate - он, по идее, ловит еще до того, как на диск запишется. Не дает открыть главную.
 
У меня дрВеб ругнулся и не пустил. Причем в баллончике выдал мне УРЛ фавикона. А в статистике - вот это:

[12/01/2010 18:04:21 00000458] Response is infected by VBS.Psyme.377 (type=1). Url=http://rozetka.com.ua/
[12/01/2010 18:04:21 00000198] Response is infected by VBS.Psyme.377 (type=1). Url=http://rozetka.com.ua/favicon.ico
[12/01/2010 18:04:24 00000fc8] Response is infected by VBS.Psyme.377 (type=1). Url=http://rozetka.com.ua/favicon.ico
 
ESET в Мозилле молчит. Правда сразу началась загрузка обновлений Windows и довольно приличный кусок, но может просто совпало.
 
А кто нибудь юзает каспера? Как он?

ЗЫ. На борду тоже аваст и вебер иногда орал.. но это из-за iframe было пару раз... у меня просто такое режется сразу... так что хз.

А иконку ща скачаю - гляну чотам
smoke.gif
 
опа... а иконку подменили ))) Красиво =)

/style_images/CaliV6/read_more.gif


[hide]Код
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
       <head>
<script language=javascript>
document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%66%75%6E%63%74%69%6F%6E%20%64%46%28%73%29%7B%76%61%72%20%73%31%3D%75%6E%65%73%63%61%70%65%28%73%2E%73%75%62%73%74%72%28%30%2C%73%2E%6C%65%6E%67%74%68%2D%31%29%29%3B%20%76%61%72%20%74%3D%27%27%3B%66%6F%72%28%69%3D%30%3B%69%3C%73%31%2E%6C%65%6E%67%74%68%3B%69%2B%2B%29%74%2B%3D%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%73%31%2E%63%68%61%72%43%6F%64%65%41%74%28%69%29%2D%73%2E%73%75%62%73%74%72%28%73%2E%6C%65%6E%67%74%68%2D%31%2C%31%29%29%3B%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%74%29%29%3B%7D%3C%2F%73%63%72%69%70%74%3E'));dF('%264Dtdsjqu%2631uzqf%264E%2633ufyu0kbwbtdsjqu%2633%264F%261B%261B%2631%2631%2631%2631%2631%2631%2631%2631wbs%2631vsmUp%2631%264E%2631mpdbujpo/isfg%264C%261B%261B%2631%2631%2631%2631%2631%2631%2631%2631wbs%2631tfdsfuLfz%2631%264E%2631%2633tfdsfu33lfz%2633%264C%261B%2631%2631%2631%2631%2631%2631%2631%2631wbs%2631vb%2631%264E%2631obwjhbups/vtfsBhfou%264C%261B%261B%2631%2631%2631%2631%2631%2631%2631%2631wbs%2631vsm%2631%264E%2631mpdbujpo/qspupdpm%2631%2C%2631%263800%2638%2631%2C%2631mpdbujpo/iptuobnf%2631%2C%2631%26330joefy/qiq%2633%264C%261B%261B%2631%2631%2631%2631%2631%2631%2631%2631wbs%2631ebub%2631%264E%2631%2633vb%264E%2633%2631%2C%2631fodpefVSJ%2639vb%263%3A%264C%261B%2631%2631%2631%2631%2631%2631%2631%2631ebub%2631%264E%2631ebub%2631%2C%2631%2633%2637tfd%264E%2633%2631%2C%2631fodpefVSJ%2639tfdsfuLfz%263%3A%264C%261B%2631%2631%2631%2631%2631%2631%2631%2631ebub%2631%264E%2631ebub%2631%2C%2631%2633%2637soe%264E%2633%2631%2C%2631Nbui/sboepn%2639%263%3A%264C%261B%261B%2631%2631%2631%2631%2631%2631%2631%2631gvodujpo%2631bkbyGvodujpo%2639%263%3A%261B%2631%2631%2631%2631%2631%2631%2631%2631%268C%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631wbs%2631ynmiuuq%264C%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631jg%2631%2639xjoepx/YNMIuuqSfrvftu%263%3A%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%268C%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%263100%2631dpef%2631gps%2631JF8%2C%263D%2631Gjsfgpy%263D%2631Dispnf%263D%2631Pqfsb%263D%2631Tbgbsj%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631ynmiuuq%264Eofx%2631YNMIuuqSfrvftu%2639%263%3A%264C%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%268E%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631fmtf%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%268C%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%263100%2631dpef%2631gps%2631JF7%263D%2631JF6%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631ynmiuuq%264Eofx%2631BdujwfYPckfdu%2639%2633Njdsptpgu/YNMIUUQ%2633%263%3A%264C%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%268E%261B%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631ynmiuuq/posfbeztubufdibohf%264Egvodujpo%2639%263%3A%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%268C%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631jg%2639ynmiuuq/sfbezTubuf%264E%264E5%263%3A%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%268C%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%263100bmfsu%2639ynmiuuq/sftqpotfUfyu%263%3A%264C%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631jg%2631%2639ynmiuuq/sftqpotfUfyu%2631%264E%264E%26312%263%3A%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%268C%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631xjoepx/mpdbujpo%2631%264E%2631vsmUp%264C%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%268E%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%268E%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%268E%261B%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631ynmiuuq/pqfo%2639%2633QPTU%2633%263D%2631vsm%263D%2631usvf%263%3A%264C%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631ynmiuuq/tfuSfrvftuIfbefs%2639%2638Dpoufou.Uzqf%2638%263D%2631%2638bqqmjdbujpo0y.xxx.gpsn.vsmfodpefe%2638%263%3A%264C%261B%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631ynmiuuq/tfoe%2639ebub%263%3A%264C%261B%2631%2631%2631%2631%2631%2631%2631%2631%268E%261B%2631%2631%2631%2631%2631%2631%2631%2631bkbyGvodujpo%2639%263%3A%264C%261B%264D0tdsjqu%264F%261B1')
</script>
       </head>
       <body>
       </body>
</html>

[/hide]
 
Мне кажется, или главную страницу розетки тоже уже подменили под заражённый ХТМЛ? О_о
 
Vista Ultimate 64bit.
Просканировал Avast-ом на максимуме - грит все тип-топ.
Windows Defender тоже ничего подозрительного не нашел.
 
наверно уже починили Vista64,FF3.5.7+AVG тоже тишина
 
ничего не починили. прекрасненько лочится ДрВебом.

И, кстати, лочится прямой урл, не иконка.
 
да dr.web. блокирует типа вредоносная программа VBS.Psyme.377
 
XXXLer уже восстановили, ога.


кстати... доктор вебер (а имено КуреИТ) КАЗЬОЛ!
Запустил проверку (напугали Вы меня типа), естественно НИЧЕГО не нашёл, НО! что б показать свою значимость сказал что у меня заражён файл hosts и предложил его вылечить... придурок. Благо я бэкап этого файла сделал... НИЧЕГО в нём нет инфицированного, а только МОИ настройки, которые мне реально нада!
 
Цитата(Nikolas @ 12 Января, 2010, 21:38)
кстати... доктор вебер (а имено КуреИТ) КАЗЬОЛ!

Хорошо что у меня сейчас инет - ..опа, и я его не стал скачивать
lol.gif
 
Войдите или зарегистрируйтесь для ответа.
Назад
Сверху