诺顿报警，天星教育网http://www.tesoon.com/[误报] [by knifed]

显示全部楼层 · 发表于 2010-2-18 12:29:45

本帖最后由 knifed 于 2010-2-20 20:16 编辑

http://www.tesoon.com/
诺顿日志
类别：入侵防护
日期和时间,风险,活动,状态,推荐的操作,风险名称,攻击电脑,攻击者网址,目标地址,源地址,通信说明
2010/2/18 12:23,高,已阻止 js.users.51.la 的入侵尝试。应用程序路径 \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE,已阻止,不需要操作,HTTP Suspicious Domain Request SQL Injection,"js.users.51.la (222.88.95.13, 80)",js.users.51.la/678279.js,"周阳-PC (117.66.102.49, 49188)",222.88.95.13 (222.88.95.13),"TCP, www-http"

类别：诺顿社区防卫
日期和时间,风险,活动,状态,推荐的操作,更新日期,提交者,说明,提交详细信息
2010/2/18 12:23,信息,IPS 检测统计提交,挂起,不需要操作,2010年2月18日 12:23,Norton AntiVirus Online,IPS 检测统计提交,"Signature ID: 23430  Local or Remote Attacker: 2  Remote Port: 80  Local Port: 49188  Protocol: 6  Signature Set Version: 20090828.002  Application Name: \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE  Offending URL: js.users.51.la/678279.js  Date Detected: Thu, 18 Feb 2010 04:23:56 GMT  Application File Checksum: 88BD42DAE7CFFEB256CA7145A15E4843  Application File Information: 8.0.6001.18882  Network Data: 434D50520014000078DAEDCABB0AC2401484E159A316516C7C8F15058D962159888D622E3616C1C22658B9F80A3EB76B0A0B7BBBFF8361389C39E4593A1C4999A4483226F42CE4D38390D7453AC7E132538DFBDF5CA53B35AEAADBC2A5B92BDBE258D59DB74F7F7B78BB5EDAFB5526EAC7B126DF7153EE179B64BB4A76B6F33F73000000000000007FF106B779186D  Sub-signature ID: 68182  Remote Address: 222.88.95.13  "
2010/2/18 12:20,信息,诺顿社区防卫反馈,挂起,不需要操作,2010年2月18日 12:20,Norton AntiVirus Online,诺顿社区防卫反馈,"Signature ID: DLLMM  Signature Set Version: 20090828.002  Application Name: C:\Windows\system32\jscript.dll  Date Detected: Thu, 18 Feb 2010 04:20:25 GMT  Application File Checksum: 680A319B0FD31AC4D7D18A6D843244FE  Application File Information: 5.8.6001.18795  Flags: 0x00000001  "
2010/2/18 12:20,信息,IPS 统计提交,挂起,不需要操作,2010年2月18日 12:20,Norton AntiVirus Online,IPS 统计提交,"Signature ID: DLLMM  Signature Set Version: 20090828.002  Application Name: C:\Windows\system32\jscript.dll  Date Detected: Thu, 18 Feb 2010 04:20:25 GMT  Application File Checksum: 39A29CED40C1A163CD8EBDAA60BD1008  Application File Information: 5.8.6001.18795  Flags: 0x00000001  "
2010/2/18 12:20,信息,诺顿社区防卫反馈,挂起,不需要操作,2010年2月18日 12:20,Norton AntiVirus Online,诺顿社区防卫反馈,"Signature ID: DLLMM  Signature Set Version: 20090828.002  Application Name: C:\Windows\system32\mshtml.dll  Date Detected: Thu, 18 Feb 2010 04:20:24 GMT  Application File Checksum: DF4D546A6E1C8D0F4FC10FCC9E422763  Application File Information: 8.0.6001.18882  Flags: 0x00000001  "
2010/2/18 12:20,信息,IPS 统计提交,挂起,不需要操作,2010年2月18日 12:20,Norton AntiVirus Online,IPS 统计提交,"Signature ID: DLLMM  Signature Set Version: 20090828.002  Application Name: C:\Windows\system32\mshtml.dll  Date Detected: Thu, 18 Feb 2010 04:20:17 GMT  Application File Checksum: F57A96073910B58820F961BD17867276  Application File Information: 8.0.6001.18882  Flags: 0x00000001  "

显示全部楼层 · 发表于 2010-2-18 12:43:22

报的51la？ 51la貌似没问题

显示全部楼层 · 发表于 2010-2-18 13:01:12

回复 2# qianwenxiang
你用诺顿访问看看就知道了，kav不报警

显示全部楼层 · 发表于 2010-2-18 13:02:07

mecode我没有，真麻烦....

显示全部楼层 · 发表于 2010-2-18 13:14:37

没诺顿……不过看那个日志报的是51la的统计代码

显示全部楼层 · 发表于 2010-2-18 23:34:06

GD opera正常in

显示全部楼层 · 发表于 2010-2-19 09:14:47

微点，卡巴，金山，都没报！！看着像误报！

显示全部楼层 · 发表于 2010-2-19 11:25:35

诺顿连卡饭都报，太敏感了，没办法的

上卖弄那个网站A5和红伞没报

显示全部楼层 · 发表于 2010-2-19 13:45:17

Log generated by anonymous use mdecoder 0.46
[root]http://www.tesoon.com/(天星教育网-教育|新课标|高考|中考|志愿填报|试卷|教案|课件|作文)
[script]http://www.tesoon.com/js/duilian.js
[iframe]http://www.tesoon.com/login_index.php
[script]http://www.tesoon.com/common/adverse.php?adtype=307
[script]http://www.tesoon.com/common/adverse.php?adtype=325
[script]http://www.tesoon.com/common/adverse.php?adtype=326
[script]http://bbs.tesoon.com/new.php?action=article&fidin=2&digest=0&pre=2&num=7&length=34&order=1
[iframe]http://www.tesoon.com/include/foot.htm
      [script]http://js.users.51.la/678279.js
      [script]http://www.tesoon.com/include/google-analytics.com/ga.js
         [iframe]http://www.tesoon.com/include/head.php?css=1
         [iframe]http://www.tesoon.com/include/foot.htm
            [script]http://js.users.51.la/678279.js
            [script]http://www.tesoon.com/include/google-analytics.com/ga.js

诺顿检测所有外链，容易误报

显示全部楼层 · 发表于 2010-2-20 15:58:22

楼上正解，我用诺顿，已经习惯了！

[已鉴定] 诺顿报警，天星教育网http://www.tesoon.com/[误报] [by knifed]