两个网站

显示全部楼层 · 发表于 2008-1-8 20:37:09

费尔报警，可疑文件提交给小红伞，反馈也说有毒
h**p://www.gw.com.cn
h**p://www.daynew.net

显示全部楼层 · 发表于 2008-1-8 20:41:31

显示全部楼层 · 发表于 2008-1-8 20:42:49

1) http://www.daynew.net : 安全
2) http://www.daynew.net/wp-content/themes/default/style.css : 未知网页
3) http://www.daynew.net/?feed=rss2 : 未知网页
4) http://www.daynew.net/xmlrpc.php : 安全
5) http://www.daynew.net/xmlrpc.php?rsd : 安全
6) http://9.douban.com/service/badg ... ;n=12&columns=3 : 未知网页
7) http://www1.itsun.com/counter.php?uuid=1458299&style=icon : 未知网页
8) http://www1.itsun.com/counter.php?uuid=1458299&style=text : 未知网页

危险的链接：0
安全的链接：3
失效的链接：5
页面总数量：8

显示全部楼层 · 发表于 2008-1-8 22:36:15

第一个网站有毒
生成了microsoft.pif和microsoft.vbs 还有fast！老毒物了

第二个网站
windows下生成了quit.exe temp文件夹中生成了svchoost.exe
但是不是有效的WIN32程序

显示全部楼层 · 发表于 2008-1-8 23:48:29

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\Temp.rar'
C:\Documents and Settings\Administrator\My Documents\
  Temp.rar
[0] Archive type: RAR
--> MicroSofts.vbs
   --> fast[1].exe
      [1] Archive type: Runtime Packed
      --> Object
         [DETECTION] Contains suspicious code HEUR/Malware
         [WARNING] Infected files in archives cannot be repaired!
   --> MicroSofts.pif
      [1] Archive type: Runtime Packed
      --> Object
         [DETECTION] Contains suspicious code HEUR/Malware
         [WARNING] Infected files in archives cannot be repaired!
   [WARNING] The file was ignored!

End of the scan: 2008年1月8日  07:47
Used time: 00:04 min

The scan has been done completely.

   0 Scanning directories
   4 Files were scanned
   0 viruses and/or unwanted programs were found
   2 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   4 Files not concerned
   1 Archives were scanned
   3 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-1-8 23:59:59

没反应

显示全部楼层 · 发表于 2008-1-9 11:48:22

小A+微点进那网站没反应

显示全部楼层 · 发表于 2008-1-9 12:32:34

有个利用real漏洞的，费尔报

显示全部楼层 · 发表于 2008-1-10 16:54:26

Starting the file scan:

Begin scan in 'E:\Temp.rar'
E:\Temp.rar
  [0] Archive type: RAR
  --> fast[1].exe
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.MC.1
  --> MicroSofts.pif
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.MC.1
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-1-10 16:55:51

Starting the file scan:

Begin scan in 'E:\111.rar'
E:\111.rar
  [0] Archive type: RAR
  --> 111.html
   [DETECTION] Contains detection pattern of the exploits EXP/RealPlay.X
   [INFO]    The file was deleted!

[已鉴定] 两个网站

回复 4楼冷_冷的帖子

回复 8楼 zzh161 的帖子

[已鉴定] 两个网站

回复 4楼 冷_冷 的帖子

回复 8楼 zzh161 的帖子

回复 4楼冷_冷的帖子