红伞报的5个，EAV杀其中one

schumi小粉

正在扫描日志
病毒库版本: 3767 (20090115)
日期: 2009-1-15  时间: 17:43:24
已扫描的磁盘、文件夹和文件: C:\Documents and Settings\Administrator\桌面\新建文件夹\5.rar
C:\Documents and Settings\Administrator\桌面\新建文件夹\5.rar > RAR > 5\C42A35FBd01 > ZIP > InstallAVg_77025304.exe3 - Win32/Adware.Antivirus2008 应用程序
已扫描的对象数: 5
发现的威胁数: 1
已清除对象数:0
完成时间: 17:43:35  总扫描时间: 11 秒 (00:00:11)

Begin scan in 'C:\'
C:\pagefile.sys
    [WARNING]   The file could not be opened!
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\bxqselhi.default\Cache\C42A35FBd01
    [0] Archive type: ZIP
    --> InstallAVg_77025304.exe3
      [DETECTION] Is the TR/FakeXPA.A.107 Trojan
    [NOTE]      A backup was created as '49a104cb.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\3GC9W8W3\fx[1].htm
    [DETECTION] Contains recognition pattern of the JS/Dldr.IFrame.JD Java script virus
    [NOTE]      A backup was created as '49ca0511.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\3GC9W8W3\new[1].htm
    [DETECTION] Contains recognition pattern of the HTML/Malicious.ActiveX.Gen HTML script virus
    [NOTE]      A backup was created as '49e604fe.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\CRAKUV19\w79[1].htm
    [DETECTION] Contains recognition pattern of the JS/Dldr.IFrame.JG Java script virus
    [NOTE]      A backup was created as '49a804d1.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\J0UE2RZ1\c0x[1].htm
    [DETECTION] Contains recognition pattern of the HTML/Shellcode.Gen HTML script virus
    [NOTE]      A backup was created as '49e704cb.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!

End of the scan: 2009年1月15日  17:40
Used time: 00:32 Minute(s)
The scan has been canceled!
    573 Scanning directories
   3882 Files were scanned
      5 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      5 files were deleted
      0 files were repaired
      5 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
   3876 Files not concerned
     71 Archives were scanned
      1 Warnings
      5 Notes

qianwenxiang

html解出来的
http://wwww.ttfafb.com/wl.css

Palkia

dreams521

TO KL

28654621

D:\download\5.rar>>5\c0x[1].htm        JS.Decoder.t        病毒        还未处理
D:\download\5.rar>>5\C42A35FBd01>>InstallAVg_77025304.exe3        TrojanPSW.QQpass.esj.lrtp        木马        还未处理
D:\download\5.rar>>5\new[1].htm        JS.RealExploit.d        病毒        还未处理

lingbo110120

NOD只会报 真正下载到计算机的有毒文件
这种网页脚本之类的不会直接报的

The EQs

Dear Don Johnson,

Thank you for your submission.
The detection for this threat will be included in our next signature update.

Regards,

Senior Virus Researcher
ESET spol. s r.o.

dreams521

2009-01-15_110310.gif,
c0x[1].htm,
w79[1].htm

No malicious code were found in these files.

C42A35FBd01.InstallAVg_77025304.exe3 - not-a-virus:FraudTool.Win32.Antivirus2009.ey

New potentially risk software was found in this file. It's detection will be included in the next update. Thank you for your help.

new[1].htm - Trojan-Downloader.JS.Iframe.adt

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

schumi小粉

EAV经过升级后杀
C:\Documents and Settings\Administrator\桌面\新建文件夹\5.rar > RAR > 5\2009-01-15_110310.gif - JS/TrojanDownloader.Iframe.NCS 特洛伊木马 - 是已删除对象的一部分
C:\Documents and Settings\Administrator\桌面\新建文件夹\5.rar > RAR > 5\c0x[1].htm - JS/TrojanDownloader.Agent.NKC 特洛伊木马 - 是已删除对象的一部分
C:\Documents and Settings\Administrator\桌面\新建文件夹\5.rar > RAR > 5\C42A35FBd01 > ZIP > InstallAVg_77025304.exe3 - Win32/Adware.Antivirus2008 应用程序
C:\Documents and Settings\Administrator\桌面\新建文件夹\5.rar > RAR > 5\new[1].htm - JS/TrojanDownloader.Iframe.NCQ 特洛伊木马 - 是已删除对象的一部分
C:\Documents and Settings\Administrator\桌面\新建文件夹\5.rar > RAR > 5\w79[1].htm - JS/TrojanDownloader.Iframe.NCR 特洛伊木马 - 是已删除对象的一部分

小A杀一个，微点没反应