来自于毒网的7个

zzh161

hxxp://calm-sea.com/bbs

太震撼了，感觉这里挂的几个网址我前两天才见过，现在似乎都处理过了，好多都报启发

冷冷

与此贴重复
http://bbs.kafan.cn/viewthread.php?tid=188936&extra=page%3D1

Graybird

Starting the file scan:

Begin scan in 'E:\新建文件夹\新建文件夹.rar'
E:\新建文件夹\新建文件夹.rar
  [0] Archive type: RAR
  --> bak.css
      [DETECTION] Contains suspicious code HEUR/Malware
  --> newrl.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> test.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> u125.exe
      [DETECTION] Contains detection pattern of the worm WORM/Cekar.A
  --> baidu.exe
      [DETECTION] Contains suspicious code HEUR/Malware
  --> bd.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [WARNING]   The file was ignored!

The file 'a.exe' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

上报antivir~

[ 本帖最后由 Graybird 于 2008-1-16 16:32 编辑 ]

无尽藏海

D:\Downloads\样本\新建文件夹4.rar » RAR » u125.exe - probably unknown NewHeur_PE virus

zzh161

确实挺无语的，红伞那么多启发，大家赶紧上报吧

觅寒枚

这些个下载者病毒，唉！可恶！

冷冷

原帖由 Graybird 于 2008-1-16 16:28 发表
Starting the file scan:

Begin scan in 'E:\新建文件夹\新建文件夹.rar'
E:\新建文件夹\新建文件夹.rar
  [0] Archive type: RAR
  --> bak.css
      [DETECTION] ...

查MD5后 有一些是重复的 那包只有两个病毒

jick117

打齐了补丁进去了，AVK报警如下：

When opening file "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\KRQT01Q9\9041[1].htm" the virus "Trojan-Downloader.HTML.IFrame.do" from engine "Engine A" has been detected. File cleaned: no. File deleted: no. Quarantine: no.
When opening file "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\9VZNXXGE\r[1].htm" the virus "Exploit.JS.RealPlr.av" from engine "Engine A" has been detected. File cleaned: no. File deleted: no. Quarantine: no.
When opening file "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GT6VS5UV\r[1].htm" the virus "Exploit.JS.RealPlr.av" from engine "Engine A" has been detected. File cleaned: no. File deleted: no. Quarantine: no.
When opening file "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WPARGDER\htm[1].htm" the virus "Trojan-Downloader.JS.Agent.avj" from engine "Engine A" has been detected. File cleaned: no. File deleted: no. Quarantine: no.
When opening file "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WPARGDER\9041[1].htm" the virus "Trojan-Downloader.HTML.IFrame.do" from engine "Engine A" has been detected. File cleaned: no. File deleted: no. Quarantine: no.
When opening file "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WPARGDER\9041[2].htm" the virus "Trojan-Downloader.HTML.IFrame.do" from engine "Engine A" has been detected. File cleaned: no. File deleted: no. Quarantine: no.
When opening file "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\9VZNXXGE\IE[1].htm" the virus "Trojan-Downloader.JS.Psyme.yi" from engine "Engine A" has been detected. File cleaned: no. File deleted: no. Quarantine: no.
When opening file "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WH6N016N\IE[1].htm" the virus "Trojan-Downloader.JS.Psyme.yi" from engine "Engine A" has been detected. File cleaned: no. File deleted: no. Quarantine: no.
When opening file "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SXYHO3AZ\IE[1].htm" the virus "Trojan-Downloader.JS.Psyme.yi" from engine "Engine A" has been detected. File cleaned: no. File deleted: no. Quarantine: no.

leonfg

ZA的spy site block还是很NB的哈哈！

a750828

McAfee W32/MumaWOW