NOD 32:现场抓系列之Tr/downloader

曲中求

来自驱动中国，NOD 32 IMON反应挺快，页面都还没有跳转就报了：

mofunzone

感觉eq2同学发过

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\head[1].rar'
C:\Documents and Settings\morgan\My Documents\
  head[1].rar
    [0] Archive type: RAR
    --> head[1].js
        [DETECTION] Contains signature of the exploits EXP/Agent.B
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

龙井茶

M版速度真的快。

曲中求

AhnLab-V3	2007.3.31.0	04.02.2007 [td]no virus found
AntiVir	7.3.1.47	04.01.2007	EXP/Agent.B
Authentium	4.93.8	03.31.2007 [td]no virus found
Avast	4.7.936.0	04.02.2007 [td]no virus found
AVG	7.5.0.447	04.01.2007	Exploit
BitDefender	7.2	04.02.2007	Trojan.Downloader.JS.Istbar.L
CAT-QuickHeal	9.00	03.31.2007 [td]no virus found
ClamAV	devel-20070312	04.02.2007 [td]no virus found
DrWeb	4.33	04.02.2007 [td]no virus found
eSafe	7.0.15.0	04.01.2007 [td]no virus found
eTrust-Vet	30.6.3527	03.31.2007 [td]no virus found
Ewido	4.0	04.01.2007	Downloader.IstBar.ai
FileAdvisor	1	04.02.2007 [td]no virus found
Fortinet	2.85.0.0	04.02.2007 [td]no virus found
F-Prot	4.3.1.45	03.30.2007 [td]no virus found
F-Secure	6.70.13030.0	04.02.2007 [td]no virus found
Ikarus	T3.1.1.3	04.02.2007	Trojan-Downloader.JS.IstBar.AI
Kaspersky	4.0.2.24	04.02.2007 [td]no virus found
McAfee	4997	03.31.2007 [td]no virus found
Microsoft	1.2306	04.02.2007 [td]no virus found
NOD32v2	2161	04.01.2007	JS/TrojanDownloader.IstBar.AI
Norman	5.80.02	03.31.2007 [td]no virus found
Panda	9.0.0.4	04.01.2007 [td]no virus found
Prevx1	V2	04.02.2007 [td]no virus found
Sophos	4.16.0	03.30.2007 [td]no virus found
Sunbelt	2.2.907.0	03.31.2007 [td]no virus found
Symantec	10	04.02.2007 [td]no virus found
TheHacker	6.1.6.084	04.02.2007 [td]no virus found
UNA	1.83	03.16.2007	TrojanDownloader.JS.IstBar
VBA32	3.11.3	04.01.2007	Trojan-Downloader.JS.IstBar.ai#22
VirusBuster	4.3.7:9	04.01.2007 [td]no virus found
Webwasher-Gateway	6.0.1	04.02.2007	Exploit.Agent.B

PS现场抓的样本具有一定的流行性和分布性的参考，不是针对任何一个杀软，而是提供这些相对有参考价值的样本给其它没有报的厂商的，这点大家不要误会，特此一并说明一下。

[ 本帖最后由 曲中求 于 2007-4-2 14:49 编辑 ]

solcroft

又只是弹出广告窗口的脚本 要说成毒太勉强了

gggh

卡巴不报警...

小邪邪

已检测