23个脚本网马

显示全部楼层 · 发表于 2009-7-17 13:59:46

avira miss 14

显示全部楼层 · 发表于 2009-7-17 14:00:14

DW 2个

红伞 9个
a2 12个

显示全部楼层 · 发表于 2009-7-17 14:01:14

a2
D:\kafan\JS\092[1].js 已检测: Exploit.JS.Mult!IK
D:\kafan\JS\1326_4[1].htm 已检测: HTML.Infected.WebPage!IK
D:\kafan\JS\ct122121[1].htm 已检测: Virus.JS.Downloader.T!IK
D:\kafan\JS\ctqm[1].htm 已检测: HTML.Small!IK
D:\kafan\JS\d[1].js 已检测: HTML.Silly!IK
D:\kafan\JS\go[1].jpg 已检测: HTML.Shellcode!IK
D:\kafan\JS\go[2].jpg 已检测: HTML.Shellcode!IK
D:\kafan\JS\logo[1].htm 已检测: Exploit.JS.Agent!IK
D:\kafan\JS\of[1].htm 已检测: Exploit.JS.CVE!IK
D:\kafan\JS\real[1].js 已检测: Virus.JS.RealPlr!IK
D:\kafan\JS\ytfll[1].htm 已检测: Exploit.JS.Agent!IK
D:\kafan\JS\z[1].htm 已检测: HTML.Crypted!IK

已扫描

文件: 23
跟踪记录: 0
Cookies: 0
进程: 0

已发现

文件: 12
跟踪记录: 0
Cookies: 0
进程: 0
注册表键: 0

Avira
Starting the file scan:

Begin scan in 'D:\kafan\JS'
D:\kafan\JS\092[1].js
[DETECTION] Contains recognition pattern of the JS/Agent.BDQ Java script virus
[NOTE]    The file was deleted!
D:\kafan\JS\ct122121[1].htm
[DETECTION] Contains recognition pattern of the JS/Dldr.Agent.aad Java script virus
[NOTE]    The file was deleted!
D:\kafan\JS\d[1].js
[DETECTION] Contains recognition pattern of the HTML/Silly.Gen HTML script virus
[NOTE]    The file was deleted!
D:\kafan\JS\go[1].jpg
[DETECTION] Contains recognition pattern of the HTML/Shellcode.Gen HTML script virus
[NOTE]    The file was deleted!
D:\kafan\JS\go[2].jpg
[DETECTION] Contains recognition pattern of the HTML/Shellcode.Gen HTML script virus
[NOTE]    The file was deleted!
D:\kafan\JS\index[1].htm
[DETECTION] Contains recognition pattern of the HTML/Infected.WebPage.Gen HTML script virus
[NOTE]    The file was deleted!
D:\kafan\JS\logo[1].htm
[DETECTION] Contains recognition pattern of the EXP/Agent.akg.1 exploit
[NOTE]    The file was deleted!
D:\kafan\JS\ytfll[1].htm
[DETECTION] Contains recognition pattern of the EXP/Agent.akg.2 exploit
[NOTE]    The file was deleted!
D:\kafan\JS\z[1].htm
[DETECTION] Contains recognition pattern of the HTML/Silly.Gen HTML script virus
[NOTE]    The file was deleted!

End of the scan: 2009年7月17日  14:01
Used time: 00:00 Minute(s)

The scan has been done completely.

   1 Scanned directories
   23 Files were scanned
   9 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   9 files were deleted
   0 Viruses and unwanted programs were repaired
   0 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   14 Files not concerned
   0 Archives were scanned
   0 Warnings
   9 Notes

显示全部楼层 · 发表于 2009-7-17 14:09:30

IKARUS - T3SCAN V1.32.10.0 (WIN32)
      T3 V1.01.64
      Copyright (c) 2006 - 2009 by Ikarus Software.
      All rights reserved.

Signature-database from 17.7.2009 04:40:25 (Build: 73050)

E:\JS\092[1].js - Signature 'Exploit.JS.Mult' found
E:\JS\1326_4[1].htm - Signature 'HTML.Infected.WebPage' found
E:\JS\ct122121[1].htm - Signature 'Virus.JS.Downloader.T' found
E:\JS\ctqm[1].htm - Signature 'HTML.Small' found
E:\JS\d[1].js - Signature 'HTML.Silly' found
E:\JS\go[1].jpg - Signature 'HTML.Shellcode' found
E:\JS\go[2].jpg - Signature 'HTML.Shellcode' found
E:\JS\logo[1].htm - Signature 'Exploit.JS.Agent' found
E:\JS\of[1].htm - Signature 'Exploit.JS.CVE' found
E:\JS\real1[1].js - Signature 'Exploit.JS.RealPlr' found
E:\JS\real[1].js - Signature 'Virus.JS.RealPlr' found
E:\JS\ytfll[1].htm - Signature 'Exploit.JS.Agent' found
E:\JS\z[1].htm - Signature 'HTML.Crypted' found

      23 Files scanned
      (0 Archives with 0 files)
      13 Signatures found
      0 Suspect code-parts found
      Used time: 0:00.156

显示全部楼层 · 发表于 2009-7-17 14:33:59

mcafee miss20，to

显示全部楼层 · 发表于 2009-7-17 14:36:29

费尔miss all

显示全部楼层 · 发表于 2009-7-17 14:42:22

我觉得MP会miss all的。。

显示全部楼层 · 发表于 2009-7-17 14:48:12

ytfll[1].htm
360[1].htm
ctxxz[1].htm
360[2].htm
360[3].htm
logo[1].htm
以上CLEAN----以下有malicious code
ctqm[1].htm
of[1].htm
z[1].htm
1326_4[1].htm
4825[1].htm

*.js
z[1].css

[ 本帖最后由黑衣~魂于 2009-7-17 14:51 编辑 ]

显示全部楼层 · 发表于 2009-7-17 14:53:26

E:\JS\JS\of[1].htm - JS/Exploit.CVE-2009-1136.A.Gen 特洛伊木马

[可疑文件] 23个脚本网马

本帖子中包含更多资源

IKARUS比A2多了一个，NOD32只发现一个。