广州中华广场电影城网站

显示全部楼层 · 发表于 2008-2-5 14:11:36

http://www.cpcinema.com/

显示全部楼层 · 发表于 2008-2-5 14:12:28

Starting the file scan:

Begin scan in 'E:\rl[1].rar'
E:\rl[1].rar
  [0] Archive type: RAR
  --> rl[1].js
   [DETECTION] Contains detection pattern of the Java script virus JS/Agent.ES
  --> bb[1].js
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Shellcode.Gen
  --> jh[1].htm
   [DETECTION] Contains detection pattern of the Java script virus JS/Dldr.Agent.JL
   [WARNING] The file was ignored!

显示全部楼层 · 发表于 2008-2-5 14:13:52

D:\download\rl[1].rar>>jh[1].htm JS.WindowObject.Exploit.a 可疑程序还未处理

显示全部楼层 · 发表于 2008-2-5 14:14:33

1)http://www.cpcinema.com/css/index.css
2)http://www.cpcinema.com/picnews.js
3)http://www.cpcinema.com/guest/homeapply.asp?type=2&lycount=5&lylen=20&
4)http://www.gzwh.gov.cn/whw/dw/cpt/count/mystat.asp?style=no
5)http://www.cpcinema.com/picnews.js
6)http://www.cpcinema.com/guest/homeapply.asp?type=2&lycount=5&lylen=20&
7)http://www.gzwh.gov.cn/whw/dw/cpt/count/mystat.asp?style=no
8)www.cpcinema.com/

显示全部楼层 · 发表于 2008-2-5 14:15:36

IK、ClamAV pass

显示全部楼层 · 发表于 2008-2-5 14:25:24

Log is generated by FreShow.
[frame]http://www.cpcinema.com/lxyx/index_iframe.asp
      [script]http://%76%63%63%64%2E%63%6E/%31
         [frame]http://xxx.hao1680.com/xx.htm?id=017
            [script]http://xxx.hao1680.com/wm/rl.js
                  [object]http://qqq.521town.com/down.exe
            [frame]http://xxx.hao1680.com/wm/jh.htm
                  [script]http://ppp.chsip.net/wm/11.js
                     [object]http://qqq.aishengho.com/down.exe
                  [script]http://ppp.chsip.net/wm/bb.js
                     [object]http://qqq.aishengho.com/down.exe
                  [script]http://ppp.chsip.net/wm/ppp.js
                     [object]http://qqq.aishengho.com/down.exe
                  [script]http://ppp.chsip.net/wm/lz.js
                     [object]http://qqq.aishengho.com/down.exe

显示全部楼层 · 发表于 2008-2-5 16:04:30

原帖由 dikex 于 2008-2-5 14:25 发表
Log is generated by FreShow.
[frame]http://www.cpcinema.com/lxyx/index_iframe.asp
      [script]http://%76%63%63%64%2E%63%6E/%31
         [frame]http://xxx.hao1680.com/xx.htm?id=017
   ...

NOD过，蜘蛛MULDROP

显示全部楼层 · 发表于 2008-2-5 16:06:10

六翼刺猬

好久不见

显示全部楼层 · 发表于 2008-2-5 16:18:29

Starting the file scan:

Begin scan in 'E:\down.exe'
E:\down.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was deleted!

Starting the file scan:
Begin scan in 'E:\rl.js'
E:\rl.js
   [DETECTION] Contains detection pattern of the Java script virus JS/Agent.ES
   [INFO]    The file was deleted!
Begin scan in 'E:\11.js'
E:\11.js
   [DETECTION] Contains detection pattern of the VBS script virus VBS/Dldr.Agent.uit
   [INFO]    The file was deleted!
Begin scan in 'E:\bb.js'
E:\bb.js
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Shellcode.Gen
   [WARNING] The file was ignored!
Begin scan in 'E:\ppp.js'
E:\ppp.js
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Shellcode.Gen
   [WARNING] The file was ignored!
Begin scan in 'E:\lz.js'
E:\lz.js
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Shellcode.Gen
   [WARNING] The file was ignored!

[ 本帖最后由 Graybird 于 2008-2-5 16:22 编辑 ]

显示全部楼层 · 发表于 2008-2-5 18:01:36

FS飘过

[已鉴定] 广州中华广场电影城网站

回复 6楼 dikex 的帖子

回复 6楼 dikex 的帖子