爱客者下载网页已被挂马？大家小心

曲中求

刚刚进去下载个NOD 32试试，目前装在机子上的NOD 32马上提示，网络监控一时忘了截图，由于没有开高效能，所以还有个文件监控提示：

IMON日志：Time Module Object Name Threat Action User Information
2007-3-29 17:13:53 IMON file http://g.ads8.com/pds_k/view.php?id=1996&uid=13932&rePlace=0&visits=1&a_width=0&a_height=0&a_class=9&a_pic_url=&ed_str=http://www.ikzhe.com/softdown.asp?softid=230&ed_ads_open_class=0&ed_ads_logo=0&ed_ads_tempstop=&ed_ads_webtest=0&ed_ads_group= JS/TrojanDownloader.IstBar.G trojan Connection terminated WWW-5688FBC3B6B\用户名

AMON截图：

[ 本帖最后由 曲中求 于 2007-3-29 17:48 编辑 ]

曲中求

以后还是开着高效能好了。。。呵呵！安全点。

mr_zhj

一个广告程序而已

曲中求

NOD 32 提示 Tr/downloader，好像不是adware

曲中求

结果出来了：

AhnLab-V3	2007.3.27.0	03.29.2007 [td]no virus found
AntiVir	7.3.1.44	03.29.2007 [td]no virus found
Authentium	4.93.8	03.29.2007 [td]no virus found
Avast	4.7.936.0	03.28.2007 [td]no virus found
AVG	7.5.0.447	03.28.2007	Exploit
BitDefender	7.2	03.29.2007	Trojan.Downloader.JS.Istbar.B
CAT-QuickHeal	9.00	03.28.2007 [td]no virus found
ClamAV	devel-20070312	03.29.2007	Trojan.Clicker.HTML.Agent
DrWeb	4.33	03.29.2007 [td]no virus found
eSafe	7.0.15.0	03.29.2007 [td]no virus found
eTrust-Vet	30.6.3522	03.29.2007 [td]no virus found
Ewido	4.0	03.28.2007	Downloader.IstBar.ai
FileAdvisor	1	03.29.2007 [td]no virus found
Fortinet	2.85.0.0	03.29.2007 [td]no virus found
F-Prot	4.3.1.45	03.28.2007 [td]no virus found
F-Secure	6.70.13030.0	03.29.2007 [td]no virus found
Ikarus	T3.1.1.3	03.29.2007 [td]no virus found
Kaspersky	4.0.2.24	03.29.2007 [td]no virus found
McAfee	4994	03.28.2007 [td]no virus found
Microsoft	1.2306	03.29.2007 [td]no virus found
NOD32v2	2152	03.28.2007	JS/TrojanDownloader.IstBar.AI
Norman	5.80.02	03.28.2007 [td]no virus found
Panda	9.0.0.4	03.28.2007 [td]no virus found
Prevx1	V2	03.29.2007 [td]no virus found
Sophos	4.15.0	03.27.2007 [td]no virus found
Sunbelt	2.2.907.0	03.24.2007 [td]no virus found
Symantec	10	03.29.2007 [td]no virus found
TheHacker	6.1.6.080	03.23.2007 [td]no virus found
UNA	1.83	03.16.2007	TrojanDownloader.JS.IstBar
VBA32	3.11.2	03.29.2007	Trojan-Downloader.JS.IstBar.ai#16
VirusBuster	4.3.7:9	03.28.2007	JS.IstBar.B
Webwasher-Gateway	6.0.1	03.29.2007 [td]no virus found

风野胤

大部分启发报了

icka

强弹广告的吧

Anycall-D908

我以前也提过这个样本了,我也不知道是不是误报.

蓝色牛仔裤

2007-3-29 18:05:07        Safe'n'Sec Scan report

2007-3-29 18:05:07        Scan start time:        2007-3-29 18:05:07

2007-3-29 18:05:07        Action applied to detected malware:       
2007-3-29 18:05:07        Scan level:        Strict

2007-3-29 18:05:08        D:\view[2].rar        Infected        Trojan-Downloader.JS.IstBar.ai#16        Moved to quarantine
2007-3-29 18:05:09        Scan area:

2007-3-29 18:05:09        D:\view[2].rar
2007-3-29 18:05:09       
2007-3-29 18:05:09        Objects scanned:        1
2007-3-29 18:05:09        Malicious objects detected:        1
2007-3-29 18:05:09        Malicious objects deleted / removed:        1

2007-3-29 18:05:09        Scan completion time:        2007-3-29 18:05:09

ALEXBLAIR

卡巴确定为下载者了

Hello.
New malicious software was found in the attached file (Trojan-Downloader.JS.IstBar.ai).
It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.