挂马

显示全部楼层 · 发表于 2007-12-15 06:20:50

http://www.torchlk.com/

[ 本帖最后由绅博周幸于 2007-12-15 06:23 编辑 ]

显示全部楼层 · 发表于 2007-12-15 06:24:40

Starting the file scan:

Begin scan in 'C:\Users\Xing\Documents\Documents.rar'
C:\Users\Xing\Documents\Documents.rar
  [0] Archive type: RAR
  --> log1[1].htm
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Click.Vipstat
  --> test1[1].htm
   [DETECTION] Contains detection pattern of the HTML script virus HTML/ObjCode.Q
--> iebar.exe
   [1] Archive type: CAB (Microsoft)
   --> iebar23.0.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/IEBar.M.1
   --> barhelp24.0.dll
      [DETECTION] Contains detection pattern of the Ad- or Spyware ADSPY/IEBar.N
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-12-15 07:37:00

2007-12-15 7:36:29 1197675389 Administrator 1636 Sign of "VBS:Script-gen" has been found in "D:\Downloads\Documents.rar\test1[1].htm" file.
2007-12-15 7:36:34 1197675394 Administrator 1636 Sign of "Win32:Trojan-gen {Other}" has been found in "D:\Downloads\Documents.rar\iebar.exe\iebar23.0.dll" file.
2007-12-15 7:36:34 1197675394 Administrator 1636 Sign of "Win32:Trojan-gen {Other}" has been found in "D:\Downloads\Documents.rar\iebar.exe\barhelp24.0.dll" file.

显示全部楼层 · 发表于 2007-12-15 07:45:15

C:\Users\Wesley\Downloads\Documents.rar » RAR » iebar.exe » CAB » iebar23.0.dll - Win32/Adware.Toolbar.IEBar application
C:\Users\Wesley\Downloads\Documents.rar » RAR » iebar.exe » CAB » barhelp24.0.dll - probably a variant of Win32/Adware.Agent application

显示全部楼层 · 发表于 2007-12-15 07:57:24

我用咖啡8.5 IE6.0进去没有任何反映啊！！是不是马被牵走了？？呵呵

显示全部楼层 · 发表于 2007-12-15 08:16:05

chow
HTML/Click.Vipstat看到这个基本上是下的iebar
HTML/ObjCode.Q这个基本上是obj挂式

显示全部楼层 · 发表于 2007-12-15 09:48:35

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.IEbar.b
病毒： Trojan.IEbar.c

用户来源：互联网

软件版本：20.22.42

显示全部楼层 · 发表于 2007-12-15 13:34:05

McAfee Adware-IEBar

显示全部楼层 · 发表于 2007-12-15 15:14:20

江民杀毒软件报告文件

北京江民新科技术有限公司

扫描引擎 11.00.702
病毒库日期 2007-12-14
更新日期 2007-12-15

扫描目标 C:\Documents and Settings\Owner.LENOVO-3D029484\桌面\Documents.rar

开始时间 2007-12-15 15:13:45

在 C:\Documents and Settings\Owner.LENOVO-3D029484\桌面\Documents.rar->iebar.exe->iebar23.0.dll 中发现 Adware/IEBar.c 病毒, 已删除
在 C:\Documents and Settings\Owner.LENOVO-3D029484\桌面\Documents.rar->iebar.exe->barhelp24.0.dll 中发现 Adware/IEBar.b 病毒, 已删除
正常结束。

扫描结果:
               文件数 :12                               病毒体 :2
               删除 :2                                  解毒 :0
扫描速度(千字节/秒) :0                               扫描时间 :00:00:00
扫描文件速度(个/秒) :12

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -    - - - - - - - - - - - -

显示全部楼层 · 发表于 2007-12-15 15:33:45

CODEBASE='http://iebar.t2t2.com/iebar.cab#Version=1,1,0,0'

微点砍掉

[已鉴定] 挂马

ESET Smart Security