跑了好久的ESS终于挂掉

显示全部楼层 · 发表于 2008-10-13 16:13:22

扫描未见异常

显示全部楼层 · 发表于 2008-10-13 16:17:31

利用QuickTime的漏洞？

显示全部楼层 · 发表于 2008-10-13 16:42:17

原帖由 tanlimo 于 2008-10-13 16:17 发表
利用QuickTime的漏洞？

中招现象开始是提示有quicktime可关联的文件，询问是否使用quicktime关联。。

是不是就是用quicktime漏洞，我是菜鸟不敢说，我把quicktime删掉了，

为了iPod装了iTunes就会夹带装上quicktime，可恶的apple~

[ 本帖最后由 avast! 于 2008-10-13 16:43 编辑 ]

显示全部楼层 · 发表于 2008-10-13 16:44:03

上去转了下，没有出现异常，可能是我的系统没这漏洞吧.......

显示全部楼层 · 发表于 2008-10-13 16:49:30

<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=shift_jis">
<META http-equiv=Content-Language content=ja>
<meta http-equiv="adimage" content="201">
<meta http-equiv="adcolor" content="0">
<meta http-equiv="adalign" content="right">
<script language="javascript">
with(document)
{
open("text");
var now = new Date();
var hour = now.getHours();
if (hour == 0)
{
writeln("<meta http-equiv="Page-Exit" content="revealTrans(Duration=3.0,Transition=12)">");
writeln("<TITLE>地獄通信</TITLE></HEAD>");
writeln("<BODY bgColor=#000000 oncontextmenu="return false" ondragstart="return false" onselectstart="return false">");
writeln("<EMBED SRC="http://blog9.fc2.com/w/waine/file/jigoku.mp3", WIDTH="0", HEIGHT="0" CONTROLS="FALSE" PLAY_LOOP="FALSE" HIDDEN="true">");
writeln("<P align=center>　</P>");
writeln("<P align=center>　</P>");
writeln("<FORM method=GET name=frm action="http://waine.blog9.fc2.com/file/jigokushoujol.htm" onSubmit="return (document.frm.kill.value!='')">");
writeln("<P align=center><FONT color=#ffffff>あなたの怨み、晴らします。</FONT></P>");
writeln("<P align=center><INPUT size=30 name=kill></P>");
writeln("<P align=center><INPUT type=submit value=' 送信 ' name=submit></P>");
writeln("<P align=center>　</P>");
writeln("</FORM></BODY></HTML>");
}
else
{
writeln("<TITLE>404 Not Found</TITLE>");
writeln("</HEAD>");
writeln("<BODY>");
writeln("<H1>Not Found</H1>");
writeln("The requested URL /kk was not found on this server.");
writeln("<P>");
writeln("<HR>");
writeln("<ADDRESS>");
writeln("hellish world/1.3.33 Server at jigokutsushin.net Port 80");
writeln("</ADDRESS>");
writeln("</BODY>");
writeln("</HTML>");
}
close();
}

复制代码

<HTML><HEAD><META http-equiv=Content-Type content="text/html; charset=shift-
jis"><META HTTP-EQUIV=Refresh CONTENT="15; URL=http://www.jigokushoujo.com/">:
<META http-equiv=Content-Language content=ja><meta http-equiv="adimage"
content="201"> <meta http-equiv="adcolor" content="0"><meta http-equiv="adalign"
content="right"><TITLE>地獄通信</TITLE></HEAD><BODY style="background:url
(http://blog9.fc2.com/w/waine/file/jigoku_back.jpg) #010B03 no-repeat right
bottom;" bgColor="#010B03"oncontextmenu="return false" ondragstart="return false"
onselectstart="return false" leftmargin="200"><DIV align="right"
style="position:absolute;left:-1000px;visibility:hidden;"><EMBED
SRC="http://blog9.fc2.com/w/waine/file/ai_voice.mp3", WIDTH="0", HEIGHT="0"
CONTROLS="FALSE" PLAY_LOOP="FALSE" HIDDEN="true"><script language="JavaScript"
src="http://analyzer2.fc2.com/analyzer.js?
uid=476828"></script></DIV><br><br><br><br><br><font color="#662222"
size="5"><strong><b>受け取リました。<br><br>地獄少女
<b></strong></font></BODY></HTML>

复制代码

[ 本帖最后由 tanlimo 于 2008-10-13 16:56 编辑 ]

显示全部楼层 · 发表于 2008-10-13 18:06:33

小红伞完美查杀！

显示全部楼层 · 发表于 2008-10-13 18:16:31

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00213943.

We received the following archive files:

File ID FilenameSize (Byte)Result
25158634 ESET Smart Security.rar671.38 KBOK

A listing of files contained inside archives alongside their results can be found below:
File ID FilenameSize (Byte)Result
25158426 egui..exe 1.38 MB CLEAN

Please find a detailed report concerning each individual sample below:
FilenameResult egui..exe CLEAN

The file 'egui..exe' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

另一个Pending中

[ 本帖最后由 leonfg 于 2008-10-13 18:20 编辑 ]

显示全部楼层 · 发表于 2008-10-13 18:38:23

金山 0

显示全部楼层 · 发表于 2008-10-13 20:25:10

McAfee miss

显示全部楼层 · 发表于 2008-10-13 23:31:02

Dear Don Johnson,

Thank you for your submission.
The detection for this threat will be included in our next signature update.

Regards,

Virus Researcher
ESET spol. s r.o.

[ 本帖最后由 EQ2 于 2008-10-13 23:41 编辑 ]

[已鉴定] 跑了好久的ESS终于挂掉