刚整理今天畅游发现的三个挂马，测试一下你的杀软

19881419

请测试，压缩包密码：virus



更新了一下 ，四个网页文件。

[ 本帖最后由 19881419 于 2008-6-6 23:49 编辑 ]

IllusionWing

这个东西放到样本区比较好...

sbbdms

卡巴杀3

已删除：木马程序 Trojan-Downloader.JS.Agent.bnu        文件　: D:\软件\其它\v\k\网马\网马\4.html
已删除：木马程序 Exploit.HTML.IESlice.gx        文件　: D:\软件\其它\v\k\网马\网马\lz.htm
已删除：木马程序 Trojan-Downloader.JS.Multi.cc        文件　: D:\软件\其它\v\k\网马\网马\yes.htm

miss one,TO KL

Kitman

Begin scan in 'C:\Documents and Settings\Administrator\桌面\网马'
C:\Documents and Settings\Administrator\桌面\网马\4.html
      [DETECTION] Contains detection pattern of the HTML script virus HTML/Dldr.Agent.BR
      [NOTE]      A backup was created as '48b15e42.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\网马\lz.htm
      [DETECTION] Contains detection pattern of the HTML script virus HTML/Shellcode.Gen
      [NOTE]      A backup was created as '48775e8e.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\网马\lz1.htm
      [DETECTION] Contains detection pattern of the HTML script virus HTML/Shellcode.Gen
      [NOTE]      A backup was created as '487a5e8e.qua'  ( QUARANTINE )
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\网马\yes.htm
      [DETECTION] Contains suspicious code HEUR/HTML.Malware
      [NOTE]      The fund was classified as suspicious.
      [NOTE]      A backup was created as '48bc5e79.qua'  ( QUARANTINE )

onlyxchuan

大蜘蛛   无反应

Ceker

Hack.Exploit.Script.HTML.Vml.a

瑞星100%

barbara

看了Ceker在样本区的几条发言 让人不禁联想到“枪手”二字

tanlimo

http://hah.kdi23.cn/uppao.exe
http://www.balldu.com/uu.exe（不能下）
http://ccc.52gol.com/xx.exe（不能下）

建议直接上网址

Log is generated by FreShow.
    [frame]14.htm
    [frame]rl.htm
    [frame]new.htm
    [frame]lz.htm
    [frame]bf.htm
    [frame]xl.htm

[ 本帖最后由 tanlimo 于 2008-6-7 01:08 编辑 ]

袋鼠吱吱

McAfee 2

a402782048

没带影子在奔着  我还是小心点算了