测试一下

显示全部楼层 · 发表于 2007-12-29 18:59:42

AntiVir应该是通吃

显示全部楼层 · 发表于 2007-12-29 19:02:44

什么叫应该是…… 猜测下脚本？

显示全部楼层 · 发表于 2007-12-29 19:03:12

Starting the file scan:

Begin scan in 'E:\1.rar'
E:\1.rar
  [0] Archive type: RAR
  --> PnpWmkDrv.sys
   [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.GZ
  --> xz[1].htm
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
  --> RegisterCQ.exe
   [DETECTION] Contains suspicious code HEUR/Malware
  --> whole_counter[1].htm
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
  --> Addall.htm
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
  --> AddUrl.htm
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
  --> ±ê×¼ÎÄÏ×ÖøÂ¼¾ÙÀý.htm
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
  --> »áÒéÎÄÏ×ÖøÂ¼¾ÙÀý.htm
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
  --> ÏêÏ¸¼ÇÂ¼.htm
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
  --> Ñ§Î»ÂÛÎÄ¾ÙÀý.htm
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
  --> test[1].htm
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Shellcode.Gen
  --> g14[1].htm
   [DETECTION] Contains detection pattern of the HTML script virus HTML/ADODB.Exploit.Gen
   [WARNING] The file was ignored!

End of the scan: 2007年12月29日  19:03
Used time: 00:23 min

The scan has been done completely.

   0 Scanning directories
   13 Files were scanned
   1 viruses and/or unwanted programs were found
   11 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   12 Files not concerned
   1 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2007-12-29 19:04:01

显示全部楼层 · 发表于 2007-12-29 19:07:13

C:\Users\Wesley\Downloads\1.rar » RAR » test[1].htm - JS/Exploit.BO.NAE trojan

显示全部楼层 · 发表于 2007-12-29 19:09:24

-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.4.2
Virus signature file from: 2007-12-29, 1:27

Scan name: [Custom Scan]
Path to scan: C:\样本 yangpizhi\1.rar

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2007-12-29, 19:09:16
---------------------------------------------------------------------

[Clean] C:\样本 yangpizhi\1.rar->PnpWmkDrv.sys
[Clean] C:\样本 yangpizhi\1.rar->xz[1].htm
[Clean] C:\样本 yangpizhi\1.rar->RegisterCQ.exe
[Clean] C:\样本 yangpizhi\1.rar->whole_counter[1].htm
[Clean] C:\样本 yangpizhi\1.rar->Addall.htm
[Clean] C:\样本 yangpizhi\1.rar->AddUrl.htm
[Clean] C:\样本 yangpizhi\1.rar->标准文献著录举例.htm
[Clean] C:\样本 yangpizhi\1.rar->会议文献著录举例.htm
[Clean] C:\样本 yangpizhi\1.rar->详细记录.htm
[Clean] C:\样本 yangpizhi\1.rar->学位论文举例.htm
[Found exploit] <HTML/IFrameBoF (exact, not disinfectable)> C:\样本 yangpizhi\1.rar->test[1].htm
[Found downloader] <VBS/Psyme.BY (exact, not disinfectable)> C:\样本 yangpizhi\1.rar->g14[1].htm
[Contains infected objects] C:\样本 yangpizhi\1.rar
[Quarantined] C:\样本 yangpizhi\1.rar->g14[1].htm

---------------------------------------------------------------------
Scan ended: 2007-12-29, 19:09:22
Duration: 0:00:06

Scan result:

Scanned files:    1
Infected objects:    2
Disinfected objects:    0
Quarantined files:    1
---------------------------------------------------------------------

显示全部楼层 · 发表于 2007-12-29 19:32:18

---------------------------------------------------------
ewido anti-spyware - 扫描报告
---------------------------------------------------------

+ 创建时间: 19:32:43 2007-12-29

+ 扫描结果:

E:\1.rar/g14[1].htm -> Downloader.Agent.aep : 未进行操作.
E:\1.rar/test[1].htm -> Not-A-Virus.Exploit.HTML.IframeBof : 未进行操作.

::报告结束

显示全部楼层 · 发表于 2007-12-29 19:42:06

McAfee JS/Exploit-BO.gen

显示全部楼层 · 发表于 2007-12-29 19:45:59

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.IeFrame.bm
病毒： Hack.Exploit.Script.JS.Bugexp.a
病毒： Hack.Exploit.Script.JS.WebThunder.c
病毒： Trojan.DL.Script.VBS.Agent.xip

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.24.52

显示全部楼层 · 发表于 2007-12-29 19:51:20

卡巴
已删除: 恶意程序 Exploit.JS.Agent.ar 文件: F:\病毒样本\1.rar/test[1].htm
已删除: 木马程序 Trojan-Downloader.JS.Psyme.ud 文件: F:\病毒样本\1.rar/g14[1].htm

[病毒样本] 测试一下

本帖子中包含更多资源

本帖子中包含更多资源

ESET Smart Security 1

13/8