抓了8只网马 MD附内

woai_jolin

6CEEB4 164346 27C403 B4CE01 C7A050 3726A6 E53B2B 531DD2

woai_jolin

2007-8-30 21:01:52        Scanning Log
2007-8-30 21:01:52        Version of virus signature database: 2491 (20070830)
2007-8-30 21:01:52        Date: 30.8.2007  Time: 21:01:52
2007-8-30 21:01:52        Scanned disks, folders and files: F:\v\网马.zip
2007-8-30 21:01:52        F:\v\网马.zip » ZIP » 847.htm - JS/TrojanDownloader.Psyme.GW trojan
2007-8-30 21:01:52        F:\v\网马.zip » ZIP » 921.asp - JS/TrojanDownloader.IstBar.AI trojan
2007-8-30 21:01:52        F:\v\网马.zip » ZIP » 2209.htm - JS/TrojanDownloader.Psyme.GW trojan
2007-8-30 21:01:52        F:\v\网马.zip » ZIP » community.asp - JS/TrojanDownloader.IstBar.Q trojan
2007-8-30 21:01:52        F:\v\网马.zip » ZIP » downloader1.htm - JS/TrojanDownloader.Psyme.GW trojan
2007-8-30 21:01:52        F:\v\网马.zip » ZIP » ifuckhackerdewife.js - JS/TrojanDownloader.Psyme.GW trojan
2007-8-30 21:01:52        F:\v\网马.zip » ZIP » 1.gif - a variant of Win32/TrojanDownloader.Ani.Gen trojan
2007-8-30 21:01:52        F:\v\网马.zip » ZIP » 002.htm - JS/TrojanDownloader.Small.EW trojan
2007-8-30 21:01:52        Number of scanned files: 9
2007-8-30 21:01:52        Number of threats found: 8
2007-8-30 21:01:52        Time of completion: 21:01:52  Total scanning time: 0 sec (00:00:00)

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\网马.zip'
F:\病毒样本\网马.zip
  [0] Archive type: ZIP
  --> 847.htm
      [DETECTION] Contains signature of the HTML script virus HTML/ADODB.Exploit.Gen
  --> 921.asp
      [DETECTION] Is the Trojan horse TR/Dldr.IstBar.AI.38
  --> 2209.htm
      [DETECTION] Contains signature of the HTML script virus HTML/ADODB.Exploit.Gen
  --> community.asp
      [DETECTION] Contains signature of the HTML script virus HTML/Agent.C
  --> downloader1.htm
      [DETECTION] Contains signature of the HTML script virus HTML/ADODB.Exploit.Gen
  --> ifuckhackerdewife.js
      [DETECTION] Contains signature of the HTML script virus HTML/ADODB.Exploit.Gen
  --> 1.gif
      [DETECTION] Contains signature of the exploits EXP/Ani.Gen
  --> 002.htm
      [DETECTION] Contains signature of the HTML script virus HTML/ADODB.Exploit.Gen
      [INFO]      The file was deleted!

ssy275

FS 下载时全部拦下

uhthn2002

C:\Documents and Settings\uhthn\Desktop\virus\921.asp : infected Trojan-Downloader.JS.IstBar.ai
C:\Documents and Settings\uhthn\Desktop\virus\community.asp : infected Trojan-Downloader.JS.IstBar.ai
C:\Documents and Settings\uhthn\Desktop\virus\1.gif : infected Exploit.Win32.IMG-ANI.gen


Directories       : 0       Files in archives:      Files on disks:
Archives:                   - total       : 0       - total       : 8     
- scanned         : 0       -  scanned    : 0       - scanned     : 8     
- contain viruses : 0       -  infected   : 0       - infected    : 3     
- deleted         : 0       -  suspicious : 0       - suspicious  : 0     


Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Heuristics - OPEN
Scan in - C:\Documents and Settings\uhthn\Desktop\virus

C:\Documents and Settings\uhthn\Desktop\virus\847.htm - Suspicious of Trojan-Downloader.VBS.Agent.1
C:\Documents and Settings\uhthn\Desktop\virus\921.asp - Suspicious of Not-A-Virus:Porn-Dialer.Agent.1
C:\Documents and Settings\uhthn\Desktop\virus\2209.htm - Suspicious of Trojan-Downloader.VBS.Agent.1
C:\Documents and Settings\uhthn\Desktop\virus\community.asp - Suspicious of Not-A-Virus:Porn-Dialer.Agent.1
C:\Documents and Settings\uhthn\Desktop\virus\downloader1.htm - Suspicious of Trojan-Downloader.VBS.Agent.1
C:\Documents and Settings\uhthn\Desktop\virus\ifuckhackerdewife.js - Suspicious of Downloader
C:\Documents and Settings\uhthn\Desktop\virus\1.gif - Suspicious of Exploit.Win32.IMG-ANI.gen
C:\Documents and Settings\uhthn\Desktop\virus\002.htm - Suspicious of Trojan-Downloader.VBS.Agent.2

8 Files scanned
0 Infected files found
8 Suspicious files found
0 Files cured
0 Files deleted

promised

C:\ABC\网马.zip:\847.htm - 特征码 'Generic.XPL.ADODB' 被发现
C:\ABC\网马.zip:\921.asp - 特征码 'Trojan-Downloader.JS.IstBar.AI' 被发现
C:\ABC\网马.zip:\2209.htm - 特征码 'Generic.XPL.ADODB' 被发现
C:\ABC\网马.zip:\community.asp - 特征码 'Trojan-Downloader.JS.IstBar.AI' 被发现
C:\ABC\网马.zip:\downloader1.htm - 特征码 'Generic.XPL.ADODB' 被发现
C:\ABC\网马.zip:\ifuckhackerdewife.js - 特征码 'Generic.XPL.ADODB' 被发现
C:\ABC\网马.zip:\1.gif - 特征码 'Exploit.Win32.MS05-002' 被发现
C:\ABC\网马.zip:\002.htm - 特征码 'Exploit.JS.ADODB.Stream' 被发现
C:\ABC\网马.zip

        9 文件被扫描
          (1 压缩档 8 文件)
        8 特征码被侦测
        0 可疑代码段被发现
        耗时: 0:00.032

wazg

nis2008




[ 本帖最后由 wazg 于 2007-8-30 21:15 编辑 ]

tiedan2

Ikarus:
30:08:2007 21:24:50 SEARCHTASK "USER_DEFINED" started...
scan item: C:\Documents and Settings\zhenjia\桌面\网马
File scanned: C:\Documents and Settings\zhenjia\桌面\网马\002.htm - SIGNATURE FOUND "Exploit.JS.ADODB.Stream"
File scanned: C:\Documents and Settings\zhenjia\桌面\网马\1.gif - SIGNATURE FOUND "Exploit.Win32.MS05-002"
File scanned: C:\Documents and Settings\zhenjia\桌面\网马\2209.htm - SIGNATURE FOUND "Generic.XPL.ADODB"
File scanned: C:\Documents and Settings\zhenjia\桌面\网马\847.htm - SIGNATURE FOUND "Generic.XPL.ADODB"
File scanned: C:\Documents and Settings\zhenjia\桌面\网马\921.asp - SIGNATURE FOUND "Trojan-Downloader.JS.IstBar.AI"
File scanned: C:\Documents and Settings\zhenjia\桌面\网马\community.asp - SIGNATURE FOUND "Trojan-Downloader.JS.IstBar.AI"
File scanned: C:\Documents and Settings\zhenjia\桌面\网马\downloader1.htm - SIGNATURE FOUND "Generic.XPL.ADODB"
File scanned: C:\Documents and Settings\zhenjia\桌面\网马\ifuckhackerdewife.js - SIGNATURE FOUND "Generic.XPL.ADODB"
30:08:2007 21:24:51 SEARCHTASK "USER_DEFINED" FINISHED...
----------------------------------------------------
Directories scanned: 1
Files scanned: 8
Virus found: 8
------------------------------------------------

微点卫士

费尔7个

jimmyleo

不是脚本么