解swf

sbbdms

Kaspersky miss abe.exe
TO KL

傻猪猪米走鸡

E:\virus\abe.rar > RAR > abe.exe - 可能是 Win32/Jalous 蠕虫 的变种 - 是已删除对象的一部分

sam.to

相信是利用flash player的漏洞

sam.to

Filename         Result
4561.swf          MALWARE

The file '4561.swf' has been determined to be 'MALWARE'. Our analysts named the threat EXP/Flash.adf. The term "EXP/" denotes malware that is able to detect and use certain security vulnerabilities whereby the attacker can get control of the system.Detection will be added to our virus definition file (VDF) with one of the next updates.
Filename         Result
4562.swf          MALWARE

The file '4562.swf' has been determined to be 'MALWARE'. Our analysts named the threat EXP/Flash.adg. The term "EXP/" denotes malware that is able to detect and use certain security vulnerabilities whereby the attacker can get control of the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

lhc-yuan

红伞第一个没报，第二个报了

capsshift

现在红伞第一个也报了。

Kitman

abe.exe
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL:         http://bbs.kafan.cn/attachment.p ... a205c5&t=1212766085
Information:         Is the Trojan horse TR/Hijacker.Gen

Generated by AntiVir WebGuard 8.0.13.0, AVE 8.1.0.55, VDF 7.0.4.156

[ 本帖最后由 Kitman 于 2008-6-6 23:30 编辑 ]

乘上白云

SWF可以挂毒咯。

IllusionWing

卡巴咋又换格式了....

解答时间：
1、为什么SWF可以挂马？
因为FlashPlayer自身有一个栈溢出漏洞，畸形的SWC(注意不是SWF,SWC是SWF内建的一种格式)文件会导致FlashPlayer执行本地文件。而Flash中本身就有下载的组件XMLControl。

[ 本帖最后由 gankeyu 于 2008-6-6 23:42 编辑 ]

sbbdms

Hello. This file is already detected. Please update your bases.
-----------------
Regards, Vladimir Lebedev
Virus Analyst, Kaspersky Lab.

Ph.: +7(095) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com


> Attachment: abe.rar

已删除：病毒 Worm.Win32.Downloader.on        文件　: D:\软件\其它\v\k\abe.rar/abe.exe//PE_Patch//UPack