网马 16x (附网马地址）

FLogo

刚才去解那个网马地址了！这次把恶意网页跟病毒一起上报！
网马地址：hxxp://caomeasdas.cn/a0018291/new.html  (kaba heur)

生成物已打包！不能查杀的请上报吧！
to kaba kill,waiting for reply。。。

[ 本帖最后由 FLogo 于 2009-2-19 16:54 编辑 ]

电影结束了

"Scan ""Shell extension scan"" was finished."
"Infections";"2";"0";"2"
"Folders selected for scanning:";"E:\收集区\TDDOWNLOAD\cx.htm;E:\收集区\TDDOWNLOAD\new.html;"
"Scan started:";"2009年2月19日, 16:25:19"
"Scan finished:";"2009年2月19日, 16:25:20 (less than one second)"
"Total object scanned:";"2"
"User who launched the scan:";"Administrator"

"Infections"
"File";"Infection";"Result"
"E:\收集区\TDDOWNLOAD\new.html";"Virus found Exploit";"Infected"
"E:\收集区\TDDOWNLOAD\cx.htm";"Virus identified Exploit";"Infected"

Sebastian

Starting the file scan:

Begin scan in 'D:\TDDOWNLOAD.zip'
D:\
  TDDOWNLOAD.zip
    [0] Archive type: ZIP
    --> TDDOWNLOAD/14.htm
      [DETECTION] Contains recognition pattern of the HTML/Rce.Gen HTML script virus
      --> TDDOWNLOAD/baidu.cab
        [1] Archive type: CAB (Microsoft)
        --> baidu.exe
          [DETECTION] Is the TR/Spy.Gen Trojan
          [WARNING]   Infected files in archives cannot be repaired!
    --> TDDOWNLOAD/baidu.exe
      [DETECTION] Is the TR/Dropper.Gen Trojan
    --> TDDOWNLOAD/bf.js
      [DETECTION] Contains recognition pattern of the HTML/Shellcode.Gen HTML script virus
    --> TDDOWNLOAD/bfyy.htm
      [DETECTION] Contains recognition pattern of the HTML/Shellcode.Gen HTML script virus
    --> TDDOWNLOAD/cx.htm
      [DETECTION] Contains recognition pattern of the HTML/Rce.Gen HTML script virus
    --> TDDOWNLOAD/cx.js
      [DETECTION] Contains recognition pattern of the HTML/Shellcode.Gen HTML script virus
    --> TDDOWNLOAD/lzz.htm
      [DETECTION] Contains recognition pattern of the HTML/Dldr.Agent.SB HTML script virus
    --> TDDOWNLOAD/lzz.js
      [DETECTION] Contains recognition pattern of the HTML/Shellcode.Gen HTML script virus
      --> TDDOWNLOAD/ms.css
        [1] Archive type: Runtime Packed
        --> Object
    --> TDDOWNLOAD/new.html
      [DETECTION] Contains recognition pattern of the JS/Dldr.IFrame.1618 Java script virus
    --> TDDOWNLOAD/readme.htm
    --> TDDOWNLOAD/real.js
      [DETECTION] Contains recognition pattern of the EXP/RealPlr.CT exploit
    --> TDDOWNLOAD/real10.htm
      [DETECTION] Contains recognition pattern of the HTML/Rce.Gen HTML script virus
    --> TDDOWNLOAD/real11.htm
      [DETECTION] Contains recognition pattern of the HTML/Rce.Gen HTML script virus
    --> TDDOWNLOAD/realplay.js
    [NOTE]      The file was deleted!


End of the scan: 2009年2月19日  17:47
Used time: 00:12 Minute(s)

The scan has been done completely.

      0 Scanning directories
     18 Files were scanned
     14 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      4 Files not concerned
      2 Archives were scanned
      1 Warnings
      1 Notes

[ 本帖最后由 Sebastian 于 2009-2-19 17:46 编辑 ]

kkgh

费尔  JS.SecretActiveX.a

wrq

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL:  http://bbs.kafan.cn/attachment.p ... b8&t=1235032517
Information:  Contains recognition pattern of the HTML/Rce.Gen HTML script virus  


--------------------------------------------------------------------------------
Generated by AntiVir WebGuard 8.0.15.0, AVE 8.2.0.83, VDF 7.1.2.44

ledled

MISS 11 to VB

qianwenxiang

关于:hxxp://caomeasdas.cn/a0018291/new.html解密的日志(自动模式 -  21):

AUTO>http://caomeasdas.cn/a0018291/new.html
AUTO>http://qq.18i16.net/baidu.cab  ●
AUTO>http://caomeasdas.cn/a0018291/fx.htm
AUTO>http://caomeasdas.cn/14.htm
AUTO>http://121.12.173.218/exe1/ms.css  ●
AUTO>http://caomeasdas.cn/as.htm
AUTO>http://caomeasdas.cn/bfyy.htm
AUTO>http://caomeasdas.cn/lzz.htm
AUTO>http://caomeasdas.cn/real10.htm
AUTO>http://caomeasdas.cn/real11.htm
AUTO>http://caomeasdas.cn/cx.htm
AUTO>http://caomeasdas.cn/a0018291/mlink.html
AUTO>http://caomeasdas.cn/a0018291/xlink.html
AUTO>http://caomeasdas.cn/bf.js
AUTO>http://caomeasdas.cn/lzz.js
AUTO>http://caomeasdas.cn/real.js
AUTO>http://qq.18i16.net/exe1/re.css  ●
AUTO>http://caomeasdas.cn/realplay.js
AUTO>http://caomeasdas.cn/cx.js
AUTO>http://caomeasdas.cn/a0018291/swfobject.js
AUTO>http://caomeasdas.cn/a0018291/+

日志由 Redoce1.8第76次修正版于 2009-2-19 18:26:44 生成。

dokhell

查出来

ghj89100062

尊敬的用户，您好！

      
bf.js
cx.htm
cx.js
readme.htm
real.js
real11.htm

以上文件中不包含恶意代码。



非常感谢您向我们提供可疑文件样本，有了您的支持我们将做得更好。
　　

感谢您对卡巴斯基的信任与支持！
我们诚恳地希望您来电或来信寻求关于产品的技术支持服务，如果您有关于卡巴斯基公司的合理化建议也希望您与我们联系。
24小时技术支持热线400-611-6633
中文主页：http://www.kaspersky.com.cn/
技术支持邮箱：support@kaspersky.com.cn
病毒上报邮箱：virus@kaspersky.com.cn

卡巴斯基中国技术服务中心            399号工程师为您服务