法国留学生论坛挂马,Kaspersky Anti-Virus Found nothing

显示全部楼层 · 发表于 2007-12-17 08:27:27

http://montpellier.ttsite.com/

[ 本帖最后由绅博周幸于 2007-12-17 08:30 编辑 ]

显示全部楼层 · 发表于 2007-12-17 08:29:35

那个应该称之为ttsite吧
免费论坛谁去挂它…… 估计是自己挂的……

显示全部楼层 · 发表于 2007-12-17 08:31:06

A-Squared  Found nothing
AntiVir  Found EXP/RealPlay.E, JS/Dldr.Agent.AM
ArcaVir  Found nothing
Avast  Found nothing
AVG Antivirus  Found nothing
BitDefender  Found nothing
ClamAV  Found nothing
CPsecure  Found Troj.Exploit.W32.RealPlr.A
Dr.Web  Found nothing
F-Prot Antivirus  Found nothing
F-Secure Anti-Virus  Found nothing
Fortinet  Found nothing
Ikarus  Found nothing
Kaspersky Anti-Virus  Found nothing
NOD32  Found JS/Exploit.BO.NAE
Norman Virus Control  Found nothing
Panda Antivirus  Found Trj/Relink.A
Rising Antivirus  Found nothing
Sophos Antivirus  Found nothing
VirusBuster  Found nothing
VBA32  Found nothing

显示全部楼层 · 发表于 2007-12-17 12:00:14

html shellcode
再次见到http://e.6ong.com/ps/a.exe

显示全部楼层 · 发表于 2007-12-17 12:21:47

The requested object is INFECTED. The following viruses Worm.Win32.Downloader.cx were found

显示全部楼层 · 发表于 2007-12-17 15:30:09

软件名称	引擎版本	病毒库版本	病毒库时间	扫描结果	时间
a-squared	3.0.0.126	2007.12.16	2007-12-16	-	3.829
AntiVir	7.6.0.45	7.0.1.102	2007-12-17	JS/Dldr.Agent.AM	5.920
Arcavir	1.0.4	200712161242	2007-12-16	-	4.865
AVAST	1.0.8	071216-0	2007-12-16	-	8.112
AVG	7.5.49.442	269.17.1/1183	2007-12-13	-	6.503
BitDefender	7.60825.960375	7.16338	2007-12-17	-	8.365
CA (VET)	9.0.0.143	31.3.5377	2007-12-15	-	9.527
ClamAV	0.91.2	5152	2007-12-17	-	0.013
Comodo	2.11	2.0.0.375	2007-12-16	-	1.735
CP Secure	1.1.0.655	2007.12.17	2007-12-17	Troj.Exploit.W32.RealPlr.A	11.834
Dr.WEB	4.44.0.9170	2007.12.16	2007-12-16	-	9.197
ewido	4.0.0.2	2007.12.16	2007-12-16	-	2.364
F-PROT	4.4.1.52	20071216	2007-12-16	-	4.197
F-SECURE	5.51.6100	2007.12.16.03	2007-12-16	-	9.067
IKARUS	T3.1.01.15	2007.12.17.70002	2007-12-17	-	1.639
MKS_VIR	2.01	2007.12.16	2007-12-16	-	8.199
NOD32	2.70.10	2726	2007-12-17	JS/Exploit.BO.NAE trojan	0.054
NORMAN	5.91.08	5.90	2007-12-13	-	14.748
nProtect	2007-12-17.00	1092503	2007-12-17	-	5.785
Prevx	V2	20071217	2007-12-17	-	3.989
QuickHeal	9.00	2007.12.15	2007-12-15	-	4.557
SOPHOS	2.49.1	4.21	2007-12-16	-	15.387
The Hacker	6.2.9	v00160	2007-12-14	-	1.275
VBA32	3.12.2.5	20071214.1956	2007-12-14	-	2.578
ViRobot	20071214	2007.12.14	2007-12-14	-	0.677
VirusBuster	4.3.19:9	9.117.4/11.0	2007-12-16	-	4.873
卡巴斯基	5.5.10	2007.12.17	2007-12-17	-	18.543
安博士V3	2007.12.15.00	2007.12.15	2007-12-15	-	1.354
江民杀毒	10.00.650	2007.12.16	2007-12-16	-	1.321
熊猫卫士	9.04.03.0001	2007.12.16	2007-12-16	Trj/Relink.A	2.858
瑞星	19.0	20.22.41.00	2007-12-14	-	1.119
赛门铁克	1.3.0.24	20071216.003	2007-12-16	-	0.207
趋势	8.500-1001	4.892.08	2007-12-16	-	0.051
迈克菲	5.2.00	5186	2007-12-14	-	2.436
金山毒霸	2007.6.20.249	2007.12.16	2007-12-16	-	1.125
飞塔	2.81-3.11	8.449	2007-12-03	-	1.060

注意: 就算报告发现病毒，也可能是杀软误报，请根据查毒结果自行判断

显示全部楼层 · 发表于 2007-12-17 15:44:43

McAfee miss

显示全部楼层 · 发表于 2007-12-17 16:34:21

小红伞拒绝了访问
Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL: bbs.kafan.cn/attachment.php?aid=169736
Information: Contains detection pattern of the exploits EXP/RealPlay.E

--------------------------------------------------------------------------------
Generated by AntiVir WebGuard 7.01.00.13, AVE 7.6.0.45, VDF 7.0.1.103

显示全部楼层 · 发表于 2007-12-17 16:39:07

REAL的漏洞
昏过去

显示全部楼层 · 发表于 2007-12-17 19:31:00

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.Mnless.zyt

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.23.01

[已鉴定] 法国留学生论坛挂马,Kaspersky Anti-Virus Found nothing

2/1