随便百度了下，就。。。

lg560852

看看附件吧

sanhu35

关于:解密的日志(全体输出-  34):

Level 1>http://qq.90356.com.cn/wm/index.htm
Level 1>http://aa.18dd.net/ww/new05.htm?075
Level 1>http://aa.18dd.net/ww/new05.htm?013
Level 1>http://xxx.llxxcx.cn/pv.htm
Level 1>http://aa.llsging.com/ww/new05.htm?075
Level 1>http://xxx.llxxcx.cn/wm.htm
Level 1>http://aa.chaina-game.cn/reg.htm
Level 1>http://aaa.77xxmm.cn/new858.htm?075
Level 1>http://aaa.1l1l1l.com/error/404.html
Level 1>http://www.shijiediyi.net/one/hao8.htm?005
Level 1>http://www.shijiediyi.net/one/hao8.htm?015
Level 1>http://wb.shijiediyi.net/one/hao8.htm?024
Level 1>http://www.virusworm.org/default.htm
Level 1>http://www.socosoco.cn/goal/mm.htm
Level 1>http://wb.shijiediyi.net/one/hao8.htm?017
Level 1>http://1.hao929.cn/1/4.js
Level 1>http://www.51laa.com/cc888.htm?003
Level 1>http://adsl.jk33581.com/web/6032453.htm
Level 1>http://aaa.faba01.com/hao116.htm
Level 1>http://www.haole555.cn/tj1/main.htm
Level 1>http://bb.congtouzailai.net/one/hao8.htm?005
Level 1>http://cc.haowangma.com/one/hao5.htm?015
Level 1>http://cc.zuiyige.net/one/hao5.htm?058
Level 1>http://www.oiok01.net/s1.htm?bei
Level 1>http://hoo111.net/s1.htm?bei
Level 1>http://yiduaner.cn/page/rnb.htm?mor
Level 1>http://sernx.cn/page/rnb.htm?mor
Level 1>http://fengshenge.cn/page/rnb.htm?mor01
Level 1>http://www.hby007.cn/one/a26.htm?02
Level 1>http://www.eqw002.cn/one/a26.htm
Level 1>http://www.zdq004.cn/one/a26.htm
Level 1>http://www.wrmfwp.cn/one/a26.htm
Level 1>http://www.wrmfwo.cn/one/a26.htm
Level 1>http://www.hryspan.cn/one/a26.htm

很多失效了
主要是下面这些。。


关于:解密的日志(部分输出-  10):
Level 2>http://zlwrnm7.cn/a279/fxx.htm
Level 3>http://zlwrnm7.cn/a279/real.html
Level 3>http://zlwrnm7.cn/a279/real.htm
Level 3>http://zlwrnm7.cn/a279/glworld.html
Level 3>http://zlwrnm7.cn/a279/thunder.html
Level 3>http://zlwrnm7.cn/uu.htm
Level 3>http://zlwrnm7.cn/sina.htm
Level 3>http://zlwrnm7.cn/a279/ms06014.htm
Level 3>http://zlwrnm7.cn/a279/ss.html
Level 3>http://zlwrnm7.cn/a279/fx.htm



to
http://down.hs7yue.cn/down/ko.css
http://www.oiuytr.net/new/a279.css

[ 本帖最后由 sanhu35 于 2008-10-21 11:16 编辑 ]

lg560852

还有好多，其实，你可以囧度下domain:http://hoo111.net/s1.htm?bei

Nerazzurri

HTML:IFrame-R [Trj]

sanhu35

domain 也没用  domain  是以存在的地址。
http://hoo111.net/s1.htm?bei 根本就失效了
很多都失效 懒得一个个验证

[ 本帖最后由 sanhu35 于 2008-10-21 11:37 编辑 ]

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Desktop\lilyfireworks.zip'
C:\Users\morgan\Desktop\
  lilyfireworks.zip
    [0] Archive type: ZIP
    --> lilyfireworks.txt
      [DETECTION] Contains recognition pattern of the HTML/IFrame.YD HTML script virus
    [NOTE]      The file was deleted!

尤金卡巴斯基

To KL

AhnLab-V3	2008.10.18.0	2008.10.21	-
AntiVir	7.9.0.5	2008.10.21	HTML/IFrame.YD
Authentium	5.1.0.4	2008.10.21	HTML/IFrame
Avast	4.8.1248.0	2008.10.15	HTML:IFrame-R
AVG	8.0.0.161	2008.10.20	JS/Downloader.Agent
BitDefender	7.2	2008.10.21	Trojan.IFrame.AL
CAT-QuickHeal	9.50	2008.10.21	-
ClamAV	0.93.1	2008.10.21	Exploit.Iframe-1
DrWeb	4.44.0.09170	2008.10.21	-
eSafe	7.0.17.0	2008.10.19	-
eTrust-Vet	31.6.6161	2008.10.21	-
Ewido	4.0	2008.10.20	-
F-Prot	4.4.4.56	2008.10.20	-
F-Secure	8.0.14332.0	2008.10.21	-
Fortinet	3.113.0.0	2008.10.21	HTML/IFrame.FLB!tr
GData	19	2008.10.21	HTML:IFrame-R
Ikarus	T3.1.1.44.0	2008.10.21	HTML.Infected.WebPage
K7AntiVirus	7.10.500	2008.10.20	-
Kaspersky	7.0.0.125	2008.10.21	-
McAfee	5409	2008.10.21	-
Microsoft	1.4005	2008.10.21	Exploit:HTML/IframeRef.gen
NOD32	3541	2008.10.21	-
Norman	5.80.02	2008.10.20	-
Panda	9.0.0.4	2008.10.20	-
PCTools	4.4.2.0	2008.10.20	-
Prevx1	V2	2008.10.21	-
Rising	20.67.12.00	2008.10.21	Trojan.DL.Script.JS.Agent.lqi
SecureWeb-Gateway	6.7.6	2008.10.21	Script.IFrame.YD
Sophos	4.34.0	2008.10.21	Mal/Iframe-F
Sunbelt	3.1.1741.1	2008.10.21	-
Symantec	10	2008.10.21	-
TheHacker	6.3.1.0.121	2008.10.21	-
TrendMicro	8.700.0.1004	2008.10.21	-
VBA32	3.12.8.8	2008.10.21	-
ViRobot	2008.10.21.1429	2008.10.21	-
VirusBuster	4.5.11.0	2008.10.20	-

tod20010_ren

感觉AVG 7.5就是一个摆设,来回整了几个病毒和木马都不认识,真悲哀.

AVIRA C全部干掉,没办法,实力啊.

qigang

老掉牙的。

尤金卡巴斯基

Hello,

lilyfireworks.txt - Trojan-Downloader.HTML.IFrame.um

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Ostroverkhov Vladimir
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: lilyfireworks.zip