http://www.111nv.cn/ad.html

sam.to

Kaspersky Internet Security 7.0

The requested URL http://www.111nv.cn/ad.html is infected with Trojan-Downloader.HTML.IFrame.gu virus

mofunzone

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\ad.html'
C:\TDDOWNLOAD\
  ad.html
      [DETECTION] Contains detection pattern of the HTML script virus HTML/Dldr.Iframe.DL
      [NOTE]      The file was deleted!

Starting the file scan:

Begin scan in 'E:\AV\ad.html'
E:\AV\ad.html
      [DETECTION] Contains detection pattern of the HTML script virus HTML/Dldr.Iframe.DL
      [NOTE]      The file was deleted!

Starting the file scan:
Begin scan in 'E:\AV\xx.html'
E:\AV\xx.html
      [DETECTION] Contains suspicious code HEUR/HTML.Malware
      [NOTE]      The fund was classified as suspicious.
      [NOTE]      The file was moved to '4859c867.qua'!

[ 本帖最后由 Exia 于 2008-5-15 13:17 编辑 ]

solcroft

http://user1.33-25.net/bak.css

红心王子

2008-5-15 13:25:16,TrojanAgent.2792.zfxq,木马,Administrator,C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\K41ON707\bak[1].css,Realtime scan

icka

htp://user1.33205.net/bak.css
htp://user1.33-22.net/bak.css
htp://user1.33-25.net/bak.css

另外一个CSS看大小应该是一样的文件吧，没看MD5。

Virus or unwanted program 'HEUR/Malware [heuristic]'
detected in file 'E:\AV\bak.css.
Action performed: Deny access

Palkia

TrojanAgent.2792.zfxq

秋叶濛濛

不分析了
hxxp://www.haohiyo.cn上挂的也是这个东西

Log is generated by FreShow.
[wide]http://www.haohiyo.cn
    [frame]http://www.too121.cn/7.htm?eeee
        [frame]http://www.too121.cn/news.html
            [object]http://user1.33-25.net/bak.css

啊弥陀佛

微点砍掉