毒网！

显示全部楼层 · 发表于 2008-6-29 10:14:42

SAV10.1.7自动防护报毒！

http://www.znccw.com/yule/tuling/ebook/200704/1435.html

[ 本帖最后由 22680506 于 2008-6-29 11:19 编辑 ]

显示全部楼层 · 发表于 2008-6-29 12:09:55

开了KAV7.0进去没任何反应啊，难道过了卡巴？

显示全部楼层 · 发表于 2008-6-29 13:45:54

肯定有毒，不知有没有中招！汗！

显示全部楼层 · 发表于 2008-6-29 14:11:37

KIS8.0+MICROPOINT进去无反应。

显示全部楼层 · 发表于 2008-6-29 14:35:17

symantec启发

显示全部楼层 · 发表于 2008-6-29 21:20:15

Log is generated by FreShow.
[wide]http://www.znccw.com/yule/tuling/ebook/200704/1435.html
[script]http://www.znccw.com/js/menu.js
[script]http://www.znccw.com/js/stm31.js
[script]http://pstatic.xunlei.com/js/webThunderDetect.js
[script]http://pstatic.xunlei.com/js/base64.js
[script]http://www.znccw.com/thunderForumLinker.js
[script]http://un.so.gougou.com/js/SearchView.js
[script]http://www.znccw.com/JS/Date.js
[frame]http://crm.86xyx.cn/gg.htm
      [script]http://s90.cnzz.com/stat.php?id=879722&web_id=879722
      [frame]http://crm.86xyx.cn/
[script]http://a.alimama.cn/inf.js
[script]http://a.alimama.cn/inf.js
[script]http://a.alimama.cn/inf.js
[script]http://www.znccw.com/yule/GetHits.asp?ArticleID=1435
[script]http://pagead2.googlesyndication.com/pagead/show_ads.js
      [frame]http://pagead2.googlesyndication.com/pagead/+N(b)+' marginwidth=
[script]http://pagead2.googlesyndication.com/pagead/show_ads.js
[script]http://www.znccw.com/yule/Comment.asp?Action=JS&CommentNum=10&ArticleID=1435
[script]http://busjs.vodone.cn/bus/ownerjs/advjs_35/35793/35793_39816_p7_.js
      [script]http://busjs.vodone.cn/liveuni/liveuni.js
         [frame]http://busjs.vodone.cn/liveuni/
[script]http://www.znccw.com/yule/JS/Article_Hot3.js
[script]http://www.znccw.com/yule/JS/Article_Elite3.js
[script]http://s119.cnzz.com/stat.php?id=486278&web_id=486278&show=pic
[script]http://pagead2.googlesyndication.com/pagead/show_ads.js
      [frame]http://pagead2.googlesyndication.com/pagead/+N(b)+' marginwidth=

显示全部楼层 · 发表于 2008-6-29 21:41:38

AVAST
http://html.damm19s.com.cn/down/real11.htm
JS:Agent-AU [Expl]
Exploit
080629-0, 2008-06-29

[ 本帖最后由 lx1234 于 2008-6-29 21:47 编辑 ]

显示全部楼层 · 发表于 2008-6-29 21:48:55

http://xj.dabb20s.net.cn/down/win.exe

显示全部楼层 · 发表于 2008-6-29 21:51:26

2008-6-29 21:51:44 HTTP filter file http://xj.dabb20s.net.cn/down/win.exe probably a variant of Win32/Genetik trojan connection terminated - quarantined 3A8AD2D60C484EE\Administrator Threat was detected upon access to web by the application: C:\Program Files\Internet Explorer\iexplore.exe.

显示全部楼层 · 发表于 2008-6-29 21:57:30

[已鉴定] 毒网！

没有发现问题！

回复 7楼 lx1234 的帖子