几只网马，看看有几家报

显示全部楼层 · 发表于 2008-2-7 23:59:16

如题，共7只
有6只加了下密。其中test和test2是同一只，不同的是test是明文，test2加密过

[ 本帖最后由 rappar 于 2008-2-8 16:59 编辑 ]

显示全部楼层 · 发表于 2008-2-8 00:06:15

Begin scan in 'C:\Documents and Settings\Administrator\桌面\WM.rar'
C:\Documents and Settings\Administrator\桌面\WM.rar
  [0] Archive type: RAR
  --> test2.htm
   [DETECTION] Contains suspicious code HEUR/Exploit.HTML
  --> 0733.htm
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Shellcode.Gen
   [WARNING] The file was ignored!

End of the scan: 2008年2月8日  00:06
Used time: 00:06 min

The scan has been done completely.

   0 Scanning directories
   8 Files were scanned
   0 viruses and/or unwanted programs were found
   2 Files were classified as suspicious:
   0 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   8 Files not concerned
   1 Archives were scanned
   1 Warnings
   0 Notes

显示全部楼层 · 发表于 2008-2-8 00:07:14

大蜘蛛过

显示全部楼层 · 发表于 2008-2-8 00:08:01

貌似大蜘蛛对网马不太敏感

显示全部楼层 · 发表于 2008-2-8 00:09:01

网马就不试了

显示全部楼层 · 发表于 2008-2-8 00:12:21

VBS:Malware-gen
avast!报一个

显示全部楼层 · 发表于 2008-2-8 00:12:36

2008-2-8 JAY00:08:22 Untreated Malware Medium C:\Documents and Settings\Owner\桌面\WM.rar/0733.htm Postponed
2008-2-8 JAY00:08:22 Untreated Trojan program High C:\Documents and Settings\Owner\桌面\WM.rar/6014.htm Postponed
2008-2-8 JAY00:08:22 Untreated Malware Medium C:\Documents and Settings\Owner\桌面\WM.rar/8.htm Postponed
2008-2-8 JAY00:08:22 Untreated Trojan program High C:\Documents and Settings\Owner\桌面\WM.rar/test2.htm Postponed

显示全部楼层 · 发表于 2008-2-8 00:14:10

卡巴表现不错

显示全部楼层 · 发表于 2008-2-8 00:16:16

FS 4个
结果: 找到 4 恶意软件
Exploit.HTML.IESlice.r (病毒)
D:\Virus\Test\d\0733.htm 操作: 删除
Trojan-Downloader.HTML.Agent.bx (病毒)
D:\Virus\Test\d\6014.htm 操作: 删除
Exploit.JS.RealPlr.bu (病毒)
D:\Virus\Test\d\8.htm 操作: 删除
Trojan-Downloader.JS.Agent.ua (病毒)
D:\Virus\Test\d\test2.htm 操作: 删除

显示全部楼层 · 发表于 2008-2-8 00:25:23

IK

I:\virus\WM.rar:\6.htm
I:\virus\WM.rar:\test2.htm - Signature 'Exploit.JS.ADODB.Stream.e#102' found
I:\virus\WM.rar:\8.htm
I:\virus\WM.rar:\test.htm
I:\virus\WM.rar:\6014.htm
I:\virus\WM.rar:\2.htm
I:\virus\WM.rar:\0733.htm
I:\virus\WM.rar

8 Files scanned
(1 Archiv with 7 files)
1 Signature found
0 Suspect code-parts found
Used time: 0:00.110

[可疑文件] 几只网马，看看有几家报

本帖子中包含更多资源