费尔拦下的

显示全部楼层 · 发表于 2008-2-7 05:00:45

C:\Documents and Settings\小飞侠.net\桌面\新建文件夹 (2)\新建文件夹 (2).rar>>001.rar>>06014[1].htm       JS.Decoder.v       病毒       还未处理
C:\Documents and Settings\小飞侠.net\桌面\新建文件夹 (2)\新建文件夹 (2).rar>>002.rar>>bf[1].htm       JS.Decoder.v       病毒       还未处理
C:\Documents and Settings\小飞侠.net\桌面\新建文件夹 (2)\新建文件夹 (2).rar>>003.rar>>d[1].htm       JS.Decoder.v       病毒       还未处理
C:\Documents and Settings\小飞侠.net\桌面\新建文件夹 (2)\新建文件夹 (2).rar>>004.rar>>realCAN5GBJK.htm       JS.Decoder.af       病毒       还未处理
C:\Documents and Settings\小飞侠.net\桌面\新建文件夹 (2)\新建文件夹 (2).rar>>005.rar>>real[1].htm       JS.Decoder.af       病毒       还未处理

文件 001.rar 接收于 2008.02.06 22:34:42 (CET)
结果: 0/32 (0%)--惨，全过哦！
ht tp://www.virustotal.com/zh-cn/analisis/2be67f1c9ba1ba2d017b2f865a0a059f
文件 002.rar 接收于 2008.02.06 22:42:52 (CET)
结果: 0/32 (0%)--惨，全过哦！
ht tp://www.virustotal.com/zh-cn/analisis/94b74c54e97dce3f0a2374ed4f7ce2b8
文件 003.rar 接收于 2008.02.06 22:47:51 (CET)
AVG 7.5.0.516 2008.02.06 JS/Psyme.QE
结果: 1/32 (3.13%)--总算爆一只！
ht tp://www.virustotal.com/zh-cn/analisis/23f70404ae5b36187a41aea19c653d3f
文件 004.rar 接收于 2008.02.06 22:56:32 (CET)
AntiVir 7.6.0.62 2008.02.06 EXP/RealPlr.BK
AVG 7.5.0.516 2008.02.06 JS/Psyme.QH
Webwasher-Gateway 6.6.2 2008.02.06 Exploit.RealPlr.BK
结果: 3/32 (9.38%)
ht tp://www.virustotal.com/zh-cn/analisis/ce6c15e251eb5f68203bb0f047a2cfec
文件 005.rar 接收于 2008.02.06 23:09:35 (CET)
AntiVir 7.6.0.62 2008.02.06 EXP/RealPlr.BK
AVG 7.5.0.516 2008.02.06 JS/Psyme.QH
Webwasher-Gateway 6.6.2 2008.02.06 Exploit.RealPlr.BK
结果: 3/32 (9.38%)
ht tp://www.virustotal.com/zh-cn/analisis/8c5ce76797b59d484e7c8d38a6a21e78

[ 本帖最后由小飞侠.net 于 2008-2-7 06:17 编辑 ]

显示全部楼层 · 发表于 2008-2-7 06:37:57

Hello,

06014[1].htm_ - Trojan-Downloader.JS.Psyme.zm,
bf[1].htm_ - Exploit.JS.Agent.fo,
d[1].htm_ - Trojan-Downloader.JS.Psyme.zn,
realCAN5GBJK.htm_, real[1].htm_ - Exploit.JS.RealPlr.ci

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vyacheslav Zakorzhevsky
Virus analyst, Kaspersky Lab.

显示全部楼层 · 发表于 2008-2-7 07:21:31

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\新建文件夹_(2).rar'
C:\Documents and Settings\Administrator\My Documents\
  新建文件夹_(2).rar
  新建文件夹_(2).rar:Zone.Identifier
[0] Archive type: RAR
--> 001.rar
      [1] Archive type: RAR
      --> 06014[1].htm
--> 002.rar
      [1] Archive type: RAR
      --> bf[1].htm
--> 003.rar
      [1] Archive type: RAR
      --> d[1].htm
--> 004.rar
      [1] Archive type: RAR
      --> realCAN5GBJK.htm
         [DETECTION] Contains detection pattern of the exploits EXP/RealPlr.BK
         [WARNING] Infected files in archives cannot be repaired!
--> 005.rar
      [1] Archive type: RAR
      --> real[1].htm
         [DETECTION] Contains detection pattern of the exploits EXP/RealPlr.BK
         [WARNING] Infected files in archives cannot be repaired!
      [WARNING] The file was ignored!

End of the scan: 2008年2月6日  15:21
Used time: 00:03 min

The scan has been done completely.

   0 Scanning directories
   12 Files were scanned
   2 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   10 Files not concerned
   6 Archives were scanned
   3 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-7 07:22:49

Starting the file scan:

Begin scan in 'E:\新建文件夹 (2).rar'
E:\新建文件夹 (2).rar
  [0] Archive type: RAR
--> 004.rar
   [1] Archive type: RAR
   --> realCAN5GBJK.htm
      [DETECTION] Contains detection pattern of the exploits EXP/RealPlr.BK
--> 005.rar
   [1] Archive type: RAR
   --> real[1].htm
      [DETECTION] Contains detection pattern of the exploits EXP/RealPlr.BK
   [INFO]    The file was deleted!

3721761    06014[1].htm    2.57 KB    UNDER ANALYSIS
3721763    bf[1].htm    13.78 KB    UNDER ANALYSIS
3721764    d[1].htm    6.34 KB    UNDER ANALYSIS

上报~

显示全部楼层 · 发表于 2008-2-7 09:22:10

又遇到graybird了
卡巴我就不扫了

显示全部楼层 · 发表于 2008-2-7 10:06:19

AVAst 飘过

显示全部楼层 · 发表于 2008-2-7 11:15:29

2008-2-7 11:21:24 Kernel File 'E:\virus\新建文件夹.rar' was sent to ESET for analysis.

显示全部楼层 · 发表于 2008-2-7 11:39:16

deleted: Trojan program Trojan-Downloader.JS.Psyme.zm File: C:\Documents and Settings\Owner\×ÀÃæ\ÐÂ½¨ÎÄ¼þ¼Ð_(2).rar/001.rar/06014[1].htm
deleted: malware Exploit.JS.Agent.fo File: C:\Documents and Settings\Owner\×ÀÃæ\ÐÂ½¨ÎÄ¼þ¼Ð_(2).rar/002.rar/bf[1].htm
deleted: Trojan program Trojan-Downloader.JS.Psyme.zn File: C:\Documents and Settings\Owner\×ÀÃæ\ÐÂ½¨ÎÄ¼þ¼Ð_(2).rar/003.rar/d[1].htm
deleted: malware Exploit.JS.RealPlr.ci File: C:\Documents and Settings\Owner\×ÀÃæ\ÐÂ½¨ÎÄ¼þ¼Ð_(2).rar/004.rar/realCAN5GBJK.htm
deleted: malware Exploit.JS.RealPlr.ci File: C:\Documents and Settings\Owner\×ÀÃæ\ÐÂ½¨ÎÄ¼þ¼Ð_(2).rar/005.rar/real[1].htm

显示全部楼层 · 发表于 2008-2-7 12:52:43

IK 飘~~~

显示全部楼层 · 发表于 2008-2-7 14:14:22

rising20.30.20未认得！

[病毒样本] 费尔拦下的

本帖子中包含更多资源

卡车回复

11/0