小脚马一只，过好多。。。

显示全部楼层 · 发表于 2008-12-3 13:24:27

小脚马一只，过好多。。。

挂马网址：ht tp://www.pcmfw.com/softdown_917.shtml

费尔说：33.rar>>401140[1].js Script.HttpDownloader.ab 病毒还未处理

文件 33.rar 接收于 2008.12.03 06:11:57 (CET)
结果: 2/37 (5.41%)
ht tp://www.virustotal.com/zh-cn/analisis/a4c8267268185b6cf5fa88468406eeaf

VirSCAN.org Scanned Report :
Scanned time : 2008/12/03 13:11:49 (CST)
Scanner results: 3%的杀软(1/39)报告发现病毒
File Name    : 33.rar
File Size    : 2056 byte
File Type    : RAR archive data, v1d, os
MD5          : 246f62518cb6f5c4cf4d28471ef9f388
SHA1          : e892e13a3c4d6483723b44ecbd61cfedc1ebff7a
Online report  : ht tp://virscan.org/report/d586578fd49969b67ccec4d4faccc8a5.html

Scanner       Engine Ver    Sig Ver          Sig Date Time Scan result
a-squared    4.0.0.27       20081202193852 2008-12-02  3.06 -
安博士V3    2008.12.02.02 2008.12.02       2008-12-02  1.11 -
AntiVir       7.9.0.36       7.1.0.176       2008-12-02  1.62 HTML/Crypted.Gen
安天          2.0.18       20081202.1774642  2008-12-02  0.12 -
Arcavir       1.0.5          200811291125    2008-11-29  1.19 -
Authentium    5.1.1          200812022132    2008-12-02  1.06 -
AVAST!       3.0.1          081202-0       2008-12-02  0.00 -
AVG          7.5.52.442    270.9.13/1825    2008-12-02  1.75 -
BitDefender 7.81008.2324708 7.22261          2008-12-03  2.25 -
CA (VET)    9.0.0.143    31.6.6240       2008-12-03  2.23 -
ClamAV       0.94.1       8714             2008-12-03  0.00 -
Comodo       3.0          669             2008-12-02  0.81 -
CP Secure    1.1.0.715    2008.12.02       2008-12-02  5.89 -
Dr.Web       4.44.0.9170    2008.12.03       2008-12-03  3.63 -
ewido       4.0.0.2       2008.12.02       2008-12-02  3.41 -
F-Prot       4.4.4.56       20081202       2008-12-02  1.04 -
F-Secure    5.51.6100    2008.12.03.01    2008-12-03  0.06 -
飞塔          2.81-3.117    9.771          2008-12-02  0.14 -
GData       19.1773/19.132  20081202       2008-12-02  2.74 -
ViRobot       20081202       2008.12.02       2008-12-02  0.65 -
Ikarus       T3.1.01.45    2008.12.03.71948  2008-12-03  3.71 -
江民杀毒    11.0.706       2008.12.02       2008-12-02  1.46 -
卡巴斯基    5.5.10       2008.12.02       2008-12-02  0.03 -
金山毒霸    2008.9.8.18    2008.12.3.11    2008-12-03  0.73 -
迈克菲       5.3.00       5452             2008-12-02  2.51 -
Microsoft    1.4205       2008.12.03       2008-12-03  3.89 -
mks_vir       2.01          2008.12.02       2008-12-02  3.04 -
Norman       5.93.01       5.93.00          2008-12-02  5.49 -
熊猫卫士    9.05.01       2008.12.02       2008-12-02  2.58 -
趋势科技    8.700-1004    5.688.02       2008-12-02  0.02 -
Quick Heal    10.00          2008.12.03       2008-12-03  0.84 -
瑞星          20.0          21.06.12.00    2008-12-02  0.24 -
Sophos       2.81.2       4.36             2008-12-03  1.93 -
Sunbelt       4674          4674             2008-11-04  0.87 -
赛门铁克    1.3.0.24       20081202.004    2008-12-02  0.04 -
nProtect    2008-12-03.00 2727708          2008-12-03  3.19 -
The Hacker    6.3.1.2       v00171          2008-12-01  0.44 -
VBA32       3.12.8.10    20081202.1409    2008-12-02  1.36 -
VirusBuster 4.5.11.10    10.94.13/729611 2008-12-03  0.92 -

显示全部楼层 · 发表于 2008-12-3 13:33:09

怀疑误报！

显示全部楼层 · 发表于 2008-12-4 18:53:18

红伞KILL~~~~~~~``

显示全部楼层 · 发表于 2008-12-4 19:01:12

document.write(_tmxst("<html>
<head>
<title></title>
<script language="javascript"> function ValidCheck(s){ var url_down = "http://download.uusee.com/pop1/dazhong1/UUSEE_dazhong1_Setup_[soft_id].exe"; var sDownloadLink = url_down; if ( !ocxstatus() ) { if( is_ie() ) { window.open(sDownloadLink); return false; } else { alert("如果您使用FireFox无法正常观看，请使用IE浏览器打开此页面！"); return false; } } else { try { window.open(s,"_self"); } catch(e) { window.open(sDownloadLink); return false; } } return true;}function is_ie(){ var agt=navigator.userAgent.toLowerCase(); var ie = ((agt.indexOf("msie") != -1)); if ( ie ) { return true; } else { return false; } }function ocxstatus(){ var UUPObj; try { /*UUPObj = new ActiveXObject("UPDATEC2.UpdateC2Ctrl.1");*/ UUPObj = new ActiveXObject("UUPLAYEROCX.UUPlayerOCXCtrl.1"); if ( typeof UUPObj != "undefined" ) { return true; } } catch(e) { return false; }} function ck(){ ifadpage("http://download.uusee.com/pop1/dazhong1/UUSEE_dazhong1_Setup_[soft_id].exe"); ValidCheck("uusee://Play({9BBF0499-BB9F-A360-1013-B700FFFFFF34},007大破量子危机,1,102,,,/#1)");} </script>
</head>
<body>
<p><a style="cursor: pointer" onclick="ck();"><img class="" alt="" border="0" src="http://img.8le8le.com/img/fodder/mo_ban/image/468-60.gif" /></a></p>
</body>
</html>"));

复制代码

显示全部楼层 · 发表于 2008-12-4 19:13:18

的确怀疑是误报，估计是UUSEE，解出来是这个样子的
[code]document.write(_tmxst("<html>
<head>
      <title></title>
      <script language="javascript"> function ValidCheck(s){
            var url_down = "http://download.uusee.com/pop1/dazhong1/UUSEE_dazhong1_Setup_[soft_id].exe";
         var sDownloadLink = url_down;
   if ( !ocxstatus() ) {
      if( is_ie() )  {
      window.open(sDownloadLink);
   return false;
   }
      else  {
      alert("濡傛灉鎮ㄤ娇鐢‵ireFox鏃犳硶姝ｅ父瑙傜湅锛岃?浣跨敤IE娴忚?鍣ㄦ墦寮

显示全部楼层 · 发表于 2008-12-4 19:30:05

你们欺负偶...

[已鉴定] 小脚马一只，过好多。。。

回复 4楼 5楼